The Fully Remote Attack Surface of the iPhone

A Google Project Zero publication of details on Mac OS X and iPhone sandbox escape bugs after Apple shipped fixes.

The initial primitive gained from the vulnerability is an absolute address dereference in which the read value is afterwards used as an ObjC object. As such, some knowledge of the target address space is required in order to exploit this vulnerability for remote code execution. This blog post describes a way to defeat ASLR remotely without any additional information disclosure vulnerabilities.

In my role here at Project Zero, I do not use some of the tooling used by some external iOS security researchers, in particular development-fused iPhones with hardware debugging capabilities like JTAG enabled. I believe that access to such devices puts those who can obtain them at a significant advantage over researchers who can not or do not wish to use them. Thus, early this year I decided I would try to find a way to build such a capability using regular iPhones you can buy at an Apple store. I identified iBoot and KTRR as primary areas for research, and spent several months looking for vulnerabilities.

The final part of Project Zero's Over The Air series, completing a remote kernel code execution chain on the iPhone 7 using Wi-Fi communication alone.

Part two of Project Zero's Over The Air Vol. 2 series, focusing on the firmware running on Broadcom's Wi-Fi SoC in the iPhone 7 as a step toward over-the-air exploitation.

A Google Project Zero essay on what makes a memory corruption vulnerability valuable, focusing on how reliably it can be exploited.