iOS Hacker's Handbook

**Discover all the security risks and exploits that can threaten iOS-based mobile devices**iOS is Apple's mobile operating system for the iPhone and iPad. With the introduction of iOS5, many security issues have come to light. This book explains and discusses them all. The award-winning author team, experts in Mac and iOS security, examines the vulnerabilities and the internals of iOS to show how attacks can be mitigated. The book explains how the operating system works, its overall security architecture, and the security risks associated with it, as well as exploits, rootkits, and other payloads developed for it. * Covers iOS security architecture, vulnerability hunting, exploit writing, and how iOS jailbreaks work * Explores iOS enterprise and encryption, code signing and memory protection, sandboxing, iPhone fuzzing, exploitation, ROP payloads, and baseband attacks * Also examines kernel debugging and exploitation * Companion website includes source code and tools to facilitate your efforts __iOS Hacker's Handbook__ arms you with the tools needed to identify, understand, and foil iOS attacks. iOS Hacker's Handbook 3 Contents 11 Chapter 1 iOS Security Basics 23 iOS Hardware/Device Types 24 How Apple Protects the App Store 24 Understanding Security Threats 25 Understanding iOS Security Architecture 27 The Reduced Attack Surface 27 The Stripped-Down iOS 28 Privilege Separation 28 Code Signing 29 Data Execution Prevention 29 Address Space Layout Randomization 30 Sandboxing 30 A Brief History of iOS Attacks 31 Libtiff 31 Fun with SMS 32 The Ikee Worm 32 Storm8 33 SpyPhone 34 Pwn2Own 2010 35 Jailbreakme.com 2 (“Star”) 35 Jailbreakme.com 3 (“Saffron”) 36 Summary 36 Chapter 2 iOS in the Enterprise 37 iOS Configuration Management 38 Mobile Configuration Profiles 38 iPhone Configuration Utility 40 Creating a Configuration Profile 40 Installing the Configuration Profile 42 Updating Profiles 47 Removing Profiles 47 Applications and Provisioning Profiles 48 Mobile Device Management 48 MDM Network Communication 49 Lion Server Profile Manager 50 Setting Up Profile Manager 51 Creating Settings 57 Enrolling Devices 60 Summary 67 Chapter 3 Encryption 69 Data Protection 69 Data Protection API 70 Attacking Data Protection 73 Attacking User Passcodes 73 iPhone Data Protection Tools 77 Installation Prerequisites 77 Building the Ramdisk 80 Booting Ramdisk 83 Brute-Force Attacking Four-Digit Passcodes 84 Dumping Keychain 86 Dumping Data Partition 87 Decrypting Data Partition 88 Summary 90 Chapter 4 Code Signing and Memory Protections 91 Understanding Mandatory Access Control 92 AMFI Hooks 93 AMFI and execv 94 How Provisioning Works 96 Understanding the Provisioning Profile 96 How the Provisioning File Is Validated 99 Understanding Application Signing 100 Inside Entitlements 101 How Code Signing Enforcement Works 102 Collecting and Verifying Signing Information 102 How Signatures Are Enforced on Processes 106 How the iOS Ensures No Changes Are Made to Signed Pages 110 Discovering Dynamic Code Signing 111 Why MobileSafari Is So Special 111 How the Kernel Handles JIT 113 Attacking Inside MobileSafari 116 Breaking Code Signing 117 Altering iOS Shellcode 118 Using Meterpreter on iOS 123 Gaining App Store Approval 125 Summary 126 Chapter 5 Sandboxing 129 Understanding the Sandbox 130 Sandboxing Your Apps 131 Understanding the Sandbox Implementation 138 Understanding User Space Library Implementation 139 Into the Kernel 143 Implementing TrustedBSD 143 Handling Configuration from User Space 145 Policy Enforcement 147 How Profile Bytecode Works 148 How Sandboxing Impacts App Store versus Platform Applications 155 Summary 159 Chapter 6 Fuzzing iOS Applications 161 How Fuzzing Works 161 The Recipe for Fuzzing 163 Mutation-Based (“Dumb”) Fuzzing 163 Generation-Based (“Smart”) Fuzzing 164 Submitting and Monitoring the Test Cases 165 Fuzzing Safari 166 Choosing an Interface 166 Generating Test Cases 166 Testing and Monitoring the Application 167 Adventures in PDF Fuzzing 170 Quick Look Fuzzing 175 Fuzzing with the Simulator 177 Fuzzing MobileSafari 180 Selecting the Interface to Fuzz 180 Generating the Test Case 180 Fuzzing and