Towards Discovering Remote Code Execution Vulnerabilities in Apple FaceTime
summary
Reverse engineering of FaceTime reveals concrete exploit paths: the APNS/PSD notification chain yields a zero-click notification path that accepts attacker-controlled blobs, and UDP packets parsed by an identity daemon expose a UDP magic-number handler whose memcpy length is attacker-controlled. PoCs trigger leaks from malformed UUIDs (server filtering mitigates some leaks), heap and stack overflows during RTP/FEC reassembly, and a compiler-induced misplaced stack canary that makes iOS stack overflows exploitable; crashes turn into practical RCE with object layout grooming.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 12:23I10 Service
- 14:57Attack Service
- 16:16UUID Leak
- 19:38Paper Overflow
- 24:20Stack Overflow
- 26:47Stack Cookie
- 28:57Compiler Issue
- 29:36Other Attack Surface
- 32:14Conclusion
related talks
42mDiscovering and Exploiting Novel Security Vulnerabilities in Apple ZeroConf
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
41mA Worm in the Apple: Wormable Zero-Click RCE in AirPlay... (Avi Lumelsky, Uri Katz)
40m(P)FACE into the Apple core and exploit to root
50mFinding Vulnerabilities In iOS/MacOS Networking Code
20mProtocol Prying: Systematic Vulnerability Research in the AirDrop and Android Quick...
31mZero-Touch-Pwn: Abusing Zoom's Zero Touch Provisioning for Remote Attacks on Desk Phones
44mExposing Critical Threats In Millions Of Connected Devices