Apple's Predicament: NSPredicate Exploits on iOS and macOS
summary
Claim: Apple limits on NSPredicate are fully bypassable on iOS 16.3 beta using serialization tricks and existing Foundation APIs to get arbitrary writes and call signed function pointers. Attack chain uses XPC predicates, a visitor bypass that sets expression types to zero, arbitrary write primitives via getValue / getCString to unset the predicate security flag, and a remaining dlsym-like gadget plus applyFunctionInfo to call exports. Exploits hit privileged daemons like springboard, os_logd and contextstored and a demo copies user notifications, and the techniques reliably work until Apple changes predicate typing.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 0:45Why Care About Predicates
- 1:17iOS Security Challenges
- 2:27Objective-C Background
- 3:38What Are NS Predicates
- 5:02Interprocess Communication
- 6:18Predicate Parsing
- 8:03Scripting Capabilities
- 9:22Apple's Predicate Security
- 11:24Bypassing Mitigations
- 13:33Forced Entry Analysis
- 15:20Exploiting the Denial Lists
- 17:25Arbitrary Memory Writes
- 18:53Modern Mitigations
- 20:11Type Restrictions Bypasses
- 22:21Function Call Bypass
- 24:22Predicate Visitor Vulnerability
- 25:54Vulnerable Processes
- 27:35Exploiting CoreDuet
- 29:40Springboard Attack Demo
- 31:27Live Technical Difficulties
- 33:37Conclusions and Future
related talks
29miOS Runtime Manipulation (PWND)
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
40mIntroduction into Reverse Engineering and iOS Security
27miOS Attack Vectors and how to protect your app
24mDeconstructing The Beast: A Deep Dive Into JIT Compilation Attacks In iOS
38mSide Channel Attacks: Lessons Learned Or Troubles Ahead?
35mAttacking iPhone XS Max
44mExploiting Unpatched iOS Vulnerabilities for Fun and Profit