Monitoring MobileSafari 180 PPT Fuzzing Fun 182 SMS Fuzzing 184 SMS Basics 185 Focusing on the Protocol Data Unit Mode 187 Using PDUspy 189 Using User Data Header Information 189 Working with Concatenated Messages 190 Using Other Types of UDH Data 191 Generation-Based Fuzzing with Sulley 192 SMS iOS Injection 197 Monitoring SMS 199 SMS Bugs 204 Summary 206 Chapter 7 Exploitation 207 Exploiting Bug Classes 208 Object Lifetime Vulnerabilities 208 Understanding the iOS System Allocator 210 Regions 210 Allocation 211 Deallocation 211 Taming the iOS Allocator 212 Tools of the Trade 212 Learning Alloc/Dealloc Basics 213 Exploiting Arithmetic Vulnerabilities 217 Exploiting Object Lifetime Issues 220 Understanding TCMalloc 222 Large Object Allocation and Deallocation 223 Small Object Allocation 223 Small Object Deallocation 224 Taming TCMalloc 224 Obtaining a Predictable Heap Layout 224 Tools for Debugging Heap Manipulation Code 226 Exploiting Arithmetic Vulnerabilities with TCMalloc – Heap Feng Shui 228 Exploiting Object Lifetime Issues with TCMalloc 233 ASLR Challenges 233 Case Study: Pwn2Own 2010 235 Testing Infrastructure 239 Summary 240 Chapter 8 Return-Oriented Programming -1 ARM Basics 242 iOS Calling Convention 242 System Calls Calling Convention 243 ROP Introduction 244 ROP and Heap Bugs 246 Manually Constructing a ROP Payload 247 Automating ROP Payload Construction 252 What Can You Do with ROP on iOS? 254 Testing ROP Payloads 254 Examples of ROP Shellcode on iOS 257 Exfiltrate File Content Payload 257 Using ROP to Chain Two Exploits (JailBreakMe v3) 264 Summary 269 Chapter 9 Kernel Debugging and Exploitation 271 Kernel Structure 271 Kernel Debugging 272 Kernel Extensions and IOKit Drivers 278 Reversing the IOKit Driver Object Tree 279 Finding Vulnerabilities in Kernel Extensions 283 Finding Vulnerabilities in IOKit Drivers 286 Attacking through Device Properties 287 Attacking through External Traps and Methods 288 Kernel Exploitation 291 Arbitrary Memory Overwrite 291 Patching a Vulnerability into the Kernel 292 Choosing a Target to Overwrite 293 Locating the System Call Table 294 Constructing the Exploit 295 Uninitialized Kernel Variables 296 Kernel Stack Buffer Overflows 301 Kernel Heap Buffer Overflows 307 Kernel Heap Zone Allocator 308 Kernel Heap Feng Shui 313 Detecting the State of the Kernel Heap 315 Exploiting the Kernel Heap Buffer Overflow 316 Summary 318 Chapter 10 Jailbreaking 319 Why Jailbreak? 320 Jailbreak Types 320 Jailbreak Persistence 321 Tethered Jailbreaks 321 Untethered Jailbreaks 321 Exploit Type 322 Bootrom Level 322 iBoot Level 322 Userland Level 323 Understanding the Jailbreaking Process 323 Exploiting the Bootrom 324 Booting the Ramdisk 325 Jailbreaking the Filesystem 325 Installing the Untethering Exploit 326 Installing the AFC2 Service 327 Installing Base Utilities 328 Application Stashing 329 Bundle Installation 329 Post-Installation Process 331 Executing Kernel Payloads and Patches 331 Kernel State Reparation 331 Privilege Escalation 332 Kernel Patching 334 security.mac.proc_enforce 334 cs_enforcement_disable (kernel) 335 cs_enforcement_disable (AMFI) 336 PE_i_can_has_debugger 337 vm_map_enter 338 vm_map_protect 340 AMFI Binary Trust Cache 341 Task_for_pid 0 342 Sandbox Patches 344 Clearing the Caches 346 Clean Return 346 Summary 347 Chapter 11 Baseband Attacks 349 GSM Basics 351 Setting up OpenBTS 353 Hardware Required 353 OpenBTS Installation and Configuration 354 Closed Configuration and Asterisk Dialing Rules 357 RTOSes Underneath the Stacks 357 Nucleus PLUS 358 ThreadX 359 REX/OKL4/Iguana 359 Heap Implementations 360 Dynamic Memory in Nucleus PLUS 360 Byte Pools in ThreadX 362 The Qualcomm Modem Heap 363 Vulnerability Analysis 364 Obtaining and Extracting Baseband Firmware 365 Loading Firmware Images into IDA Pro 366 Application/Baseband Processor Interface 367 Stack Traces and Baseband Core Dumps 367 Attack Surface 368 Static Analysis on Binary Code Like it’s 1999 369 Specification-Guided Fuzz Testing 370 Exploiting the Baseband 370 A Local Stack Buffer Overflow: AT+XAPP 370 The ultrasn0w Unlock 372 An Overflow Exploitable 0ver the Air 378 Summary 384 Appendix References 387 Index 391

