Главная
Study mode:
on
1
Intro
2
Agenda
3
Past vulnerabilities
4
Launchdown
5
Vulnerability
6
Research
7
Mobile Device
8
Summary
9
Exploitability
10
How to exploit
11
Network traffic
12
GDB session
13
Add second client
14
Add third client
15
Full session Takeover
16
Second client
17
Remote code execution
18
Vulnerability disclosure
19
Disclosure timeline
20
Downgrad attack
21
Downgrad attack explained
22
What did Apple do
23
Full disclosure timeline
24
Conclusion
Description:
Explore a critical design flaw in iOS development tools that allowed remote code execution on pre-iOS 14 devices in this 44-minute conference talk from Nullcon Goa 2022. Dive into the discovery, research, and exploitation of the vulnerability in MobileDevice.framework and Xcode. Learn about iOS device services, lockdownd, and past vulnerabilities. Follow the speaker's journey through the vulnerability disclosure process and Apple's response. Gain insights into network attacks, GDB sessions, and full session takeovers. Understand the downgrade attack explained and the timeline of events leading to the flaw's resolution. Suitable for information security professionals and iOS developers interested in understanding and preventing such vulnerabilities.

Contextomy - Let's Debug Together

nullcon
Add to list
0:00 / 0:00