One bite and all your dreams will come true: Analyzing and Attacking Apple Kernel Drivers

Video thumbnail (Frame 0) Video thumbnail (Frame 1247) Video thumbnail (Frame 2146) Video thumbnail (Frame 2760) Video thumbnail (Frame 3286) Video thumbnail (Frame 4612) Video thumbnail (Frame 5263) Video thumbnail (Frame 6792) Video thumbnail (Frame 7422) Video thumbnail (Frame 8749) Video thumbnail (Frame 9722) Video thumbnail (Frame 10219) Video thumbnail (Frame 10906) Video thumbnail (Frame 11733) Video thumbnail (Frame 12382) Video thumbnail (Frame 12952) Video thumbnail (Frame 13863) Video thumbnail (Frame 14440) Video thumbnail (Frame 15076) Video thumbnail (Frame 15850) Video thumbnail (Frame 16407) Video thumbnail (Frame 16916) Video thumbnail (Frame 17568) Video thumbnail (Frame 18810) Video thumbnail (Frame 19497) Video thumbnail (Frame 20222) Video thumbnail (Frame 21542) Video thumbnail (Frame 22823) Video thumbnail (Frame 23297) Video thumbnail (Frame 24897) Video thumbnail (Frame 25690) Video thumbnail (Frame 26462) Video thumbnail (Frame 27012) Video thumbnail (Frame 27892) Video thumbnail (Frame 28597) Video thumbnail (Frame 29764) Video thumbnail (Frame 30743) Video thumbnail (Frame 31552) Video thumbnail (Frame 32147) Video thumbnail (Frame 32806) Video thumbnail (Frame 33755) Video thumbnail (Frame 34862)
Video in TIB AV-Portal: One bite and all your dreams will come true: Analyzing and Attacking Apple Kernel Drivers

Formal Metadata

One bite and all your dreams will come true: Analyzing and Attacking Apple Kernel Drivers
Title of Series
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Release Date

Content Metadata

Subject Area
Though many security mechanisms are deployed in Apple's macOS and iOS systems, some old-fashioned or poor-quality kernel code still leaves the door widely open to attackers. Especially, as kernel's critical components, device drivers are frequently exploited to attack Apple systems. In fact, bug hunting in Apple kernel drivers is not easy since they are mostly closed-source and heavily relying on object-oriented programming. In this talk, we will share our experience of analyzing and attacking Apple kernel drivers. In specific, we will introduce a new tool called Ryuk. Ryuk employs static analysis techniques to discover bugs by itself or assist manual review. In addition, we further combine static analysis with dynamic fuzzing for bug hunting in Apple drivers. In specific, we will introduce how we integrate Ryuk to the state-of-art Apple driver fuzzer, PassiveFuzzFrameworkOSX, for finding exploitable bugs. Most importantly, we will illustrate Ryuk's power with several new vulnerabilities that are recently discovered by Ryuk. In specific, we will show how we exploit these vulnerabilities for privilege escalation on macOS 10.13.3 and 10.13.2. We will not only explain why these bugs occur and how we find them, but also demonstrate how we exploit them with innovative kernel exploitation techniques.
