my name is Joshua most people know me as
prophets Anja been around Joburg seen
for quite a while so I basically taught
myself everything about hacking the
chief research each week or for the
green boys in an accident jailbreak so
this is really more of a story about
well my entire year of 2017 I was
working on this exploit I don't usually
have that long as an attention span but
this was actually really really fun to
track what got me started and this was
actually back when I was a child so I
had an old Macintosh before my one other
13 school also had one so we kind of
shared you know video games that I was
going to do mine one day ups there was
something called Apple remote access
basically allows you to dial into a
negative use phone and xstep this was
1997 course the internet was still
clearly very nuanced
so I didn't have it in it at this time
I did not even have I'm building
actually went to school and traded a han
Solo trading card in for my first 56k
modem chance to test this out at bowing
to his computer set it up when he using
the shower one morning and maybe it's
not a little bit so before this there
was a couple of odd things I've noticed
when I was doing my research for example
this kernel extension you can see it is
has a copyright header at the top but
I'm not sure what their copyright in
here because there's nothing there
this entire criminal extinction every
single one of the file is empty so after
a while you can't get it think like this
is a common time so I basically pulled
every single Apple open source code
extracted them the lion counted every
single one sorted ascending order
I'm gonna check to see which ones were
empty and which projects having those
memory ranky file one of them was an old
friend of mine that BP antigen
originally discovered this file when I
was trying to look into it I couldn't
tell why is that dick throwing back in
that wasn't in the binary there is a key
it was called no sandbox looking into
what that he does they basically
redirected it around the sandbox
initialization I wonder why they didn't
want people to find that yeah it's
clearly lighting security through
obscurity of a lot of repeat offenders
we're showing up there UI user said a
lot of course the main one I wanted
we're interested in was the PDP one a
very old software I actually found the
source report on one of the Apple vinci
websites
unfortunately Apple removes a stuffit
expander support so I did not look at it
yeah so then I realized okay so the
entire VPN system is actually built on
this old legacy modems for the next
thing said both do similar things but
one just does it for sound waves either
one does it over right now so how do I
actually get in and by installing these
PPP configurations and EP and stuff to
actually test it there's one thing which
kind of bothered me always whenever you
go up to change your Wi-Fi password for
different networks or DBS they never ask
you for your root password
this stuff is held in very secure
locations something has to be running
this birthday the easiest method I can
was simply go up to your network
configuration files you can select one
export configuration and as it basically
exports a phoebus file containing all
the different settings for T that were
configuration you can actually modify
that and had some extra ones in there
which don't really document this was
mostly just for testing though so beyond
that we have two well the VPN stuff
Renza it's the user so suddenly they get
a little more cartridges so one sticking
around through there I discovered there
was still a UNIX optic in flash bar size
running so a peb company it was seven
seven seven breathable right what's it
for
so let's see
we done this is the basic header format
for the tactics going over the units I
see very simple protocol one thing that
caught my attention that first lap that
would be the bug as you see down or it
says block the very bottom each are any
data one we should not have a character
or an array of size one there yeah
entire structure is now going to be
opposite by seven days look inside the
code you see apple tries to fix this a
couple times they first make a macro
basically just subtract one from it
before parsing it they still did that
wrong put in the code we continually do
call back and then fix that yeah so
these are some of the commands you can
sing to it most of them well I wasn't
sure which one to focus on so I just
focus on them all basically very simple
fuzzy but it was really only one thing
that stood out to me but lots of other
options
more about millions but thinks this
exploit actually did require a building
to be set up as a network device most
people don't have modems able I have had
a hard time trying to acquire one myself
first
yeah Morgan's work extremely complicated
back then every single provider actually
have their own unique specific or they
still do today
these things are pretty Apple but Apple
needed a way to support all these people
fortunately you don't necessarily need a
modem in order to do this so on the
order max every single time you plugged
in a serial to USB adapter it would
automatically create a new serial line
they were configuration in there most of
the sewer line buildings or well since
they're modems are also sewer line it's
very easy to simply modify what second
is you turn in esterline device in