FUZZING

Master One of Today’s Most Powerful Techniques for Revealing Security Flaws!

Fuzzing has evolved into one of today’s most effective approaches to test software security. To “fuzz,” you attach a program’s inputs to a source of random data, and then systematically identify the failures that arise. Hackers have

relied on fuzzing for years: Now, it’s your turn. In this book, renowned fuzzing experts show you how to use fuzzing to reveal weaknesses in your software before someone else does.

Fuzzing is the first and only book to cover fuzzing from start to finish, bringing disciplined best practices to a technique that has traditionally been implemented informally. The authors begin by reviewing how fuzzing works and outlining its crucial advantages over other security testing methods. Next, they introduce state-of-the-art fuzzing techniques for finding vulnerabilities in network protocols, file formats, and web applications; demonstrate the use of automated fuzzing tools; and present several insightful case histories showing fuzzing at work. Coverage includes:

• Why fuzzing simplifies test design and catches flaws other methods miss

• The fuzzing process: from identifying inputs to assessing “exploitability”

• Understanding the requirements for effective fuzzing

• Comparing mutation-based and generation-based fuzzers

• Using and automating environment variable and argument fuzzing

• Mastering in-memory fuzzing techniques

• Constructing custom fuzzing frameworks and tools

• Implementing intelligent fault detection

Attackers are already using fuzzing. You should, too. Whether you’re a developer, security engineer, tester, or QA specialist, this book teaches you how to build secure software.

