4 ms·

Remotely dump memory with no interaction on iPhone 11 Pro (fixed in iOS 13.3.1)

100 points by notRobot 7y ago

saagarjha 7y ago
> The physical memory dumping is abusing the fact that on iOS the physmap region, which provides direct virtual mappings of large parts of device physical memory is larger than the random ASLR shift which is applied to it. It's almost 4GB in size, but its virtual address only varies by around 1GB, leading to kernel virtual addresses which are always mapped and which provide a window in to device physical memory. Not the first time Apple has messed up ASLR because the thing that they’re sliding has gotten too large…
marton78 7y ago
Why would People of Color do such a thing?
DangerousPie 7y ago
Maybe it would be good to change the title to say `(fixed in iOS 13.3.1)` instead of `(iOS 13.3)`, to make it clear that this is not a zero day.
- ConcernedCoder 7y ago
  Well how would you expect to get any clicks doing that?
  - kardos 7y ago
    It's a bug tracker. Is it ad supported? Would they even want superfluous clicks?
    - rudolph9 7y ago
      OP want clicks.
      - notRobot 7y ago
        Why would I?
      - NotHereNotThere 7y ago
        What would be the point of getting clicks to a bug tracker which he doesn't own?
  - jchw 7y ago
    Lot of cynicism on HN today :( but I suggest that if someone links to a Project Zero bug about iOS you can pretty much assume it’s been patched, and the OP claims HN title character limit is the true reason for the omission. If a bug is unpatched I’d actually expect the title to specify that instead...
- notRobot 7y ago
  HN title character limit didn't allow me to.
  - dang 7y ago
    I've squeezed it in there now at the cost of a little ungrammaticalness. (Submitted title was "PoC remotely dump memory with no user interaction on iPhone 11 Pro (iOS 13.3)".)
    - sixstringtheory 7y ago
      I still see only 13.3, not 13.3.1... could do this: > Remotely dump memory w/o user interaction on iPhone 11 Pro (fixed iOS 13.3.1)
      - dang 7y ago
        Thanks, I missed that. I've moved things around a bit.
    - notRobot 7y ago
      Good enough :)
  - deleted 7y ago
    [deleted]
  - notlukesky 7y ago
    It would be nice if they increased the title limit.
deleted 7y ago
[deleted]
kristopher 7y ago
This also affected MacBooks and was fixed in MacOS 10.15.3 iOS: https://support.apple.com/en-us/HT210918 https://support.apple.com/en-us/HT210918 MacOS: https://support.apple.com/en-us/HT210919 https://support.apple.com/en-us/HT210919
koolba 7y ago
Does this work if AirDrop is disabled but Bluetooth is on? How about if just AirDrop is off?

100 points by notRobot 7y ago

> The physical memory dumping is abusing the fact that on iOS the physmap region, which provides direct virtual mappings of large parts of device physical memory is larger than the random ASLR shift which is applied to it. It's almost 4GB in size, but its virtual address only varies by around 1GB, leading to kernel virtual addresses which are always mapped and which provide a window in to device physical memory. Not the first time Apple has messed up ASLR because the thing that they’re sliding has gotten too large…

marton78 7y ago

Why would People of Color do such a thing?

DangerousPie 7y ago

Maybe it would be good to change the title to say `(fixed in iOS 13.3.1)` instead of `(iOS 13.3)`, to make it clear that this is not a zero day.

ConcernedCoder 7y ago
Well how would you expect to get any clicks doing that?
- kardos 7y ago
  It's a bug tracker. Is it ad supported? Would they even want superfluous clicks?
  - rudolph9 7y ago
    OP want clicks.
    - notRobot 7y ago
      Why would I?
    - NotHereNotThere 7y ago
      What would be the point of getting clicks to a bug tracker which he doesn't own?
- jchw 7y ago
  Lot of cynicism on HN today :( but I suggest that if someone links to a Project Zero bug about iOS you can pretty much assume it’s been patched, and the OP claims HN title character limit is the true reason for the omission. If a bug is unpatched I’d actually expect the title to specify that instead...
notRobot 7y ago
HN title character limit didn't allow me to.
- dang 7y ago
  I've squeezed it in there now at the cost of a little ungrammaticalness. (Submitted title was "PoC remotely dump memory with no user interaction on iPhone 11 Pro (iOS 13.3)".)
  - sixstringtheory 7y ago
    I still see only 13.3, not 13.3.1... could do this: > Remotely dump memory w/o user interaction on iPhone 11 Pro (fixed iOS 13.3.1)
    - dang 7y ago
      Thanks, I missed that. I've moved things around a bit.
  - notRobot 7y ago
    Good enough :)
- deleted 7y ago
  [deleted]
- notlukesky 7y ago
  It would be nice if they increased the title limit.

deleted 7y ago

[deleted]

kristopher 7y ago

This also affected MacBooks and was fixed in MacOS 10.15.3 iOS: https://support.apple.com/en-us/HT210918 https://support.apple.com/en-us/HT210918 MacOS: https://support.apple.com/en-us/HT210919 https://support.apple.com/en-us/HT210919

koolba 7y ago

Does this work if AirDrop is disabled but Bluetooth is on? How about if just AirDrop is off?