D1T1 - Real World Attacks Against Secure Elements
summary
Demonstrates a practical attack against Apple’s global MFi/WAC provisioning that lets an attacker sitting nearby impersonate any accessory, relay mDNS via hostapd, and coax an MFi secure element into provisioning Wi‑Fi keys to the attacker. Uses simple Python tools (example mooks packet forwarder and small relay scripts), a fake Wi‑Fi beacon and an instrumented accessory firmware; exploit works in live demo, code is published, vulnerability was reported spring 2017 and mitigations are still rolling out.
AI-written summary · about
chapters (16)
- 0:00Introduction and background
- 1:57Capgras syndrome analogy
- 3:56Apple's WAC protocol
- 7:10WAC provisioning process
- 8:29The MFI chip mechanism
- 12:33Identifying the security gap
- 15:18Spoofing WAC instances
- 16:48Exploiting cleartext data
- 18:43Tooling for the attack
- 20:38Man-in-the-middle execution
- 21:56Packet forwarding technique
- 22:29Instrumenting the network
- 23:13Attacking the endpoint
- 27:50Secure element architectures
- 36:01External vs internal models
- 48:38Conclusion and implications
related talks
42mDiscovering and Exploiting Novel Security Vulnerabilities in Apple ZeroConf
47mHacking a Cat — Going Beyond Traditional Attack Vectors
44mManna from Heaven: Improving the State of Wireless Rogue AP Attacks
23mMalicious MDM: Fun with iOS MobileConfigs
41mA Worm in the Apple: Wormable Zero-Click RCE in AirPlay... (Avi Lumelsky, Uri Katz)
37mEnterprise Apps: Bypassing the IOS Gatekeeper
48mMobile Security Attacks: A Glimpse from the Trenches
27mWIFI-Important Remote Attack Surface: Threat is Expanding