8/12/2015 iOS Exploits - iOS - EDG Confluence
Pages / iOS
iOSExploits
CreatedbyHP(193pt),lastmodifiedbyBenM.ATTLERyesterdayat4:10PM
iOSExploitsData
Name Type Access BornDate ModificationDate Death Foundby Description
Granted &iOS Date
Version
Archon technique Remote (camewith
Architecture purchase)
Detection
Dyonedo machoparsing Codesign JDWGCHQ
Defeat
Earth/Eve Remote PurchasedbyNSA
Exploit
SharedwithCIA
PortedbyGCHQ
Elderpiggy Sandbox Peppermint(NSAVR
Escape Contract)
Implementedby
GCHQatJDW
Ironic KernelASLR iOS8 Publicvulnerability
Defeat researcher:Steffan
Esser(i0nic)
Nandao Heapoverflow KernelExploit GCHQ
corruption?
Juggernaut PurchaseBaitshop
Persistence Executionvia Reboot June2013, June2014,JDW CIA Byselectingspecificexecutablesonthesystem
symboliclinks Persistence JDWXXXX XXXX partitionthatarerunwithrootprivileges,
asymboliclinkcanbecreated(oniOS7.x)oran
existingfilecanbeoverwritten(iOS8.x)
thatwillrunourbootstrapper,givinguseinitial
executiononeveryboot.
Redux Sandbox CloseAccess June2012, 7/15,workaroundfor 11/17/14, GCHQ SandboxProfiles:
misconfiguration iOS6 missing iOS8.1.1
vpnagentiniOS8 Availablefor:iPhone4Sandlater,iPodtouch(5th
devdmgs generation)andlater,iPad2andlater
Impact:Amaliciousapplicationmaybeableto
launcharbitrarybinariesonatrusteddevice
Description:Apermissionsissueexistedwiththe
debuggingfunctionalityforiOSthatallowedthe
spawningofapplicationsontrusteddevicesthatwere
notbeingdebugged.Thiswasaddressedby
changestodebugserver'ssandbox.
PubliclydiscoveredbytheChineseJailbreak
team,Pangu
CVE:20144457
Rhino APImisuse KernelASLR April2013, June2014, GCHQ ReadsKEXTinfothatrevealstheKASLRvaluesby
Defeat iOS7 iOS8Beta callingtheOSKextCopyLoadedKextInfofunction.
1
Sal Abnormalcode Codesign DATE???, 2/15,bugfix FBI,ROU Copiesnonpagedsizedchunkssothatthe
path Defeat iOS7 vm_map_copy_overwrite_unaligned()pathistakenin
inthekernel thekernel.
Thisabnormalcodepathresultsinpagesofmemory
notbeingpagedin,sothecs_taintedflagisnever
seton
thepagesinmemory,causingnosignaturechecks.
Saline BufferOverflow ROP DATE???, 2/15,Productizedat PurchaseBaitshop SendingacraftedNSArchiverobjecttoanyprocess
causedby execution iOS8 TRICLOPS thatcallsNSArchiveunarchivemethodwillresultin
deserialization workshop abufferoverflow,allowingforROP.
parsingerror
inFoundation
library
Wintersky SizeMismatch KernelASLR DATE???, NOCTURNALFEARS WinterSkyleaksthekerneladdressoftheipc_port
betweenuser Defeat iOS8 structofauserprovidedmachport.
andkernel
structures
Xiphos ValidationIssue KernelExploit March2014, 11/14,iOS CIA Availablefor:iPhone4Sandlater,iPodTouch5th
iOS7 8.1.1 genandlater,iPad2andLater.
Impact:Amaliciousapplicationmaybeableto
executearbitrarycodewithsystemprivileges.
Description:Avalidationissueexistedinthe
handlingofcertainmetadatafieldsof
IOSharedDataQueueobjects.
PubliclydiscoveredbytheChineseJailbreak
team,Pangu.
