These guys are amazing. Excellent level of details.
Exploiting the Wi-Fi Stack on Apple Devices
11–20 of 85 posts
Re: Exploiting the Wi-Fi Stack on Apple Devices
#12This post is a thing of beauty. The details of how this works are amazing.
Yes, I particularly liked the detail of using the KTRR registers to defeat KASLR.
Re: Exploiting the Wi-Fi Stack on Apple Devices
#13Amazing. Did they need to jailbreak or physically open the phone to find all this stuff? They talk about reversing binary images and using their "Legilimency" toolkit; I wonder if a vanilla phone was enough to research all this and propagate through Wi-Fi.
I'm guessing there must be other jailbreaks involved to be able to observe and experiment on the ios kernel side of things while developing the wifi chip exploit; going in all blind from the wifi side only sounds impossible. The question now is, are they sitting on 0day jailbreaks for current iOS versions or did they have to do all the tests on legacy iOS versions?
It looks like that setup work for their research environment was all covered in part 1 (all the parts are really interesting and worth a read if anyone hasn't already incidentally). Specifically, the reason they mention at the end of part 3 that
>The exploit has been tested against the iPhone 7 running iOS 10.2 (14C92).
was because iOS 10.2 has a known kernel exploit developed by Ian Beer [1], and they used that as part of the basis of subsequent research. Presumably they either found some iPhones still running 10.2 (which stopped being signed a long while back) or like many well funded researches just keep a set of different iPhones loaded with major iOS versions so they're ready to go for research if an exploit is found after signing stops (dedicated jailbreakers sometimes to the same thing if they can). And of course security patches themselves are handy for reverse engineering old exploits from whatever bugs Apple fixes.
In part one read under "Kernel Memory Analysis Framework".
----
1: https://googleprojectzero.blogspot.co.uk/2017/04/exception-o...
Re: Exploiting the Wi-Fi Stack on Apple Devices
#14Why did Apple make it harder to turn off the WiFi radio in iOS11?
Re: Exploiting the Wi-Fi Stack on Apple Devices
#15Wonder if something like this was used to get into the San Bernardino shooter's phone by the FBI
Most definitely not.
Re: Exploiting the Wi-Fi Stack on Apple Devices
#16Why did Apple make it harder to turn off the WiFi radio in iOS11?
Because people would turn off WiFi from Control Center and then forget about it, resulting in expensive cellular overages. (This cost me about $30, for example.)
I think the pertinent question is: why didn't they make the change more clear?
Re: Exploiting the Wi-Fi Stack on Apple Devices
#17Why did Apple make it harder to turn off the WiFi radio in iOS11?
Because people would turn off WiFi from Control Center and then forget about it, resulting in expensive cellular overages. (This cost me about $30, for example.) I think the pertinent question is: why didn't they make the change more clear?
Apple thinks for its users in all the wrong ways.
Re: Exploiting the Wi-Fi Stack on Apple Devices
#18Earlier quoted context omitted.
Because people would turn off WiFi from Control Center and then forget about it, resulting in expensive cellular overages. (This cost me about $30, for example.) I think the pertinent question is: why didn't they make the change more clear?
Apple thinks for its users in all the wrong ways.
Several people in my family have had overage issues by forgetting about WiFi being off. They are certainly not technically inclined.
Re: Exploiting the Wi-Fi Stack on Apple Devices
#19Why did Apple make it harder to turn off the WiFi radio in iOS11?
Because people would turn off WiFi from Control Center and then forget about it, resulting in expensive cellular overages. (This cost me about $30, for example.) I think the pertinent question is: why didn't they make the change more clear?
If you want to avoid cellular charges, shouldn't you be turning off cellular?
Re: Exploiting the Wi-Fi Stack on Apple Devices
#20I'd love to know how many hours were needed to develop this exploit from start to finish, and how many dead ends the researcher ran into along the way. Just writing the blog post and generating all the images for it must've taken many days.
I have followed iOS JB for years and keep up with exploit dev and mitigation/defense.
The usage of source code and avoiding deep assembly documenting helped a lot. You are still looking at several man days of deep work on understanding the driver and stack.
KASLR was the only real mitigation to bypass. That could have been a difficult part worth it's own discussion. Bypassing ASLR typically requires an info leak.
I think 3-4 weeks of one person's effort is a good guess. +/- 1wk depending.