It Just (Net)works: The Truth About iOS 7's Multipeer Connectivity Framework
summary
Shows the actual network stack: Bonjour service advertisement, a TCP plist exchange that sends peer IDs and a list of candidate IP/UDP ports, ICE connectivity checks, and a UDP payload channel that is DTLS but always prefixes records with an unexplained DTLS-with-leading-d0 byte so packet tools choke. Connection settings (encryption/auth) are sent before certificate validation, enabling a downgrade attack that can turn encryption optional into cleartext; default is optional/no-auth, so only encryption required + mutual auth is safe. A packet-inspection tool used to find these issues is released.
AI-written summary · about
chapters (11)
- 0:00Intro
- 1:26Multipeer Connectivity
- 4:02Motivation
- 5:35MC API - Authentication
- 6:10Test Setup
- 10:23Mystery Protocol #1
- 12:53Mystery Protocol #2
- 14:48Pro Packet Trace Editing
- 16:40MC Security Analysis
- 21:38MCEncryption Optional Downgrade Attack
- 22:03Conclusion
related talks
42mDiscovering and Exploiting Novel Security Vulnerabilities in Apple ZeroConf
40mTrust in Apple's Secret Garden: Exploring & Reversing Apple's Continuity Protocol
48mNothing but Net: Leveraging macOS's Networking Frameworks to Heuristically Detect Malware
49mLeveraging MacOS's Networking Frameworks to Heuristically Detect Malware
50mFinding Vulnerabilities In iOS/MacOS Networking Code
46miOS Trustjacking: Trust Has a Price
34mTowards Discovering Remote Code Execution Vulnerabilities in Apple FaceTime
47mSecurity Threats & Mitigations for iOS Developers