Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Over The Air - Vol. 2, Pt. 1: Exploiting The Wi-Fi Stack on Apple Devices

projectzero.google | blog | #attack-surface | #ios | #apple | #exploit-chain | #project-zero | #broadcom | #wi-fi

Summary

Project Zero revisits Broadcom's Wi-Fi stack through Apple devices, mapping new attack surfaces and building toward a full over-the-air exploit chain against iPhones.
Published
Collected

original ↗

Related coverage

blog · projectzero.google
Over The Air - Vol. 2, Pt. 3: Exploiting The Wi-Fi Stack on Apple Devices
The final part of Project Zero's Over The Air series, completing a remote kernel code execution chain on the iPhone 7 using Wi-Fi communication alone.
blog · projectzero.google
Over The Air - Vol. 2, Pt. 2: Exploiting The Wi-Fi Stack on Apple Devices
Part two of Project Zero's Over The Air Vol. 2 series, focusing on the firmware running on Broadcom's Wi-Fi SoC in the iPhone 7 as a step toward over-the-air exploitation.
blog · projectzero.google
Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 1)
Part one of Project Zero's Over The Air series, turning attention from application processors to Wi-Fi chips and finding flaws in Broadcom's widely used Wi-Fi stack.
blog · projectzero.google
More Mac OS X and iPhone sandbox escapes and kernel bugs
A Google Project Zero rundown of sandbox escape and privilege escalation bugs in Mac OS X and iOS fixed by Apple in OS X 10.9.5 and iOS 8.
blog · projectzero.google
DER Entitlements: The (Brief) Return of the Psychic Paper
Research on DER-encoded entitlement handling that briefly revived the Psychic Paper technique for forging iOS entitlements, covering the root cause and subsequent fixes.
blog · projectzero.google
In-the-wild iOS Exploit Chain 1
TL;DR This exploit provides evidence that these exploit chains were likely written contemporaneously with their supported iOS versions; that is, the exploit techniques which were used suggest that this exploit was written around the time of iOS 10. This suggests that this group had a capability against a fully patched iPhone for at least two years.
back