[HN Gopher] Heap Overflows on iOS ARM64
       ___________________________________________________________________
        
       Heap Overflows on iOS ARM64
        
       Author : carride
       Score  : 74 points
       Date   : 2022-08-13 13:28 UTC (9 hours ago)
        
 (HTM) web link (www.inversecos.com)
 (TXT) w3m dump (www.inversecos.com)
        
       | olliej wrote:
       | This is a pretty approachable intro to manipulating the heap and
       | subsequently exploiting it. On their iOS device they were using a
       | jailbreak, presumably to circumvent code signing requirements,
       | but I assume you could do the same thing on any modern Mac - an
       | M1/2 system for consistency, but I would expect similar behavior
       | for the allocator on an Intel Mac.
        
       | rdudek wrote:
       | It's interesting but can't really be done without jailbreaking
       | the iOS first.
        
       | pmalynin wrote:
       | If you're interested in doing this legitimately, on latest
       | devices, and without needing a jailbreak you should sign up for
       | the Security Researcher Device
       | (https://developer.apple.com/programs/security-research-devic...)
        
         | dapids wrote:
         | So you can sign an NDA and away all your findings on their
         | product as they gatekeep the bounty? I don't think so.
        
           | saurik wrote:
        
             | 95014_refugee wrote:
             | Possibly worth disclosing your own stake in this issue...
             | 
             | FWIW, Corellium was garbage. Can't speak for its current
             | state, but not spending money on the tech - or the people -
             | was the right call at the time.
        
               | smoldesu wrote:
               | I think the principles behind Corellium are good (can we
               | build an iOS toolchain without Apple?) but everything I
               | heard about the implementation was unfortunately also
               | negative. I think it would be a lot easier to stand
               | behind them if they separated their product and service
               | offerings, maybe making the iOS bootstrapping code Open
               | Source, but providing ARM instances with commercial
               | support at-cost. In it's current state, though, I can't
               | root for them any more than Oracle or Apple themselves.
        
             | dang wrote:
             | Please don't cross into personal attack. The rest of your
             | comment is fine but the first paragraph isn't.
             | 
             | https://news.ycombinator.com/newsguidelines.html
        
       ___________________________________________________________________
       (page generated 2022-08-13 23:01 UTC)