Skip to content

Commit 3a4ac2f

Browse files
authored
Clean up citation and add extra location for Spotlight importers (#511)
1 parent 728a99b commit 3a4ac2f

1 file changed

Lines changed: 7 additions & 2 deletions

File tree

docs/docs/cookbook/faa.md

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -100,8 +100,7 @@ except sudo itself. With this installed, users will have to use
100100
## Lockdown Spotlight Importers
101101

102102
Spotlight importers have been used as [a persistence trick for a
103-
while](https://theevilbit.github.io/beyond/beyond_0011/) and were
104-
recently used in the
103+
while](https://theevilbit.github.io/beyond/beyond_0011/), going back to Patrick Wardle's [talks in 2015](https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-Writing-Bad-A-Malware-For-OS-X.pdf). This was recently used in the
105104
[Sploitlight exploit](https://www.microsoft.com/en-us/security/blog/2025/07/28/sploitlight-analyzing-a-spotlight-based-macos-tcc-vulnerability/).
106105

107106
```xml
@@ -116,6 +115,12 @@ recently used in the
116115
<key>IsPrefix</key>
117116
<true/>
118117
</dict>
118+
<dict>
119+
<key>Path</key>
120+
<string>/Library/Spotlight</string>
121+
<key>IsPrefix</key>
122+
<true/>
123+
</dict>
119124
</array>
120125
<key>Options</key>
121126
<dict>

0 commit comments

Comments
 (0)