Black Hat Europe 2020 London, United Kingdom Story of Jailbreaking iOS 13 Author: 08tc3wbb (
[email protected]) Revision by Zuk Avaraham, Raz Mashat Outlines - Review iOS Sandbox weaknesses - Exploit Userland vulnerability CVE-????-???? (iOS 12.0 - iOS 14.1) - Looking for similar bugs - Attack AVEVideoEncoder component - Exploit Kernel vulnerability CVE-2019-8795 (iOS 12.0 - iOS 13.1.3) - Exploit Kernel vulnerability CVE-2020-9907 (iOS 13.2 - iOS 13.5.1) - Exploit Kernel vulnerability CVE-????-???? (iOS 13.6 - iOS 13.7) iOS security consists of many layers, and hackers can find vulnerabilities in different layers to gain different levels of access, and it's also possible to link multiple vulnerabilities together to form an exploit chain. The unique aspect of this paper is to analyze the threat from userland vulnerabilities, and then use its advantages to attack the neglected kernel weaknesses, thereby completing the privilege escalation from the user to the kernel. It may not sound as cool as attacking the kernel directly. Still, it has been proven to be a practical method for jailbreaking. Also, such exploits are eligible for various bounty programs and are well hidden, which reduces the chance of bug collision. These are important factors that an independent researcher needs to consider before deciding to enter the field full-time. A general term "Sandbox" refers to similar security mechanisms for separating running programs by controlling the power and resources that a process may use. It's customizable and evolvable. Thus it lets Apple neutralize many kinds of vulnerabilities in a very short period of time, with almost no overhead added.