This wasn’t very straightforward though.'ĭo you research vulnerabilities on Apple's products? We’d love to hear from you. 'For example, I found a TXT file force-downloaded from Tor browser, when opened can bypass Gatekeeper and leak the real IP address of the victim without any warning. 'One of the first bugs I discovered using this showed me that Gatekeeper doesn’t quarantine TXT files even if they were downloaded from a suspicious website,' Yibelo wrote in his blog. 'I knew immediately something would go wrong if I could inject *ANY* html.' 'Realizing the TXT file had colors and bold parts was really eerie,' Yibelo said. And a hacker could take advantage of those features with some HTML code hidden in an innocent looking text file. Yibelo said he was surprised to find out that TextEdit had features such as calling to other local files and folders on the hard disk, and even making a request to a remote server. 'And that's basically gameover I believe!' Yibelo told me in an online chat, referring to the possibility of achieving Remote Code Execution, or RCE. As an example, Yibelo said that chaining his bug with a 2016 bug found by a Google Project Zero researcher would have allowed a hacker to run javascript on the target's computer. Yibelo told Motherboard that the bug he found could have been used along other bugs to do much more damage than just revealing a victim's IP address, such as taking control of the victim's machine. Apple patched the bug last year, according to the company's security update notes.

Download text edit for mac