Breaking iOS Code Signing - Reverse Engineering Mac OS X

More documents

Recommendations

Info

iOS Security ModelPages that are writeable may never be madeexecutableAfter iOS 4.3 there is an exception for JITPages can never be both writable and executableTherefore only pages coming from signed binaries mayever be executedFriday, October 14, 11
Malware preventionSince only signed binaries may be executed, randombinaries cannot be downloaded and runSigned binaries cannot alter their behaviors, onlyexecutable code from binary may ever be executedNo self modificationNo executable packingApps can’t update themselvesFriday, October 14, 11
Page 3 and 4: AgendaCode signing and iOS security
Page 5: iOS Security ModelAll code (binarie
Page 9 and 10: Exploit mitigationNo pages are writ
Page 11 and 12: ComparisonIn OS XCan allocate RWX p
Page 13 and 14: Overview of internalsMandatory Acce
Page 15 and 16: iOS MAC policiesOnly 2 policies reg
Page 17 and 18: AMFI hooksAMFI uses the following M
Page 19 and 20: mac_vnode_check_execintmac_vnode_ch
Page 21 and 22: mpo_vnode_check_signatureSets CS_HA
Page 23 and 24: Kernel checksparse_machfile(struct
Page 25 and 26: Actual signature validationintubc_c
Page 27 and 28: Code signing so farWhen binary is l
Page 29 and 30: Enforcement codevm_fault_enter{.../
Page 31 and 32: Validating code matches hashvm_page
Page 33 and 34: When a page is invalidBack in vm_fa
Page 35 and 36: No new codeWe’ve seen how all exe
Page 37 and 38: Existing regionsvm_map_protect(...)
Page 39 and 40: Dynamic codesigningIn order to util
Page 41 and 42: Speed vs securityThere is a (single
Page 43 and 44: MobileSafari# ldid -e /Applications
Page 45 and 46: Inside mmapintmmap(proc_t p, struct
Page 47 and 48: Even further......if (flags & MAP_J
Page 49 and 50: Now we pass the checkvm_map_enter(.
Page 51 and 52: vm_map_enter (again)if ((flags & VM
Page 53 and 54: 7 PatchesCan be found at https://gi
Page 55 and 56: vm_map_enter (again!)vm_map_enter(.
Page 57 and 58:
vm_map_protectvm_map_protect(...){.
Page 59 and 60:
vm_map_protectvm_map_protect(...){.
Page 61 and 62:
Allow “unvalidated” pagesSet cs
Page 63 and 64:
MobileSafari shellcodeunsigned int
Page 65 and 66:
Unsigned code, iOS 2void (*f)();uns
Page 67 and 68:
Questions?Thanks for coming!Friday,
Page 69 and 70:
An iOS 5.0 code signing bugintmmap(
Page 71 and 72:
An iOS 5.0 code signing bug#define
Page 73 and 74:
Allocating RWX regionsAny process w
Page 75 and 76:
Running unsigned codeMalicious App
Page 77 and 78:
Copy and fixup dyldint fd = open("f
Page 79 and 80:
Patch 2uintptr_t ImageLoaderMachO::
Page 81 and 82:
Patch 2uintptr_t ImageLoaderMachO::
Page 83 and 84:
Patch 3void ImageLoaderMachO::mapSe
Page 85 and 86:
Patch 3void ImageLoaderMachO::mapSe
Page 87 and 88:
Patch 4void ImageLoader::link(const
Page 89 and 90:
Apple review processAn app that did
Page 91 and 92:
InstastockAlso rejected - for illeg
Page 93 and 94:
App Store Review ProcessNot very cl
Page 95:
Questions?Contact me at charlie.mil
show all

Breaking iOS Code Signing - Reverse Engineering Mac OS X

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?