Breaking iOS Code Signing - Reverse Engineering Mac OS X

More documents

Recommendations

Info

The validationcs_validate_page(void*_blobs, memory_object_offset_t page_offset, const void *data, boolean_t *tainted){...for (blob = blobs; blob != NULL; blob = blob->csb_next) {...embedded = (const CS_SuperBlob *) blob_addr;cd = find<strong>Code</strong>Directory(embedded, lower_bound, upper_bound);if (cd != NULL) {...if (cd->pageSize != PAGE_SHIFT ||hash = hashes(cd, atop(offset), lower_bound, upper_bound); find hashif (hash != NULL) {bcopy(hash, expected_hash, sizeof (expected_hash));found_hash = TRUE;}break;.........if (found_hash == FALSE) {validated = FALSE;*tainted = FALSE;} else {if (bcmp(expected_hash, actual_hash, SHA1_RESULTLEN) != 0) {cs_validate_page_bad_hash++;*tainted = TRUE;} else {*tainted = FALSE;}validated = TRUE;}return validated;compare hashFriday, October 14, 11
When a page is invalidBack in vm_fault_enter....vm_fault_enter{...vm_page_validate_cs(m);}...if (m->cs_tainted ||(( !cs_enforcement_disable && !cs_bypass ) &&((!m->cs_validated && (prot & VM_PROT_EXECUTE)) ||(m->cs_validated && ((prot & VM_PROT_WRITE) || m->wpmapped))))){...reject_page = cs_invalid_page((addr64_t) vaddr);...if (reject_page) {/* reject the tainted page: abort the page fault */kr = KERN_CODESIGN_ERROR;cs_enter_tainted_rejected++;Friday, October 14, 11
Page 3 and 4: AgendaCode signing and iOS security
Page 5 and 6: iOS Security ModelAll code (binarie
Page 7 and 8: Malware preventionSince only signed
Page 9 and 10: Exploit mitigationNo pages are writ
Page 11 and 12: ComparisonIn OS XCan allocate RWX p
Page 13 and 14: Overview of internalsMandatory Acce
Page 15 and 16: iOS MAC policiesOnly 2 policies reg
Page 17 and 18: AMFI hooksAMFI uses the following M
Page 19 and 20: mac_vnode_check_execintmac_vnode_ch
Page 21 and 22: mpo_vnode_check_signatureSets CS_HA
Page 23 and 24: Kernel checksparse_machfile(struct
Page 25 and 26: Actual signature validationintubc_c
Page 27 and 28: Code signing so farWhen binary is l
Page 29 and 30: Enforcement codevm_fault_enter{.../
Page 31: Validating code matches hashvm_page
Page 35 and 36: No new codeWe’ve seen how all exe
Page 37 and 38: Existing regionsvm_map_protect(...)
Page 39 and 40: Dynamic codesigningIn order to util
Page 41 and 42: Speed vs securityThere is a (single
Page 43 and 44: MobileSafari# ldid -e /Applications
Page 45 and 46: Inside mmapintmmap(proc_t p, struct
Page 47 and 48: Even further......if (flags & MAP_J
Page 49 and 50: Now we pass the checkvm_map_enter(.
Page 51 and 52: vm_map_enter (again)if ((flags & VM
Page 53 and 54: 7 PatchesCan be found at https://gi
Page 55 and 56: vm_map_enter (again!)vm_map_enter(.
Page 57 and 58: vm_map_protectvm_map_protect(...){.
Page 59 and 60: vm_map_protectvm_map_protect(...){.
Page 61 and 62: Allow “unvalidated” pagesSet cs
Page 63 and 64: MobileSafari shellcodeunsigned int
Page 65 and 66: Unsigned code, iOS 2void (*f)();uns
Page 67 and 68: Questions?Thanks for coming!Friday,
Page 69 and 70: An iOS 5.0 code signing bugintmmap(
Page 71 and 72: An iOS 5.0 code signing bug#define
Page 73 and 74: Allocating RWX regionsAny process w
Page 75 and 76: Running unsigned codeMalicious App
Page 77 and 78: Copy and fixup dyldint fd = open("f
Page 79 and 80: Patch 2uintptr_t ImageLoaderMachO::
Page 81 and 82: Patch 2uintptr_t ImageLoaderMachO::
Page 83 and 84:
Patch 3void ImageLoaderMachO::mapSe
Page 85 and 86:
Patch 3void ImageLoaderMachO::mapSe
Page 87 and 88:
Patch 4void ImageLoader::link(const
Page 89 and 90:
Apple review processAn app that did
Page 91 and 92:
InstastockAlso rejected - for illeg
Page 93 and 94:
App Store Review ProcessNot very cl
Page 95:
Questions?Contact me at charlie.mil
show all

Breaking iOS Code Signing - Reverse Engineering Mac OS X

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?