[HN Gopher] Heap Overflows on iOS ARM64
___________________________________________________________________
Heap Overflows on iOS ARM64
Author : carride
Score : 74 points
Date : 2022-08-13 13:28 UTC (9 hours ago)
(HTM) web link (www.inversecos.com)
(TXT) w3m dump (www.inversecos.com)
| olliej wrote:
| This is a pretty approachable intro to manipulating the heap and
| subsequently exploiting it. On their iOS device they were using a
| jailbreak, presumably to circumvent code signing requirements,
| but I assume you could do the same thing on any modern Mac - an
| M1/2 system for consistency, but I would expect similar behavior
| for the allocator on an Intel Mac.
| rdudek wrote:
| It's interesting but can't really be done without jailbreaking
| the iOS first.
| pmalynin wrote:
| If you're interested in doing this legitimately, on latest
| devices, and without needing a jailbreak you should sign up for
| the Security Researcher Device
| (https://developer.apple.com/programs/security-research-devic...)
| dapids wrote:
| So you can sign an NDA and away all your findings on their
| product as they gatekeep the bounty? I don't think so.
| saurik wrote:
| 95014_refugee wrote:
| Possibly worth disclosing your own stake in this issue...
|
| FWIW, Corellium was garbage. Can't speak for its current
| state, but not spending money on the tech - or the people -
| was the right call at the time.
| smoldesu wrote:
| I think the principles behind Corellium are good (can we
| build an iOS toolchain without Apple?) but everything I
| heard about the implementation was unfortunately also
| negative. I think it would be a lot easier to stand
| behind them if they separated their product and service
| offerings, maybe making the iOS bootstrapping code Open
| Source, but providing ARM instances with commercial
| support at-cost. In it's current state, though, I can't
| root for them any more than Oracle or Apple themselves.
| dang wrote:
| Please don't cross into personal attack. The rest of your
| comment is fine but the first paragraph isn't.
|
| https://news.ycombinator.com/newsguidelines.html
___________________________________________________________________
(page generated 2022-08-13 23:01 UTC)