iOS Hacker's Handbook
by Miller, Charlie; Blazakis, Dion; DaiZovi, Dino; Esser, Stefan; Iozzo, Vincenzo; Weinmann, Ralf-PhilipEdition: 1st
Format: Paperback
Pub. Date: 2012-05-08
Publisher(s): Wiley
Other versions by this Author
List Price: $44.99
Buy New
Usually Ships in 2-3 Business Days.
$44.54
Buy Used
Usually Ships in 24-48 Hours
$33.74
Rent Book
Select for Price
eBook
We're Sorry
Not Available
How Marketplace Works:
- This item is offered by an independent seller and not shipped from our warehouse
- Item details like edition and cover design may differ from our description; see seller's comments before ordering.
- Sellers much confirm and ship within two business days; otherwise, the order will be cancelled and refunded.
- Marketplace purchases cannot be returned to eCampus.com. Contact the seller directly for inquiries; if no response within two days, contact customer service.
- Additional shipping costs apply to Marketplace purchases. Review shipping costs at checkout.
Summary
This book discusses the internals of iOS. It explains how the operating system works, security risks associated with it, how it can be used in the Enterprise, and the overall security architecture of the operating system. It explains how vulnerabilities can be found in it, exploits developed for it, and rootkits and other payloads developed for it. There is no other book that comes close to covering iOS on this level and the book is written by a panel of some of the world's leading experts in iOS. Overview iOS Security Architecture iOS vulnerability hunting and exploit writing iOS enterprise and encryption How iOS jailbreaks work Specifically, the book will cover: iOS in the Enterprise , Encryption, Code signing and memory protections, Sandboxing, iPhone Fuzzing, Exploitation , ROP payloads, Rootkits, Kernel Debugging and Exploitation, Jailbreaking , Baseband attacks
Author Biography
Charlie Miller is Principal Research Consultant at Accuvant Labs and a four-time CanSecWest Pwn20wn winner. Dionysus Blazakis is an expert on iOS and OS X sandbox security mechanisms. Dino Dai Zovi is coauthor of The Mac Hackers Handbook and a popular conference speaker. Stefan Esser is a PHP security expert and leading researcher of iOS security topics. Vincenzo Iozzo is an independent security researcher focused on Mac OS X and smartphones. Ralf-Philipp Weinmann holds a PhD in cryptography and has an extensive security background.
Table of Contents
| Introduction | p. xv |
| iOS Security Basics | p. 1 |
| iOS Hardware/Device Types | p. 2 |
| How Apple Protects the App Store | p. 2 |
| Understanding Security Threats | p. 3 |
| Understanding iOS Security Architecture | p. 5 |
| The Reduced Attack Surface | p. 5 |
| The Stripped-Down iOS | p. 6 |
| Privilege Separation | p. 6 |
| Code Signing | p. 7 |
| Data Execution Prevention | p. 7 |
| Address Space Layout Randomization | p. 8 |
| Sandboxing | p. 8 |
| A Brief History of iOS Attacks | p. 9 |
| Libtiff | p. 9 |
| Fun with SMS | p. 10 |
| The Ikee Worm | p. 10 |
| Storm8 | p. 11 |
| SpyPhone | p. 12 |
| Pwn2Own2010 | p. 13 |
| Jailbreakme.com 2 ("Star") | p. 13 |
| Jailbreakme.com 3 ("Saffron") | p. 14 |
| Summary | p. 14 |
| iOS in the Enterprise | p. 15 |
| iOS Configuration Management | p. 16 |
| Mobile Configuration Profiles | p. 16 |
| iPhone Configuration Utility | p. 18 |
| Creating a Configuration Profile | p. 18 |
| Installing the Configuration Profile | p. 20 |
| Updating Profiles | p. 25 |
| Removing Profiles | p. 25 |
| Applications and Provisioning Profiles | p. 26 |
| Mobile Device Management | p. 26 |
| MDM Network Communication | p. 27 |
| Lion Server Profile Manager | p. 28 |
| Setting Up Profile Manager | p. 29 |
| Creating Settings | p. 35 |
| Enrolling Devices | p. 38 |
| Summary | p. 45 |
| Encryption | p. 47 |
| Data Protection | p. 47 |
| Data Protection API | p. 48 |
| Attacking Data Protection | p. 51 |
| Attacking User Passcodes | p. 51 |
| iPhone Data Protection Tools | p. 55 |
| Installation Prerequisites | p. 55 |
| Building the Ramdisk | p. 58 |
| Booting Ramdisk | p. 61 |
| Brute-Force Attacking Four-Digit Passcodes | p. 62 |
| Dumping Keychain | p. 64 |
| Dumping Data Partition | p. 65 |
