Researching New Attack Interfaces On iOS And OSX
summary
Automated static and dynamic analysis generates automatic external method extraction for IOUserClient vectors, a custom kernel-extension analysis agent builds CFGs and a tiny instruction emulator, and runtime hooks use Frida and DTrace to collect contexts; those artifacts feed a passive fuzzing toolchain that finds faults reproducibly from user space. The workflow yields dozens of driver/kernel 0days (CVE-2018-4462 integer overflow in AMDFramebuffer, NULL-page in IntelAccelerator, IOUSBFamliy overflow, OOB read in AMDRadeonX4000_AMDAccelResource, divide-by-zero in IOAccelCommandQueue) and the tools are open sourced.
AI-written summary · about
chapters (26)
- 0:00Introduction to research
- 1:10Speaker introduction
- 2:20Solution overview
- 3:06Static analysis of kernel interfaces
- 5:03Kernel inheritance interfaces
- 7:13User kind analysis
- 9:50External method generation
- 11:25Locating key memory addresses
- 13:39Kernel extension analysis agent
- 16:59CFG generation process
- 18:26Instruction emulator design
- 20:17Kernel interfaces automatic analysis
- 22:12Deep interface aided recognition
- 24:41Dynamic analysis introduction
- 25:45Frida for runtime context
- 28:12Frida API hooking examples
- 30:46DTrace for system calls
- 34:26Automatic fuzzing solution
- 36:17Inline hook for taint analysis
- 38:07Kernel address sanitizer
- 39:59Future fuzzing plans
- 41:32Memory centralizer for fuzzing
- 41:56Vulnerabilities found
- 47:38USB family travel vulnerability
- 50:57MDL accelerator command buffer flaw
- 52:25Open source tool demonstration
related talks
45mD1T1 - How to Analyze and Find Bugs in MacOS and iOS Kernel Drivers
43mDebug for Bug: Crack and Hack Apple Core by Itself
23mIntroduction to security research and bounty hunting on Apple's platforms
42mCPU Fuzzing: Automatic Discovery of...
40m(P)FACE into the Apple core and exploit to root
53mFuzzing At Mach Speed: Uncovering IPC Vulnerabilities On MacOS
35mRacing the Dark: A New TOCTTOU Story From Apple's Core
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox