Subverting Apple Graphics - Practical Approaches to Remotely Gaining Root
Explore practical approaches to remotely gaining root access by subverting Apple graphics in this Black Hat conference talk. Delve into the vulnerabilities within Apple's graphics components, both in userland and kernel, that can be exploited from sandboxed applications. Learn about the WindowServer process, IOKit user clients, and hidden interfaces that expose attack surfaces. Discover "graphic-style" exploitation techniques for elevating privileges from inside the sandbox. Examine specific security flaws, including design-related logic issues, vulnerabilities in hidden interfaces, and memory corruption bugs. Gain insights into kernel attack surfaces within closed-source core graphics pipeline components. Understand new kernel heap spraying methods with improved control and reduced side effects. Watch live demonstrations of remote root access exploitation chains on OS X El Capitan, showcasing attacks on both userland and kernel graphics components.