yaseeng

3 ms·

1. 1.▲
   by yaseeng 6mo ago

   Completely agree on the encryption point. Apple controls the entire stack and could mandate FileVault encryption by default. The fact that it's opt-in is a weird decision that hasn't caught up with their security posture elsewhere
2. 2.▲
   by yaseeng 6mo ago

   I come from an Arabic-speaking household so my English can be a bit funky sometimes, sorry. However I did use Claude to help format the CVSS tables and polish the grammar in the formal Apple submission (I was 17 submitting to a major compan
3. 3.▲
   by yaseeng 6mo ago

   You're right that Terminal is accessible via Utilities, but Target Disk Mode and Terminal both require an admin password. Safari bypassed that authentication entirely, writing directly to protected system locations with no admin passwo
4. 4.▲
   by yaseeng 6mo ago

   Actually this is a distinction worth clarifying, in Recovery Mode, Terminal does require mounting the data volume first, which typically prompts for an admin password. Safari bypassed this entirely, writing directly to protected system loca
5. 5.▲
   by yaseeng 6mo ago

   For context: I submitted this to Apple in September 2025 and waited 6 months before publishing. Apple closed both reports citing FileVault as a mitigation, which is technically accurate but FileVault is opt-in and many people disable it dur
6. 6.▲
   Root Persistence via macOS Recovery Mode Safari(yaseenghanem.com)

   26 points by yaseeng 6mo ago|17 comments