The exploit worked by dropping malicious Spotlight plugins into user-writable directories. Spotlight would automatically ...