Foreword xix

Preface xxi

Acknowledgments xxv

About the Author xxvii

P ARTI B ACKGROUND 1

Chapter 1 Vulnerability Discovery Methodologies 3

Chapter 2 What Is Fuzzing? 21

Chapter 3 Fuzzing Methods and Fuzzer Types 33

Chapter 4 Data Representation and Analysis 45

Chapter 5 Requirements for Effective Fuzzing 61

P ART II T ARGETS AND A UTOMATION 71

Chapter 6 Automation and Data Generation 73

Chapter 7 Environment Variable and Argument Fuzzing 89

Chapter 8 Environment Variable and Argument Fuzzing: Automation 103

Chapter 9 Web Application and Server Fuzzing 113

Chapter 10 Web Application and Server Fuzzing: Automation 137

Chapter 11 File Format Fuzzing 169

Chapter 12 File Format Fuzzing: Automation on UNIX 181

Chapter 13 File Format Fuzzing: Automation on Windows 197

Chapter 14 Network Protocol Fuzzing 223

Chapter 15 Network Protocol Fuzzing: Automation on UNIX 235

Chapter 16 Network Protocol Fuzzing: Automation on Windows 249

Chapter 17 Web Browser Fuzzing 267

Chapter 18 Web Browser Fuzzing: Automation 283

Chapter 19 In-Memory Fuzzing 301

Chapter 20 In-Memory Fuzzing: Automation 315

P ART III A DVANCED F UZZING T ECHNOLOGIES 349

Chapter 21 Fuzzing Frameworks 351

Chapter 22 Automated Protocol Dissection 419

Chapter 23 Fuzzer Tracking 437

Chapter 24 Intelligent Fault Detection 471

P ART IV L OOKING F ORWARD 495

Chapter 25 Lessons Learned 497

Chapter 26 Looking Forward 507

Index 519

"A very interesting book that not only exposes readers to kernel exploitation techniques, but also deeply motivates the study of operating systems internals, moving such study far beyond simple curiosity."--Golden G. Richard III, Ph. D., Professor of Computer Science, University of New Orleans and CTO, Digital Forensics Solutions, LLC The number of security countermeasures against user-land exploitation is on the rise. Because of this, kernel exploitation is becoming much more popular among exploit writers and attackers. Playing with the heart of the operating system can be a dangerous game : This book covers the theoretical techniques and approaches needed to develop reliable and effective kernel level exploits and applies them to different operating systems (UNIX derivatives, Mac OS X, and Windows). Kernel exploits require both art and science to achieve. Every OS has its quirks and so every exploit must be molded to fully exploit its target. This book discusses the most popular OS families-UNIX derivatives, Mac OS X, and Windows-and how to gain complete control over them. Concepts and tactices are presented categorically so that even when a specifically detailed exploit has been patched, the foundational information that you have read will help you to write a newer, better attack or a more concrete design and defensive structure. Covers a range of operating system families - UNIX derivatives, Mac OS X, Windows Details common scenarios such as generic memory corruption (stack overflow, heap overflow, etc.) issues, logical bugs and race conditions Delivers the reader from user-land exploitation to the world of kernel-land (OS) exploits/attacks, with a particular focus on the steps that lead to the creation of successful techniques, in order to give to the reader something more than just a set of tricks Covers a range of operating system families - UNIX derivatives, Mac OS X, Windows Details common scenarios such as generic memory corruption (stack overflow, heap overflow, etc.) issues, logical bugs and race conditions Delivers the reader from user-land exploitation to the world of kernel-land (OS) exploits/attacks, with a particular focus on the steps that lead to the creation of successful techniques, in order to give to the reader something more than just a set of tricks This is the eBook version of the printed book. If the print book includes a CD-ROM, this content is not included within the eBook version. FUZZING Master One of Today's Most Powerful Techniques for Revealing Security Flaws! Fuzzing has evolved into one of today's most effective approaches to test software security. To “fuzz,” you attach a program's inputs to a source of random data, and then systematically identify the failures that arise. Hackers have relied on fuzzing for years: Now, it's your turn. In this book, renowned fuzzing experts show you how to use fuzzing to reveal weaknesses in your software before someone else does. Fuzzing is the first and only book to cover fuzzing from start to finish, bringing disciplined best practices to a technique that has traditionally been implemented informally. The authors begin by reviewing how fuzzing works and outlining its crucial advantages over other security testing methods. Next, they introduce state-of-the-art fuzzing techniques for finding vulnerabilities in network protocols, file formats, and web applications; demonstrate the use of automated fuzzing tools; and present several insightful case histories showing fuzzing at work. Coverage includes: • Why fuzzing simplifies test design and catches flaws other methods miss • The fuzzing process: from identifying inputs to assessing “exploitability” • Understanding the requirements for effective fuzzing • Comparing mutation-based and generation-based fuzzers • Using and automating environment variable and argument fuzzing • Mastering in-memory fuzzing techniques • Constructing custom fuzzing frameworks and tools • Implementing intelligent fault detection Attackers are already using fuzzing. You should, too. Whether you're a developer, security engineer, tester, or QA specialist, this book teaches you how to build secure software. A Guide to Kernel Exploitation: Attacking the Core discusses the theoretical techniques and approaches needed to develop reliable and effective kernel-level exploits, and applies them to different operating systems, namely, UNIX derivatives, Mac OS X, and Windows. Concepts and tactics are presented categorically so that even when a specifically detailed vulnerability has been patched, the foundational information provided will help hackers in writing a newer, better attack; or help pen testers, auditors, and the like develop a more concrete design and defensive structure.The book is organized into four parts. Part I introduces the kernel and sets out the theoretical basis on which to build the rest of the book. Part II focuses on different operating systems and describes exploits for them that target various bug classes. Part III on remote kernel exploitation analyzes the effects of the remote scenario and presents new techniques to target remote issues. It includes a step-by-step analysis of the development of a reliable, one-shot, remote exploit for a real vulnerabilitya bug affecting the SCTP subsystem found in the Linux kernel. Finally, Part IV wraps up the analysis on kernel exploitation and looks at what the future may hold. Covers a range of operating system families — UNIX derivatives, Mac OS X, Windows Details common scenarios such as generic memory corruption (stack overflow, heap overflow, etc.) issues, logical bugs and race conditions Delivers the reader from user-land exploitation to the world of kernel-land (OS) exploits/attacks, with a particular focus on the steps that lead to the creation of successful techniques, in order to give to the reader something more than just a set of tricks

