4 ms·
Apple's Predicament – NSPredicate Exploitation on macOS and iOS [video]
- 1over137 3y agohttps://yewtu.be/watch?v=R62sm30G2Jw https://yewtu.be/watch?v=R62sm30G2Jw
- nope96 3y agoVideo's description : "Sep 15, 2023 -- In 2021 the FORCEDENTRY sandbox escape introduced the usage of NSPredicate in an iOS exploit. This new technique allowed attackers to sidestep codesigning, ASLR, and all other mitigations to execute arbitrary code on Apple devices. As a result, Apple put in place new restrictions to make NSPredicate less powerful and less useful for exploits. This presentation will cover new research showing that these added restrictions could be completely circumvented in iOS 16, and how NSPredicates could be exploited to gain code execution in many privileged iOS processes. This technical deep dive will be a rare instance of iOS security that anyone can comprehend without years of experience."
- ec109685 3y agoThe deck: https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Austin%20Emmitt%20-%20Apple%27s%20Predicament%20NSPredicate%20Exploitation%20on%20macOS%20and%20iOS.pdf https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20pre... Quite reminiscent of the exploits the JVM suffered with reflection and deserialization. Fascinating how many iterations it took Apple to mitigate huge gaping holes. I imagine they were trying to do least invasive thing possible each time while they worked behind the scenes to fundamentally secure the primitive.
- dwaite 3y agoNSPredicate is a rather old system which is (or at least was) extremely open. I suspect few developers realized just how much they could get out of NSPredicate across sandbox boundaries when mediated by the OS. However, that also means locking this down without understanding developer usage would also be a severely breaking change for potentially important software on the platform.