Sweet QuaDreams or Nightmare Before Christmas? Dissecting an iOS 0-Day
summary
Analysis ties forensic traces to a QuaDream/Rain iOS zero‑click exploit that abuses iCloud Calendar via calendar CalDAV CDATA XML injection to reach the phone’s XML parser, then chains parsing bugs plus sandbox/entitlement and PAC bypasses to run payloads. Reverse engineering and Frida validation show payloads doing dylib injection to hook adid (to generate future 2FA codes), exfiltrate calls/mic/photos/location/keychain, and run from /private/var/.../staging (subdD) with no durable persistence; tests use Apple’s archived CalDAV server and infrastructure maps to ~10 countries.
AI-written summary · about
chapters (12)
- 0:00Introduction and context
- 2:00Understanding iOS attacks
- 4:57Defense and security updates
- 7:01Discovery and collaboration
- 11:58The mercenary spyware industry
- 14:34Infrastructure attribution
- 15:52Technical security mitigations
- 18:28Spyware functionality
- 23:25Exploiting iCloud services
- 28:16Calendar injection exploit
- 33:59Closing thoughts and defense
- 36:06Q&A and final remarks
related talks
34mTowards Discovering Remote Code Execution Vulnerabilities in Apple FaceTime
58mUncovering OWASP’s Mobile Risks in iOS Apps
42mLook, No Hands! -- The Remote, Interaction-less Attack Surface of the iPhone
40mStealing User's Identity
45mThe Nightmare Behind The Cross Platform Mobile Apps Dream
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
36mStealing user’s identity
20mProtocol Prying: Systematic Vulnerability Research in the AirDrop and Android Quick...