Kernel (computing) Device driver Information security
Fluid statics Computer file Device driver Mathematical analysis Information security Expert system Device driver Fuzzy logic System call Twitter Vulnerability (computing)
Service (economics) INTEGRAL Device driver Client (computing) Computer programming Cache (computing) Semiconductor memory Kernel (computing) Object (grammar) Spacetime Extension (kinesiology) Library (computing) Noise (electronics) Interface (computing) Computer program Client (computing) Binary file Device driver System call Order (biology) Interface (computing) Physical system Spacetime Library (computing) Extension (kinesiology)
Service (economics) Client (computing) Parameter (computer programming) Computer programming Message passing Read-only memory Oval Object (grammar) Universe (mathematics) Spacetime Implementation Resultant Spacetime
Area Information Link (knot theory) Software developer Code Software developer Execution unit Code Device driver Client (computing) Client (computing) Device driver Rule of inference Revision control Vortex Process (computing) Kernel (computing) Cuboid Energy level Spacetime Routing Family Spacetime
Subject indexing Arithmetic mean Resource allocation Error message Channel capacity Personal digital assistant Object (grammar) Personal digital assistant Information Funktionalanalysis Object (grammar) Disk read-and-write head
Chord (peer-to-peer) Frame problem Computer icon Slide rule Link (knot theory) Key (cryptography) Information Channel capacity Demo (music) Cloud computing Maxima and minima Price index Thread (computing) 32-bit Leak Inclusion map Uniform resource locator CAN bus Personal digital assistant Kernel (computing) Hill differential equation Spacetime Information
Vulnerability (computing) Group action Atomic nucleus Freeware Link (knot theory) Link (knot theory) Database transaction Client (computing) Parameter (computer programming) Group action Database transaction Traverse (surveying)
Vulnerability (computing) Execution unit Freeware Shared memory Client (computing) Database transaction Parameter (computer programming) Client (computing) Funktionalanalysis Database transaction Causality Chain Spacetime Freeware Table (information) Default (computer science)
Category of being Chain Freeware Host Identity Protocol Kernel (computing) Memory management Coroutine Object (grammar) Freeware
Quantum state Strut Shared memory Coroutine Device driver Disk read-and-write head Thread (computing) Pivot element Wave packet Product (business) Chain Pointer (computer programming) Process (computing) Kernel (computing) Spacetime Process (computing) Identity management Electric current Exception handling Physical system
Point (geometry) Mathematics Chain Game controller Chain Stack (abstract data type) Control flow Content (media) Pivot element Address space
Point (geometry) Root Kernel (computing) Revision control Device driver Convex hull Gastropod shell Local ring Routing Vulnerability (computing)
Source code Code Device driver Binary file
Type theory File format Code Function (mathematics) Tap (transformer) Inference MIDI Code Parameter (computer programming) Menu (computing) Funktionalanalysis System call
Email Scripting language System call Identifiability Table (information) Code Graph (mathematics) Data recovery Mathematical analysis Variable (mathematics) Virtual reality Type theory Robotics Series (mathematics) Social class Scripting language Source code File format Data recovery Code Coroutine Funktionalanalysis Device driver System call Fluid statics Oval Tower Time evolution Series (mathematics) Function (mathematics) Order (biology) Website Social class Figurate number Table (information) Arithmetic progression Identity management Writing Extension (kinesiology)
Meta element Information Mountain pass Strut Thermal expansion Trigonometric functions Latent heat Sample (statistics) Function (mathematics) Social class Data structure System identification Data structure Pressure
Source code Meta element Table (information) Execution unit Code Funktionalanalysis Pointer (computer programming) Virtual reality Oval Function (mathematics) Social class Figurate number Object (grammar) System identification Table (information) Data structure Social class Spacetime
Meta element Inheritance (object-oriented programming) Table (information) Real number Water vapor Pointer (computer programming) Virtual reality Kernel (computing) Object (grammar) System identification Game theory Social class Service (economics) Key (cryptography) Inheritance (object-oriented programming) Data recovery Funktionalanalysis Device driver Symbol table Annulus (mathematics) Inclusion map Process (computing) Oval Personal digital assistant Function (mathematics) Social class Object (grammar) Table (information) Arithmetic progression Data structure Reading (process)
Service (economics) Function (mathematics) Data recovery Kernel (computing) Social class Coma Berenices Online help Funktionalanalysis Family
Game controller Identifiability Real number Plotter Tap (transformer) Binary code Water vapor Variable (mathematics) Sign (mathematics) Type theory Strategy game Average System identification Local ring Position operator Social class Data type Data dictionary Service (economics) Code Sound effect Parameter (computer programming) Stack (abstract data type) Funktionalanalysis Control flow 10 (number) Type theory Resource allocation Personal digital assistant Function (mathematics) Figurate number Task (computing) Local ring
Source code Source code Code Maxima and minima Funktionalanalysis Density of states Device driver 10 (number) Variable (mathematics) CAN bus Uniform resource locator Goodness of fit Virtual reality Function (mathematics) Bloch wave Hill differential equation Table (information) Data structure Writing Social class
Operations research Execution unit Implementation Line (geometry) Code Funktionalanalysis Group action Virtual reality Event horizon Doubling the cube Function (mathematics) String (computer science) Operator (mathematics) Implementation Data structure
