Главная
Study mode:
on
1
Introduction
2
Agenda
3
What is iOS
4
Design of iOS
5
Chart Cache
6
Mock Messages
7
Lunch
8
iOS research difficulties
9
IDA
10
Sandbox Escape
11
Sandbox Target
12
Map Cache
13
Message Handler
14
callbacks
15
coldframe
16
decompression session
17
serialization
18
Python Implementation
19
Demo
20
Results
21
iOS 11 Refactor
22
Bluetooth Deep
23
Get Pair Devices
24
CV4095
25
Bug Fix
26
Bluetooth Session Token
27
Brute Force
28
Blue2D Demo
29
Bug Fixes
30
Global Variables
31
Token Change
32
Jailbreak
33
Spark
34
References
35
Credits
36
Questions
Description:
Explore the intricacies of iOS sandbox escape techniques in this HITB Security Conference talk. Delve into the world of mach message IPC and poorly designed daemons, uncovering vulnerabilities that allow arbitrary code execution outside the sandbox. Learn about research tools for analyzing mach message handlers and gain insights into exploiting vulnerabilities across various iOS daemons. Discover the potential for full chain exploitation and necessary gadgets. Understand the challenges of iOS research, explore IDA techniques, and witness demonstrations of sandbox escape methods. Examine specific vulnerabilities in Bluetooth functionality, including pair device retrieval and session token manipulation. Gain valuable knowledge about iOS security, jailbreaking, and cutting-edge mobile device exploitation techniques.

The Road to iOS Sandbox Escape

Hack In The Box Security Conference
Add to list