| Decrypting Data Partition | p. 66 |
| Summary | p. 68 |
| Code Signing and Memory Protections | p. 69 |
| Understanding Mandatory Access Control | p. 70 |
| AMFI Hooks | p. 71 |
| AMFI and execv | p. 72 |
| How Provisioning Works | p. 74 |
| Understanding the Provisioning Profile | p. 74 |
| How the Provisioning File Is Validated | p. 77 |
| Understanding Application Signing | p. 78 |
| Inside Entitlements | p. 79 |
| How Code Signing Enforcement Works | p. 80 |
| Collecting and Verifying Signing Information | p. 80 |
| How Signatures Are Enforced on Processes | p. 84 |
| How the iOS Ensures No Changes Are Made to Signed Pages | p. 88 |
| Discovering Dynamic Code Signing | p. 89 |
| Why MobileSafari Is So Special | p. 89 |
| How the Kernel Handles JIT | p. 91 |
| Attacking Inside MobileSafari | p. 94 |
| Breaking Code Signing | p. 95 |
| Altering iOS Shellcode | p. 96 |
| Using Meterpreter on iOS | p. 101 |
| Gaining App Store Approval | p. 103 |
| Summary | p. 104 |
| Sandboxing | p. 107 |
| Understanding the Sandbox | p. 108 |
| Sandboxing Your Apps | p. 109 |
| Understanding the Sandbox Implementation | p. 116 |
| Understanding User Space Library Implementation | p. 117 |
| Into the Kernel | p. 121 |
| Implementing TrustedBSD | p. 121 |
| Handling Configuration from User Space | p. 123 |
| Policy Enforcement | p. 125 |
| How Profile Bytecode Works | p. 126 |
| How Sandboxing Impacts App Store versus Platform Applications | p. 133 |
| Summary | p. 137 |
| Fuzzing iOS Applications | p. 139 |
| How Fuzzing Works | p. 139 |
| The Recipe for Fuzzing | p. 141 |
| Mutation-Based ("Dumb") Fuzzing | p. 141 |
| Generation-Based ("Smart") Fuzzing | p. 142 |
| Submitting and Monitoring the Test Cases | p. 143 |
| Fuzzing Safari | p. 144 |
| Choosing an Interface | p. 144 |
| Generating Test Cases | p. 144 |
| Testing and Monitoring the Application | p. 145 |
| Adventures in PDF Fuzzing | p. 148 |
| Quick Look Fuzzing | p. 153 |
| Fuzzing with the Simulator | p. 155 |
| Fuzzing MobileSafari | p. 158 |
| Selecting the Interface to Fuzz | p. 158 |
| Generating the Test Case | p. 158 |
| Fuzzing and Monitoring MobileSafari | p. 158 |
| PPT Fuzzing Fun | p. 160 |
| SMS Fuzzing | p. 162 |
| SMS Basics | p. 163 |
| Focusing on the Protocol Data Unit Mode | p. 165 |
| Using PDUspy | p. 167 |
| Using User Data Header Information | p. 167 |
| Working with Concatenated Messages | p. 168 |
| Using Other Types of UDH Data | p. 169 |
| Generation-Based Fuzzing with Sulley | p. 170 |
| SMS iOS Injection | p. 175 |
| Monitoring SMS | p. 177 |
| SMS Bugs | p. 182 |
| Summary | p. 184 |
| Exploitation | p. 185 |
| Exploiting Bug Classes | p. 186 |
| Object Lifetime Vulnerabilities | p. 186 |
| Understanding the iOS System Allocator | p. 188 |
| Regions | p. 188 |
| Allocation | p. 189 |
| Deallocation | p. 189 |
| Taming the iOS Allocator | p. 190 |
| Tools of the Trade | p. 190 |
| Learning Alloc/Dealloc Basics | p. 191 |
| Exploiting Arithmetic Vulnerabuities | p. 195 |
| Exploiting Object Lifetime Issues | p. 198 |
| Understanding TCMalloc | p. 200 |
| Large Object Allocation and Deallocation | p. 201 |
| Small Object Allocation | p. 201 |
| Small Object Deallocation | p. 202 |
| Taming TCMalloc | p. 202 |
| Obtaining a Predictable Heap Layout | p. 202 |
| Tools for Debugging Heap Manipulation Code | p. 204 |
| Exploiting Arithmetic Vulnerabilities with TCMalloc - Heap Feng Shui | p. 206 |
| Exploiting Object Lifetime Issues with TCMalloc | p. 211 |
| ASLR Challenges | p. 211 |
| Case Study: Pwn20wn 2010 | p. 213 |
| Testing Infrastructure | p. 217 |
| Summary | p. 218 |
| Return-Oriented Programming | p. 219 |
| ARM Basics | p. 220 |
| iOS Calling Convention | p. 220 |
| System Calls Calling Convention | p. 221 |
| ROP Introduction | p. 222 |
| ROP and Heap Bugs | p. 224 |
| Manually Constructing a ROP Payload | p. 225 |
| Automating ROP Payload Construction | p. 230 |
| What Can You Do with ROP on iOS? | p. 232 |
| Testing ROP Payloads | p. 232 |
| Examples of ROP Shellcode on iOS | p. 235 |
| Exfiltrate File Content Payload | p. 235 |
| Using ROP to Chain Two Exploits (JailBreakMe v3) | p. 242 |
| Summary | p. 247 |
| Kernel Debugging and Exploitation | p. 249 |
