26 ms·
> As an exploit category, iOS sandbox escapes are medium difficulty. Are there any published explanations of exploits that achieve this? Just curious what it w
by nodamage 7y ago
> As an exploit category, iOS sandbox escapes are medium difficulty.
Are there any published explanations of exploits that achieve this? Just curious what it would look like.
- comex 7y agoProject Zero has some excellent writeups. Here is one from last year where the author exploited a kernel vulnerability that’s directly accessible from within the sandbox: “voucher_swap: Exploiting MIG reference counting in iOS 12” https://googleprojectzero.blogspot.com/2019/01/voucherswap-exploiting-mig-reference.html https://googleprojectzero.blogspot.com/2019/01/voucherswap-e... And here is a massive writeup, also from last year, analyzing the privilege escalation parts of no fewer than five different exploit chains, which were found bundled together in a real attack, each targeting a different range of iOS versions. Not five exploits, five chains. It’s a great read: “A very deep dive into iOS Exploit chains found in the wild” https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...