Data dictionary Group action System call Graph (mathematics) Mathematical analysis Mathematical analysis Funktionalanalysis Variable (mathematics) Virtual reality Type theory Fluid statics Personal digital assistant Function (mathematics) Authorization Procedural programming
Dataflow State of matter Disintegration File format Set (mathematics) Mathematical analysis Mereology Goodness of fit Exclusive or Kernel (computing) Implementation output Fuzzy logic Condition number Electric generator Electronic program guide Mathematical analysis Code Data analysis Mereology Device driver Message passing Process (computing) Fluid statics Order (biology) Inference output Website Figurate number
Email Parsing Strut Electronic program guide Web page File format Error message Oval Kernel (computing) Revision control Arrow of time Information Process (computing) Fuzzy logic Physical system Data buffer
Web page Email Implementation Context awareness Run time (program lifecycle phase) Web page Electronic program guide Sheaf (mathematics) Dressing (medical) Causality Error message Resource allocation Oval Kernel (computing) Inference Process (computing) Fuzzy logic Physical system Resultant Data buffer Address space
Vulnerability (computing) Quantum state Patch (Unix) Electronic program guide Causality Mathematics Error message Kernel (computing) Sheaf (mathematics) Order (biology) Spacetime Interrupt <Informatik> Figurate number Fuzzy logic Electric current Spacetime
Vulnerability (computing) Patch (Unix) Electronic program guide Physical law Funktionalanalysis Word Error message Oval Kernel (computing) Spacetime Fuzzy logic Local ring Spacetime Address space
Source code Vulnerability (computing) Uniform resource locator Fluid statics Personal digital assistant State of matter Kernel (computing) Mathematical analysis Mereology Device driver Mereology Twitter
our next peak years one of the turning one of those brand new. we have a little tradition for brand new speakers so before we get started. we're going to a shot. oh. i. the. how. the ohio and so good i'm no airline today today way we operate them to talk about it. security one bite and the oil dreams will come to an ally the and attacking a ball cannot drive earth so this is based on my name is john me you can call me spark a way i ph d.'s and work for our ababa.
so here is the agenda at first we briefly in her deals what is cannot driver then we talk about your vulnerabilities the airport drivers.
after that we will talk about almost to calls you are not rising as for drivers and there's a introduce a new tool called wreak for analyzing and the filing cannot drivers. so let's start.
first thing you should know his every driver you an income noise the axing your is a country extension they share the same space with the condo american oil s. drivers located means a system library extensions. iowa's drivers are integrity the ways condo in the cage. i cannot drivers provide the euro climbed which are can all the checks for drivers probably why the stories to programs your first place.
also your the client is the interface between euro space of vacations and devices. the order to provide services come up your clients need to implement several call back messrs like external mastered klein the memory for hive register no difficulty import on crime the clothes and song.
the most important to master a callback mastered he is the external master which provides a message to you and our space program the selector is used the tools they let the master to use a crime arguments are past the to us he led to the mastered. these parish is a strike strive to reprise the hearing the master to be called the target is a target that you have a crime the fall the master to be called on reference is the result of the she is in the back to the universities.
despite the street could stand a box restriction some your clients ask you'll be obsessed ball to send the box eps aisle as forgive them all i owe you tried the label your client and i also obvious that rules you're the kind. so now we all share some of one of haiti's away from the airport drivers will the first thing you should know is a driver areas of the driver are good targets for exploiting the condo because they share the same space with the car and of they have the same cannot.
privilege soul some drivers are programmed up by third party vendors not the connaught developers sold a code of quality is not guaranteed. so a lot of drivers are frequently exploited the unit attacks against the cannot including the job greek i'll also one or a taser use the union job rhee forgive them hall i.r.s. a leveling use the aisles of is the route. nine euros the first in their in their first version the you'll have the ilo hiv family and the second version in the urals i'll offer free him i'll mobile offer from darfur. the first this is the first of the warmer it down their ability to is a year for information link year i'll fly our family it is caused by initialize the condo stead well over a bull which pays out ten.
will handle means i asked old channel elk cases.
at the oak as they use up i'll say channel create the out channel handle his past the union to the head all the jet to function. in this function you can see the out handle for the be said to weigh the index of when you add the the object but the when the new capacity ricci's f f f t you object to will not be added and out handle will not be said.
recall the location case the external master out hand though is an initial lies the overall and the return of who you lost the base so that is the f.a.. is an evil mission link.
you can use this information to help your to get of the can also lied and have been defeated the key as they are.
on the second the bargain is yours are free of another eighteen the ilo a salary of her family to. it has a mess are called s. transaction and in this mess are your the client who will call to action in the ilo because there are these play pipe to note that all you have a client's to share our a steam pipe to use teens.
