Look, No Hands! -- The Remote, Interaction-less Attack Surface of the iPhone
summary
The research demonstrates about ten fully remote, interaction‑less iPhone bugs across SMS/MMS, Visual Voicemail/IMAP, Mail and iMessage; tooling includes a SMS simulator and an iMessage sender plus an IMAP fuzzer and a Frida-based message interceptor. A visual‑voicemail flow forces devices to fetch attacker‑controlled IMAP servers; one IMAP use‑after‑free leaks pointers. NSKeyedArchiver deserialization chains enable a remote file read (SMS DB ≈40KB) and several memory‑corruption primitives; an exploit demo uses iMessage as a crash oracle to break ASLR and pop calc in about six minutes.
AI-written summary · about
chapters (5)
- 0:00Start
- 23:21Idea 4
- 25:53Problems with cycles
- 28:54What's the attack surface of an NSURL?
- 39:48Conclusions
related talks
29mDancing on the Lip of the Volcano: Chosen Ciphertext Attacks on Apple iMessage
42mDiscovering and Exploiting Novel Security Vulnerabilities in Apple ZeroConf
58mUncovering OWASP’s Mobile Risks in iOS Apps
48mMobile Security Attacks: A Glimpse from the Trenches
44mExposing Critical Threats In Millions Of Connected Devices
01h 01mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
35mPractical Mobile App Attacks By Example