iPhone Rootkit? There's an App for that! - Reverse Engineering Mac ...

More documents

Recommendations

Info

Jailbreak LandscapeRemote client-side exploits are few and far between• Highly valuable• Obviously more potential for abuse• Obviously more exciting for security researchMost jailbreaks exploit vulns in restore and FW updates over USB• Fertile territory for jailbreaks, JB nerds, and regular nerds to follow (like me)• Security impact for ‘evil maid’ style bad-guy attacksVery impressive work is consistent from the JB community• It takes a real !$$-hole to taint their awesome efforts…• But this is just how I do adoration and idolizationInternets have loads of tech details for learning• Patience! Gotta wade through lots of Apple fanboi and tech writer blogs tofind the good stuff• JB teams have cool info on wikis, but it’s not always up to date• Github!!! Jailbreak-team stalker’s paradise!Copyright Trustwave 2010
Jailbreakme.com A Thing to Behold…Author: Comex backed up by other jailbreak team members• The actual exploit and jailbreak package dubbed “star”• Worked on every iDevice Apple made and across almost all modernversions.• iPhone 4G out for just a month or so.• Jailbreak users had been waiting patiently and were notdisappointed• Released right after a crucial US legal decision on jailbreaking• It’s now officially legal in US. Prior status was fuzzy• Source for exploit released after Apple releases security fix (iOS 4.0.2)• See http://github.com/comex/star• Handled everything like pros• Implementation, to presentation, to disclosure, to the timing of thereleaseCopyright Trustwave 2010
Page 5 and 6: iPhone/iOS Security Overview
Page 7 and 8: Architecture OverviewApplications P
Page 9 and 10: Application SecurityCode signing•
Page 11: Jailbreaking Overview
Page 15 and 16: What it looks likeVisit h'p://jailb
Page 17 and 18: Weaponizing
Page 19 and 20: Patch PlanReversing the installui.d
Page 21 and 22: My “Big Fat Rootkit”… so farC
Page 23 and 24: Set-upA vanilla un-jailbroken iPhon
Page 25 and 26: Hardware: Mic and AudioAudio record
Page 27 and 28: Dumping Process DataSeveral interes
Page 29 and 30: Targeting iOS ApplicationsiOS isn
Page 31 and 32: Demo App Backdoor
Page 33 and 34: Binary Reversing Prep (continued…
Page 35 and 36: No More SecretsHint: find the LC
Page 37 and 38: Mach Binary Encryption (continued
Page 39 and 40: What’s your point?For starters…
Page 41 and 42: Objective-C Method HookingIt’s ca
Page 43 and 44: Objective-C Method Hook ExampleLets
Page 45 and 46: Injecting Our LibraryConventionally
Page 47 and 48: ConclusionsLots of security researc
Page 49 and 50: Reversing Redux: The Binary “star
Page 51 and 52: … continued: eggMalformed Times-
Page 53 and 54: class-dump on installui.dylib (aka

iPhone Rootkit? There's an App for that! - Reverse Engineering Mac ...

Create successful ePaper yourself

Delete template?

Save as template?