pface into the apple core and exploit root code blue 4devide3 add notes进入苹果核心并利用.pptx

Howwefuzzandexploitthe

Applecore

(P)FACEintotheApplecoreandexploittoroot

AgendaWhoweareCVElistPassivefuzzingframeworkApproachconsiderationImplementationContextenlightenmentBestPracticeExploittorootSecuritymitigationRoot

MoonyLi@Flyic7yearssecuritySandcastleDeepDiscoveryExploitDetectionMac/WindowsKernelAndroidVulnerability

JackTang@jacktang31010+yearssecurityBrowserDocumentMac/WindowsKernelVirtualizationVulnerability

Sowhat?HerebelowistheCVEandZDIlistuntilnow(NOTincludingsubmittedbutpending)since2015:CVE-2015-3787,CVE-2015-5867,CVE-2015-7021,CVE-2015-7020,CVE-2016-1716,ZDI-CAN-3536,ZDI-CAN-3558,ZDI-CAN-3598,ZDI-CAN-3596,ZDI-CAN-3603,CVE-2015-7067,CVE-2015-7076,CVE-2015-7106,CVE-2015-7109,CVE-2016-1718,CVE-2016-1747,CVE-2016-1749,CVE-2016-1753,ZDI-CAN-3693,ZDI-CAN-3694,CVE-2016-1795,CVE-2016-1808,CVE-2016-1810,CVE-2016-1817,CVE-2016-1820,CVE-2016-1798,CVE-2016-1799,CVE-2016-1812,CVE-2016-1814,CVE-2016-1818,CVE-2016-1816,CVE-2016-4648，CVE-2016-4699，CVE-2016-4700，CVE-2016-4750Root10.11.3(then)twicewithfoundbug

AgendaWhoweareCVElistPassivefuzzingframeworkApproachconsiderationImplementationContextenlightenmentBestPracticeExploittorootSecuritymitigationRoot

So…HowOthersFuzzBugs?TraditionalfuzzingbyIOKitinterfaceUsuallyopentheIOKitservicenamewhichtheywanttotest,andpourfuzzingdataintobytheIOKitusermodeAPI(e.g.IOConnectCallMethod)CallsequencedependencyAppleCamIn(OpenDevice,PowerOnCamera…)InputdatadependencyAppleHDAEngineInput(inputasusermodebufferpointer)TimingdependencyIOHDIXHDDriveOutKernel(mountdmg)

ThenWhatAboutReview?CodereviewoftargetkernelextensionThiscostsmuchefforttoreverseengineeringbinarycodeandinthefaceofsomanyIOKitservicesanduserclient. -Un-scalable -CosteffortRE(upgrade)

Ourapproach:

Whynotplay(e.g.games)forbugs?BothcodetraditionalfuzzandcodereviewaretiringWhataboutplay