The number of security countermeasures against user-land exploitation is on the rise. Because of this, kernel exploitation is becoming much more popular among exploit writers and attackers. Playing with the heart of the operating system can be a dangerous game: This book covers the theoretical techniques and approaches needed to develop reliable and effective kernel-level exploits and applies them to different operating systems (Linux, Solaris, Mac OS X, and Windows). Kernel exploits require both art and science to achieve. Every OS has its quirks and so every exploit must be molded to fully exploit its target. This book discusses the most popular OS families—UNIX derivatives, Mac OS X, and Windows—and how to gain complete control over them. Concepts and tactics are presented categorically so that even when a specifically detailed exploit has been patched, the foundational information that you have read will help you to write a newer, better attack or a more concrete design and defensive structure.

• Covers a range of operating system families — UNIX derivatives, Mac OS X, Windows
• Details common scenarios such as generic memory corruption (stack overflow, heap overflow, etc.) issues, logical bugs and race conditions
• Delivers the reader from user-land exploitation to the world of kernel-land (OS) exploits/attacks, with a particular focus on the steps that lead to the creation of successful techniques, in order to give to the reader something more than just a set of tricks

A Guide to Kernel Attacking the Core discusses the theoretical techniques and approaches needed to develop reliable and effective kernel-level exploits, and applies them to different operating systems, namely, UNIX derivatives, Mac OS X, and Windows. Concepts and tactics are presented categorically so that even when a specifically detailed vulnerability has been patched, the foundational information provided will help hackers in writing a newer, better attack; or help pen testers, auditors, and the like develop a more concrete design and defensive structure. The book is organized into four parts. Part I introduces the kernel and sets out the theoretical basis on which to build the rest of the book. Part II focuses on different operating systems and describes exploits for them that target various bug classes. Part III on remote kernel exploitation analyzes the effects of the remote scenario and presents new techniques to target remote issues. It includes a step-by-step analysis of the development of a reliable, one-shot, remote exploit for a real vulnerabilitya bug affecting the SCTP subsystem found in the Linux kernel. Finally, Part IV wraps up the analysis on kernel exploitation and looks at what the future may hold.

Discover all the security risks and exploits that can threaten iOS-based mobile devices

iOS is Apple's mobile operating system for the iPhone and iPad. With the introduction of iOS5, many security issues have come to light. This book explains and discusses them all. The award-winning author team, experts in Mac and iOS security, examines the vulnerabilities and the internals of iOS to show how attacks can be mitigated. The book explains how the operating system works, its overall security architecture, and the security risks associated with it, as well as exploits, rootkits, and other payloads developed for it.

• Covers iOS security architecture, vulnerability hunting, exploit writing, and how iOS jailbreaks work
• Explores iOS enterprise and encryption, code signing and memory protection, sandboxing, iPhone fuzzing, exploitation, ROP payloads, and baseband attacks
• Also examines kernel debugging and exploitation
• Companion website includes source code and tools to facilitate your efforts

iOS Hacker's Handbook arms you with the tools needed to identify, understand, and foil iOS attacks.