the piper tool can contain is a link least of all transactions and the piper to will have traversed the nucleus of to find a transaction. and then call the said the transaction arguments of all the farm the transaction.
however union the transaction argument said that kind of press transaction arguments functioning of a crime piper you have a crime that too is a member of the transaction tool and the functional will call the return mastered the of the your client. but the higher you have acquired that can be released by calling i also was closed for the from your us based which we are called though you'll laugh free.
so here is the steps fall exploited the spark first way we created to hire your client then we added a transaction for the first the you're the kind and as an we released you'll that klein after that which end of the transaction from the second year the crime is. we are trigger the your life free of his party's fix the because now. the piper your clients don't share a steam pipe. the sole how to exploit the years after the free barley in the coastal here is the basic for all first layer we construct the rope chains as then trigger the release after that we use our feet object the with the feet of the table to occupies the the employee slot.
last but not least that we trigger the years after free by invoking the master of all the object.
the hip summary technical we used to use this of our liberty is or as fast and centralise the x.m.l. the uk more hated by setting profit properties of a device.
not that the brit data can be read and the head of ray the data is controllable all so this is a rope train for the privilege escalation first in a way your thus dec humor to control the dead at present as a pointer to the strike a product of.
car in the process then we can to your credit the from prague and instead c.r.u. ideas they are you idea of c.r.'s of the new id to the or after their to well you'll have to read exception to each of these to cano more than and the return to your the more then we can excuse the system bear she took care to. together share always of wood privilege.
just as people are away your with the union. and this role cheney's as a following in gary's. feels the ying thus dec he worked as the beginning and wales i x to control our assets then way your assets to control ice sheet which is just that point her.
so here is the layout of the edges year old chain knows that i x aged is controlled by us.
of by using these vulnerabilities away god a privilege escalation are mcavoy us. from holland. king tempo and starting point to an tempo and thirteen point three. and so there is a gamble on.
ponson him point three and as you can say wake although a route to share all. in this in this mecca less. so shallow well call them all about drivers analyzing and a farthing on oprah. the same spot the next to the we're going to show how we found there was one the beatles and the.
i would hours are mostly close last are you all the to offend want to be his we know you to do some rooijen year but it is not an easy at first i would look better and that he compiled a cold off to our enemies and the a pro.
in that the pair to compare the cold all format quite straight were you can see that the function names are kept and bought the are many problems such as wrong paramilitary for its last the rubble taps and the unknown to function call.
and it's four hours to the kind of flowers and a situation is even worse and we have no idea what this code represents it's a mess.
in fact the order to find someone abilities all do some research we want to compare the code would be just like the sauce call just like the figures suggest.
and so we propose a new tool to analyze hours in my class and how us and this too is called a real which is listed to the nicest to fall making eiffel towers to compare the cold malek sauce call to his implementing the idea of progress and script and the name.
we'll take a stand fall kept her in the comic series that's not a lousy reaching apple. so it requires that were features as people can identify name size and with tables for classes can recover function names were so war over robot has extended cross-reference extend the u.s. appalled and the construct all costs. this. so forcefully real identifies name and the sites for classes to identify b.c. formation from some specific in his writings and function of the feeder shoals ascend holiness reggie's and function looks like this the eye can see that the the scolding indicates some.
some information off the costly for example the name and its size. the city's identify the cost me my size of the concrete structures of the idea pro represent these costs.
and besides i recall can also identify the tables for classes and. sleepless across the full cost has a tiny which will function it always has this frosh recall that we people to organize its which functions trust like the figures suggest.
we identify classes with tables with a keen and that he's a healthful class the table there's always a pond her pointing to the cost of medical met class object this is a special all objects. and they recall that in this space figure in a special unit years raising function of it.
this function also all also feels weird a better class object he's so is about key and became used to read class object to address to find a costly table and a half by the weekend and creates traffickers the any approach to represent these of the tables and send the first member of. awful crossed progress to upon her the to deal with tables. the next feature off real cases a recovering function names as we can see hours for hours i lost off singles the functions he now is for us to know how to not have a meaningful names at all they all the naysayers of the prefix we saw it.
we recover function names but now we're just so sad were affects the first fact is that most classes mean for our new creature from crossing the colonel and these colonel classes have symbols the sec fact is that the simplest past when caught a welsh how the causing her his book part of the process. and the all rise of a water function the parents can find shannon child's function of how the same name and the same offset has showing in this few. so is a soft facts we care a car with the names off water functions that already functions he and colonel classes.
