v0.4.6: review the surfaces nobody had reviewed — 20 findings in the collectors, render and ignore paths

[deva0x]

Follows #3. A fourth adversarial round, pointed for the first time at the code the previous five rounds never examined. 20 findings, and the worst were not in the heavily-audited redact(). Suite 526 → 656, 87/87 mutations caught.

The lesson of this round

Five rounds hammered redact() and the capability guard. Round 4 asked instead: what has nobody attacked? The answer — collectors, render, ignore rules — held the most serious defects in the project's history.

A broken helper silently emptied its category

lsof, osascript, scutil, kextstat, systemextensionsctl all returned "" on a timeout or non-zero exit, so the collector reported an empty category. The diff reads that as "every listener was removed"; the next day, "all of them are new" with the attacker's port among them; and if the tool stays broken, both snapshots are empty and the report reads:

Nothing changed. 🎉        # while a backdoor listens on 4444

SECURITY.md promises a skip with a note. Only a raised error delivers that. Compounding it, coverage_lost required a tool stamp — which only 4 of 13 categories have — so the nine loudest categories could never reach the ORANGE LOST VISIBILITY finding at all.

An unsigned binary named sh fell out of RED (regression from v0.4.5)

The interpreter caveat I added in 0.4.5 cleared the suspicious flag, and the basename is attacker-chosen. cp miner ~/Library/.../sh dropped an unsigned payload from RED to YELLOW, stopped --notify firing, and replaced "unsigned" with a reassuring explanation. Now appended, never substituted — and an Apple-signed binary copied outside the system paths is suspicious in its own right.

Collectors that could not see the attack

Collector	Was	Now
Browser extensions	fingerprinted by display name — overwriting background.js, adding <all_urls>/cookies/webRequest, swapping the .xpi all invisible	version + manifest hash; version dirs sort numerically (1.10 was reading as older than 1.9)
Login items	keyed and fingerprinted by display name, no path — a planted app named after an existing item was invisible, and no signature check was possible	keyed on path, trust-checked
Kernel extensions	startswith("com.apple") — naming a rootkit com.apple.driver.AudioHelper removed it from the report	every reverse-DNS id collected
Listeners	"no port overlap ⇒ churn" dropped 8080 → 4444 silently	only all-ephemeral multi-port sets are churn
Linux units	.socket/.path persistence never collected	collected
Applications	trust check rebuilt the path from the key, printing another app's signature	real path stored

Severity and disclosure

Creating a tracked config file was YELLOW while editing one was ORANGE — so planting ~/.zshenv (sourced by every zsh) was the quieter attack. And an ignore rule can no longer silence a critical finding; suppressions are now disclosed, because the README's own example rule can be matched by an attacker-chosen process name.

redact() leaks closed

An unlisted auth scheme absorbed the mask and printed the credential (Authorization: SSWS <token> — a real .curlrc line); a quoted value past the 512-char bound leaked its tail; a separator run (:=, =>, ==) left the secret as the next token.

Three of my own fixes were reverted after measuring them

A whitespace-scheme rule masked pam_deny.so and, worse, masked the wrong token while leaving real secrets (19 property cases). A mask-tail pass broke compositionality by eating shell separators (25 cases). A payload-path exemption leaked base64 tokens — base64 uses /, so they match "looks like a path". All three are documented residuals, not silent reverts.

Upgrade note

Login-item keys change from display name to path, so existing items appear once as removed+added — the same one-time transition as the (system) autostart tag.

🤖 Generated with Claude Code