The Last Line of Defense: Understanding and Attacking Apple File System on iOS
summary
Shows a concrete exploit that bypasses APFS snapshot-based remount mitigation to make the read-only root appear writable by swapping mount internals: create a writable root mount (using tmutil), grab the new mount’s mount monitor (extent tree pointers), replace the original mount’s monitor in kernel memory, and restore credentials to avoid sandbox panics. Requires existing root plus arbitrary kernel R/W, fixes vnode refcounts and clears spec/mounted flags, and only achieves a temporary remount in RAM (non‑persistent); also explains kernel credential toggle and why naive fixes cause panics.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:17APFS basics
- 4:09Previous attacks on APFS
- 6:10APFS's mitigation
- 10:22Our new bypass
- 21:48Other bypass methods
related talks
36mThe Price of Compatibility: Defeating macOS Kernel Using Extended File Attributes
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
33mA Deep Dive into A Vulnerability Apple Deems Unexploitable
26mDive into Apple UserFS (Userspace Filesystem)
44mExploiting Unpatched iOS Vulnerabilities for Fun and Profit
54mSubverting Apple Graphics: Practical Approaches to Remotely Gaining Root
40m(P)FACE into the Apple core and exploit to root
50mTake a Jailbreak -Stunning Guards for iOS Jailbreak-