Главная
Study mode:
on
1
Intro
2
Agenda
3
Typical exploit chain (mobile Pwn20wn) 1/2
4
Why not a kernel bug to escape the sandbox?
5
iOS sandbox overview
6
Our strategy on sandbox bypass
7
General approach to exploit double free
8
Problem 1: fill in object B
9
Problem 2: stable race to fill
10
CF object fill into vm_allocate
11
The strategy doesn't work
12
Android Comparison
13
Pegasus APT
14
Initial Step: Setting up the required files
15
Final step, showing the app
16
Examining the roadblocks
17
iOS 12 sandbox hardening
Description:
Explore advanced iOS exploitation techniques in this 55-minute Recon Conference talk. Delve into the strategies used to remotely pwn iOS 11 systems, breaking Apple's sandbox and installing persistent rogue applications without kernel exploits. Learn about the double free vulnerability (CVE-2017-7162) in the IOKit framework, advanced exploit techniques for 100% reliable exploitation, and methods for bypassing code signing requirements. Gain insights into sandbox escape technology, browser exploitation, and the challenges of chaining vulnerabilities to defeat iOS defenses. Witness a live demonstration of these techniques and compare them to Android exploitation. Examine the Pegasus APT case study and discuss iOS 12 sandbox hardening measures.

Exploiting Userland Vulnerabilities to Get Rogue App Installed Remotely on iOS 11

Recon Conference
Add to list