Главная
Study mode:
on
1
Intro
2
Outline
3
Unix Domain Socket
4
Race Condition
5
The fix
6
The pattern
7
UAF, let's look at the USE
8
Binary version may be better
9
PAC (Pointer Authentication Code)
10
UAF, let's look at the second USE
11
Got troubles while adding trust caches
12
tfpo's write capability for kernel image
13
Look for unprotected control flow transfer points
14
What can we do
15
Got ssh on iPhone XS Max
16
Black Hat Sound Bytes
Description:
Explore the vulnerabilities of the iPhone XS Max in this Black Hat conference talk. Delve into Apple's Pointer Authentication Code (PAC) implementation and uncover an ancient bug in the XNU kernel that affects even the latest iOS releases. Learn how to exploit this vulnerability to bypass PAC and gain arbitrary kernel read/write access. Examine topics such as Unix Domain Socket, race conditions, use-after-free (UAF) vulnerabilities, and unprotected control flow transfer points. Discover the process of adding trust caches and gaining SSH access on the iPhone XS Max. Gain valuable insights into mobile device security and penetration testing techniques from speakers Tielei Wang and Hao Xu.

Attacking iPhone XS Max

Black Hat
Add to list
0:00 / 0:00