Discover all the security risks and exploits that can threaten iOS-based mobile devices

iOS is Apple's mobile operating system for the iPhone and iPad. With the introduction of iOS5, many security issues have come to light. This book explains and discusses them all. The award-winning author team, experts in Mac and iOS security, examines the vulnerabilities and the internals of iOS to show how attacks can be mitigated. The book explains how the operating system works, its overall security architecture, and the security risks associated with it, as well as exploits, rootkits, and other payloads developed for it.

• Covers iOS security architecture, vulnerability hunting, exploit writing, and how iOS jailbreaks work
• Explores iOS enterprise and encryption, code signing and memory protection, sandboxing, iPhone fuzzing, exploitation, ROP payloads, and baseband attacks
• Also examines kernel debugging and exploitation
• Companion website includes source code and tools to facilitate your efforts

iOS Hacker's Handbook arms you with the tools needed to identify, understand, and foil iOS attacks.

"The number of security countermeasures against user-land exploitation is on the rise. Because of this, kernel exploitation is becoming much more popular among exploit writers and attackers. Playing with the heart of the operating system can be a dangerous game : this book covers the theoretical techniques and approaches needed to develop reliable and effective kernel level exploits and applies them to different operating systems (UNIX derivatives, Mac OS X, and Windows). Kernel exploits require both art and science to achieve. Every SO has to quirks and so every exploit must be molded to fully exploit this target. This book discusses the most popular OS families - UNIX derivatives, Mac OS X, and Windows - and how to gain complete control over them. Concepts and tactics are presented categorically so that even when a specifically detailed exploit has been patched, the foundational information that you have read will help you to write a newer, better attack or a more concrete design and defensive structure." (source : 4ème de couverture) Fuzzing for Software Security Testing and Quality Assurance gives software developers a powerful new tool to build secure, high-quality software, and takes a weapon from the malicious hackers' arsenal. This practical resource helps developers think like a software cracker, so they can find and patch flaws in software before harmful viruses, worms, and Trojans can use these vulnerabilities to rampage systems. Traditional software programmers and testers learn how to make fuzzing a standard practice that integrates seamlessly with all development activities. The book progresses through each phase of software development and points out where testing and auditing can tighten security. It surveys all popular commercial fuzzing tools and explains how to select the right one for a software development project. The book also covers those cases where commercial tools fall short and developers need to build their own custom fuzzing tools "Fuzzing is the first and only book to cover fuzzing from start to finish, bringing disciplined best practices to a technique that has traditionally been implemented informally. The authors begin by reviewing how fuzzing works and outlining its crucial advantages over other security testing methods. Next, they introduce state-of-the-art fuzzing techniques for finding vulnerabilities in network protocols, file formats, and web applications; demonstrate the use of automated fuzzing tools; and present several insightful case histories showing fuzzing at work."--Jacket A complete guide for the developer or student, this text provides an overview of general concepts and terminology, investigates the salient features of the reference processor, thoroughly explores the services and features of the reference RTOS, and culminates with a major case study. Perfect for embedded systems programmers, software engineers, electrical engineers, or firmware engineers with a programming background in C or C++. This comprehensive reference goes through each phase of software development and points out where testing and auditing can tighten security. It surveys all popular commercial fuzzing tools and explains how to select the right one for a software development project. The book also identifies those cases where commercial tools fall short and when there is a need for building your own fuzzing tools. Offers software developers a tool to build secure, high-quality software, and takes a weapon from the malicious hackers' arsenal. This book helps developers think like a software cracker, so they can find and patch flaws in software before harmful viruses, worms, and Trojans can use these vulnerabilities to rampage systems. "The world loves iOS. Users love the convenience. Black hats love the vulnerability. This book arms you with the knowledge and tools to protect your organization's iOS devices. If you're a developer, it will also help you create hack-resistant applications."--P. [4] of cover-- Source other than Library of Congress "The world loves iOS. Users love the convenience. Black hats love the vulnerability. This book arms you with the knowledge and tools to protect your organization's iOS devices. If you're a developer, it will also help you create hack-resistant applications."--Page 4 of cover