https://confluence.devlan.net/display/NS/iOS+Exploits 1/3
8/12/2015 iOS Exploits - iOS - EDG Confluence
Exploits
Release Access Kernel Kernel Sandbox CodeSign Persistence Persistence
Date(s) Info Exploit Escape Defeat
(reboot) (update)
Leak (browser)
iOS4(4.0 Remote 6/21/2010 SafferonSkies <NR> <NR> ?? EarlyKatana overrides.plist No
3/11/2011
4.3.3) (OTA<NR>)
Local SLIDE <NR>
iOS5(5.0 Remote 10/12/2011 SunsetSkies <NR> Corona(5.0.1) ?? EarlyKatana overrides.plist Yes
5/7/2012
5.1.1) (sysnot
Local SLIDE <NR> <NR> touched)
iOS6(6.x Remote 9/19/2012 Wby Rhino Cutlass SandShrew Katana overrides.plist block
2/16/2013
6.1.2) Local Redux <NR> (libamfi) launchd.conf
iOS6(6.1.3 Remote 3/19/2013 Wby Rhino Scimitar SandShrew Dyonedo dirhelper block
5/2/2013
6.1.4) Local Redux <NR>
iOS7(7.0 Remote 9/18/2013 Eve <NR> Xiphos Piggy Dyonedo dirhelper block
6/20/2014
7.1.2) Local Redux <NR>
iOS8(8.0& Remote 9/17/2014 Earth Ironic Nandao <NR> Dyonedo dirhelper block
9/25/2014
8.0.2) Local Saline
iOS8(8.1 Remote 10/10/2014 Earth Ironic Nandao <NR> Dyonedo dirhelper block
12/19/2014
8.1.2) Local Saline
iOS8(8.1.3 Remote 1/27/2015 Earth WinterSky Nandao <NR> Dyonedo mountNFS block
3/9/2015
8.2) Local Saline
IOS8.3 Remote 4/8/2015 Earth WinterSky Nandao <NR> Juggernaut mountNFS block
Local Saline
iOS8.4 Remote 6/30/2015 Earth WinterSky Nandao <NR> Juggernaut mountNFS block
Local Saline
Key
NewExploit
MajorUpdate
MinorUpdate
MinimalChanges
<NR> NotRequired
?? Unknown
OldTables(Toberemoved)
iOS4(4.04.3.3) iOS5(5.05.1.1) iOS6(6.x6.1.2) iOS6.1.36.1.4 iOS7 iOS8
Remote Local Remote Local Remote Local Remote Local Remote Local
KernelInfo <NR> <NR> <NR> <NR> rhino rhino rhino rhino <NR> <NR>
Leak
Sandbox ?? <NR> ?? <NR> sandshrew <NR> sandshrew <NR> piggy <NR>
Escape
(browser)
Kernel <NR> <NR> <NR>, <NR> cutlass cutlass scimitar scimitar xiphos xiphos
https://confluence.devlan.net/display/NS/iOS+Exploits 2/3
8/12/2015 iOS Exploits - iOS - EDG Confluence
Exploit CORONA(5.0.1)
CodeSign EARLYKATANA EARLYKATANA EARLYKATANA EARLYKATANA katana katana dyonedo dyonedo dyonedo dyonedo
Defeat (libamfi) (libamfi)
Access SAFFRONSKIES SLIDE SUNSETSKIES SLIDE wby redux wby redux eve redux
(4.3only?)
Persistence overrides.plist overrides.plist overrides.plist overrides.plist overrides.plist overrides.plist dirhelper dirhelper dirhelper dirhelper
(reboot) / /
launchd.conf launchd.conf
Persistence NO(OTA<NR>) NO(OTA<NR>) YES(sysnot YES(sysnot block block block block block block
(update) touched) touched)
iOS8(8.0&8.0.2) iOS8.18.1.2 iOS8.1.38.2 IOS8.3 iOS8.4
Release 9/17/20149/25/2014 10/10/201412/19/2014 1/27/20153/9/2015 4/8/2015 6/30/2015
Date(s)
Remote Local Remote Local Remote Local Remote Local Remote Local
KernelInfo Ironic Ironic Ironic Ironic WinterSky WinterSky WinterSky WinterSky WinterSky WinterSky
Leak
Sandbox <NR> <NR> <NR> <NR> <NR> <NR> <NR> <NR> <NR> <NR>
Escape
(browser)
Kernel Nandao Nandao Nandao Nandao Nandao Nandao Nandao Nandao Nandao Nandao
Exploit
CodeSign dyonedo dyonedo dyonedo dyonedo dyonedo dyonedo Juggernaut Juggernaut Juggernaut Juggernaut
Defeat
Access Earth Saline Earth Saline Earth Saline Earth Saline Earth Saline
Persistence dirhelper dirhelper dirhelper dirhelper dirhelper dirhelper Mount Mount Mount Mount
(reboot) NFS NFS NFS NFS
Persistence block block block block block block block block block block
(update)
XX=required,butnotavailable.
<NR>=notrequired
??Unknown/someelsefillthisin
Like Bethefirsttolikethis Nolabels
https://confluence.devlan.net/display/NS/iOS+Exploits 3/3
