iPhone Rootkit? There's an App for that! - Reverse Engineering Mac ...
iPhone Rootkit? There's an App for that! - Reverse Engineering Mac ... iPhone Rootkit? There's an App for that! - Reverse Engineering Mac ...
The WhatInstant, convenient jail-breaking using nothing more than your phone’sdata connection and the built-in Safari web browser• No iPhone is safe. Guy walked into apple store and filmed himselfjailbreaking their floor model! Posts to You Tube, hilarity ensures• Actually the second published web-based jailbreakme.com exploit• First was a based on a libtiff vulnerability from Tavis Ormandy• Similar security analysis and exploitation undertaken for libtiff byHD Moore/metasploit team and othersCopyright Trustwave 2010
What it looks likeVisit h'p://jailbreakme.com Star exploit execu9on Finished. Pre'y safe and easy! Note: If we want a “stealth jailbreak”, we need to do away with all these prompts. Copyright Trustwave 2010
- Page 5 and 6: iPhone/iOS Security Overview
- Page 7 and 8: Architecture OverviewApplications P
- Page 9 and 10: Application SecurityCode signing•
- Page 11 and 12: Jailbreaking Overview
- Page 13: Jailbreakme.com A Thing to Behold
- Page 17 and 18: Weaponizing
- Page 19 and 20: Patch PlanReversing the installui.d
- Page 21 and 22: My “Big Fat Rootkit”… so farC
- Page 23 and 24: Set-upA vanilla un-jailbroken iPhon
- Page 25 and 26: Hardware: Mic and AudioAudio record
- Page 27 and 28: Dumping Process DataSeveral interes
- Page 29 and 30: Targeting iOS ApplicationsiOS isn
- Page 31 and 32: Demo App Backdoor
- Page 33 and 34: Binary Reversing Prep (continued…
- Page 35 and 36: No More SecretsHint: find the LC
- Page 37 and 38: Mach Binary Encryption (continued
- Page 39 and 40: What’s your point?For starters…
- Page 41 and 42: Objective-C Method HookingIt’s ca
- Page 43 and 44: Objective-C Method Hook ExampleLets
- Page 45 and 46: Injecting Our LibraryConventionally
- Page 47 and 48: ConclusionsLots of security researc
- Page 49 and 50: Reversing Redux: The Binary “star
- Page 51 and 52: … continued: eggMalformed Times-
- Page 53 and 54: class-dump on installui.dylib (aka
The WhatInst<strong>an</strong>t, convenient jail-breaking using nothing more th<strong>an</strong> your phone’sdata connection <strong>an</strong>d the built-in Safari web browser• No <strong>iPhone</strong> is safe. Guy walked into apple store <strong>an</strong>d filmed himselfjailbreaking their floor model! Posts to You Tube, hilarity ensures• Actually the second published web-based jailbreakme.com exploit• First was a based on a libtiff vulnerability from Tavis Orm<strong>an</strong>dy• Similar security <strong>an</strong>alysis <strong>an</strong>d exploitation undertaken <strong>for</strong> libtiff byHD Moore/metasploit team <strong>an</strong>d othersCopyright Trustwave 2010
Change language