actually this season all her a complete solution. in college and helpful critical functions.
another critical feature off real case that it can't be resold caps off local a local grable of global and a member of holes in the the compelled to call its mastery is to first identify local rivals taps and then pull from temper bank is tempered by titian long control flows. i doubt many top ten's off local or ago such as which which are called for me to rubble and the stack workable. for perry me to rubble we identify their taps bell average in effect that days a year the better it said prosperous function names are you call the the with your the functions of class name and apparently the taps so paying coding these names we can know the pensions apparently the taps just as the. the figures shows. of foster corals we identified your creation and the new strategies. by finding a typical functions has a mistake here. so after wearable tabs identified a weekend pro back to its plot along functions control for local off their and pepper position we figure out what to wear rivals are signs are assigned always the were rubble was ted art is defined in.
and there's senate types for them according to the identified high just a. just make peace with the these the speaker shows. next we extend across reference for member robles and that what functions the exam me i resent has been that the compel the cold and off all functions and check whether any member were overall water function is used and then we had held cross-reference seen as a pro.
from the uses off of from these uses from these uses two men were able all functions location in their class always table soldiers.
and now you can see that at the compound called now looks more like a good source code write off.
and for your have to be your for better rewards engineering experienced we as a stand the u.s. operations idea pro.
for example them always show i read aloud trumping pool which functions implementation i trust that double click on what functions call. he was in the you can see that the when we can hear it from two to the functions implementation and we can also from to the trials and in implementation and by pricey have called key. ok.
finally after robert helps on the five which a function calls author so and now we can generally costs for all of ours and this called braf ways to where he pardoned for further in the procedure. a full on the data for analysis.
and now everything is right that we can do many when i say it's all either cannes awful stake and i see this as we want. and you know we will show you his case all group which is called a real folks.
the idea also really really fast is to have died the trial were fighting with starting and i switch off and resorts we implement hated by integrating rick which the state all far to travel farther possible foster more question. rick father takes two sets that's in the first that the poor from people flow analysis to you for two hours required to the user input for most and the sex that uses to you for being put forward to own cabinet important a tad generation in the fighting process and the import. so fuzzy fishy. so he is the first that we perform state good data flow analysis in the to compel the coat to identify whether the user important to check being conditions and the what the parts all checked and the what his the condition trust like to.
these figures shows that we can identify that to all sites when they fall on its sites one should be not be equal to six all want the order to have a wide its this does feel the pos. and then we can go with flowers requirements on usury impose a fault different the exclusion pass and your such knowledge tool get five.
but to foster more cost ten only works on a quest tempah eleven not have fully to work since the on may first to sue down several stand you be resold and the first arrows that he uses wrong offer says to read the colonel at it. i tested.
was for more quest ten. the post at the says awful the kind of whether it's less than one plate.
i actually after my quest tempo and twelve. there is larger than one page.
also this problem which changed the barber said two pages. the second problem is that the and passive fazio for more quest and it was his old wrong way to you for the colonel tax base a year a small regional implementation it defines the price off the throttle and other.
i know which the which was in the cortex section and he uses the search for us find the note that this is. but for now the in the current ameriquest to interrupt hand the race in a rocking you no longer in the context the as a result we cannot find the kind of tax base which the hundred dress.
this change is caused by both medication on and the famous male don't want to be the order to defend against a male body size to move to interrupt hundred or other under some other cold related to the use of space from the colonel text torn. not a special occasion.
just like the the figure on the red suggest. so now the problem and the rays not mean the tech contexts base.
as a solution we look for all the protest base which son was another mr that is we find the press awful some are the kind of functions for example the less often local tax law and the word spiked to find that the current. space and a small stable than the then the than their previous messrs. and so they include you conclusions the in this talk aware how which also want to be at his tend to ten be exploiting the fall of easy to reach a splash it on my quiets and the way.
how we introduced the technique off exploiting yusof we want to believe he's been in the congo and the we also explain the annual state taken us is to call the real and also shows the use case call the real facts. the most important part of all three has been open sourced and you can. fall for crewe the boston now require on might get hot and the also were were calm to follow us on twitter and that we will meant to the economy's the xo ninety nine and the sparks and to the economy in a spokesman. and. that's all and thank you for location.