HexBrain

Internet Bug Bounty · Report #265232

Unsecure: Bypass alerts of Little Flocker / Little Snitch / HandsOff! / BlockBlock (same concept can be applied to other security tools)

Validstatus
5upvotes
12 Dec 2017disclosed

How it was found

Hello,

This PoC is using a simple yet powerful trick to detect when Little Flocker, Little Snitch, HandsOff! or BlockBlock window appear then automatically click on the "Allow" button by calculating the distance (so it works pretty well on every resolution). The window only appear for a fraction of second.

More details about this and PoC at https://github.com/pwnsdx/Unsecure

I am submitting this as HandsOff! finally fixed the issue.

Regards, Sabri.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original