| Kernel Structure | p. 249 |
| Kernel Debugging | p. 250 |
| Kernel Extensions and IOKit Drivers | p. 256 |
| Reversing the IOKit Driver Object Tree | p. 257 |
| Finding Vulnerabilities in Kernel Extensions | p. 261 |
| Finding Vulnerabilities in IOKit Drivers | p. 264 |
| Attacking through Device Properties | p. 265 |
| Attacking through External Traps and Methods | p. 266 |
| Kernel Exploitation | p. 269 |
| Arbitrary Memory Overwrite | p. 269 |
| Patching a Vulnerability into the Kernel | p. 270 |
| Choosing a Target to Overwrite | p. 271 |
| Locating the System Call Table | p. 272 |
| Constructing the Exploit | p. 273 |
| Uninitialized Kernel Variables | p. 274 |
| Kernel Stack Buffer Overflows | p. 279 |
| Kernel Heap Buffer Overflows | p. 285 |
| Kernel Heap Zone Allocator | p. 286 |
| Kernel Heap Feng Shui | p. 291 |
| Detecting the State of the Kernel Heap | p. 293 |
| Exploiting the Kernel Heap Buffer Overflow | p. 294 |
| Summary | p. 296 |
| Jailbreaking | p. 297 |
| Why Jailbreak? | p. 298 |
| Jailbreak Types | p. 298 |
| Jailbreak Persistence | p. 299 |
| Tethered Jailbreaks | p. 299 |
| Untethered Jailbreaks | p. 299 |
| Exploit Type | p. 300 |
| Bootrom Level | p. 300 |
| iBoot Level | p. 300 |
| Userland Level | p. 301 |
| Understanding the Jailbreaking Process | p. 301 |
| Exploiting the Bootrom | p. 302 |
| Booting the Ramdisk | p. 303 |
| Jailbreaking the Filesystem | p. 303 |
| Installing the Untethering Exploit | p. 304 |
| Installing the AFC2 Service | p. 305 |
| mstalling Base Utilities | p. 306 |
| Application Stashing | p. 307 |
| Bundle Installation | p. 307 |
| Post-Installation Process | p. 309 |
| Executing Kernel Payloads and Patches | p. 309 |
| Kernel State Reparation | p. 309 |
| Privilege Escalation | p. 310 |
| Kernel Patching | p. 312 |
| security.mac.proc_enforce | p. 312 |
| cs_enforcement_disable (kernel) | p. 313 |
| cs_enforcement_disable (AMFI) | p. 314 |
| PE_i_can_has_debugger | p. 315 |
| vm_map_enter | p. 316 |
| vm_map_protect | p. 318 |
| AMFI Binary Trust Cache | p. 319 |
| Task_for_pid 0 | p. 320 |
| Sandbox Patches | p. 322 |
| Clearing the Caches | p. 324 |
| Clean Return | p. 324 |
| Summary | p. 325 |
| Baseband Attacks | p. 327 |
| GSM Basics | p. 329 |
| Setting up OpenBTS | p. 331 |
| Hardware Required | p. 331 |
| OpenBTS Installation and Configuration | p. 332 |
| Closed Configuration and Asterisk Dialing Rules | p. 335 |
| RTOSes Underneath the Stacks | p. 335 |
| Nucleus PLUS | p. 336 |
| ThreadX | p. 337 |
| REX/OKL4/Iguana | p. 337 |
| Heap Implementations | p. 338 |
| Dynamic Memory in Nucleus PLUS | p. 338 |
| Byte Pools in ThreadX | p. 340 |
| The Qualcomm Modem Heap | p. 341 |
| Vulnerability Analysis | p. 342 |
| Obtaining and Extracting Baseband Firmware | p. 343 |
| Loading Firmware Images into IDA Pro | p. 344 |
| Application/Baseband Processor Interface | p. 345 |
| Stack Traces and Baseband Core Dumps | p. 345 |
| Attack Surface | p. 346 |
| Static Analysis on Binary Code Like it's 1999 | p. 347 |
| Specification-Guided Fuzz Testing | p. 348 |
| Exploiting the Baseband | p. 348 |
| A Local Stack Buffer Overflow: AT+XAPP | p. 348 |
| The ultrasn0w Unlock | p. 350 |
| An Overflow Exploitable Over the Air | p. 356 |
| Summary | p. 362 |
| Appendix References | p. 365 |
| Index | p. 369 |
| Table of Contents provided by Ingram. All Rights Reserved. |
An electronic version of this book is available through VitalSource.
This book is viewable on PC, Mac, iPhone, iPad, iPod Touch, and most smartphones.
By purchasing, you will be able to view this book online, as well as download it, for the chosen number of days.
Digital License
You are licensing a digital product for a set duration. Durations are set forth in the product description, with "Lifetime" typically meaning five (5) years of online access and permanent download to a supported device. All licenses are non-transferable.
More details can be found here.
A downloadable version of this book is available through the eCampus Reader or compatible Adobe readers.
Applications are available on iOS, Android, PC, Mac, and Windows Mobile platforms.
Please view the compatibility matrix prior to purchase.