deliver later on when they release the
newer Mac of throws they actually well
it has USB C so you can't really tell
you that but serial line just legalized
to it fortunately every single adapter
the USB Sita a I found would
automatically create a server line
device for that effect so if you had
used USB we didn't even need to have a
moment so you know doesn't like the fuzz
whisker but this is the exploit for the
purpose escalation
even though I closed everything in here
continuously the stupidest bugs I found
was this one right there
the sin PPP connect apparently if you
run it from the socket it watches ppps
root they're not as music yeah so when I
suppose these are typically the error
codes that should have been started at
256 now this is the error results my
buzzer guy and here you can see actually
took me a while because I kept buzzing
it and not realizing what was happening
then I finally realized oh this actually
watching roots not user anymore still
nobody actually EP running is yeah we
either how do we actually gain oh that's
easy for next so back in 1997 Apple
released their I magically and it
included a built-in modem what are the
firstly lake specifically for innovation
by Mac in the next Mac and they included
different logo stuff the CCOs burgers
yeah Apple documented quite well on that
let's see so these scripts handle both
following up and answer any other
telephone so what's in a typical sea
snail bundle really just the folder
within info.plist and ACCC expert the
example of both this is mice info.plist
and you can probably start to get it
where I'm going on the next wave
simply adding a whole bunch of days and
couple little bites into there it
actually allows you to select specific
variables inside of the bundle including
the username password yeah APN oh yeah
and you said a couple variable ones
awesome so those variable strings look
kind of the first day of testing I spent
about two days working on something to
buzz or creates CCL scripts so I can
close it all and I thought you know
let's just try these variable string
things in their insensitive but well
that's that's right at the budget of
mittens and it turns out half of them
are open 13 which one of the strings are
actually passed out strings so it
actually makes it a little more
difficult we can't just overwrite the no
value and then you know reading some
arbitrary data after that like
interesting I've never seen a packet
elsewhere instructor will of my life so
here's the first one and note in the F
there is just a bar string and tonight
to put foster and 2727 together both of
those we gained 255 bytes
this is especially black classic Butler
overflow but with modern sections click
to stack quickly and it goes max
perience we
almost exactly the same and finally
right there's also a good one this one
was actually the one I decided to focus
on because it seemed a lot more fun so
this is a very simple example of a CCL
script all this does is leaders
basically sex really well it looks
similar to a single code similarly what
the top increment number tries my one
write hello world
we'll put a new label check to see if we
had a number of tries is greater than
five it is jump to three otherwise come
back to one and come in again so print
hello world five times these are always
like a manatee get in there
a lot of these are interesting but they
kind of all come into play once you're
trying to create this cooking concept
exploit strip those are some of the more
interesting one so yeah so my first idea
was how about being Note one so I can
somehow grab the stack 30 earlier in
memory there'd be no problem just
rewriting that and then next C is duck
complaint
nothing then boy the interesting one was
slightly more difficult has it had more
constraints these are the basic gadgets
I had to work with the return
the man is essentially a limited 16 hit
read to the script
well it's almost I'll get to that later
jsr 16-bit write some tiny controls we
can almost create a full turn place
machines just on this information
there's some of the pillars so you can
see here it says a crispy taco sack if
it's equal to be a maximum type of start
you can do this if not it doesn't think
what if top stack is greater or less
than and I want to point out that doing
the right overflow we can overwrite but
a sweet type of stack and there is the
script line fantasies there so we
control the stack around the top of
stack so it's very nice
reading reproductive almost other
gadgets so the next feeding memory there
so you want to try and find you know
where our members out of taking space we
can actually compare the bytes there one
we have in a vertical strip we can
actually find where it shows that we're
solving it drives and recharge earlier
easily to use for it well
conditionals I was also thinking you
typically use X to store lots or this
furnishing but might be in doing a
little cheating oh yes and we can also
have these different states but when it
answered when it all started
yeah thanks between these two we had
should be a backswing right fortunately
a Thursday support pitfalls involved in
this so the maximum size of the script
is 32 kilobytes
days 32 tonight sorry doesn't kill mites
of characters for 32 kilobytes of lines
whichever comes first
so we're limited you those reads I said
either under 0 7 ffff and we can only
write 0 X 7 epithet the way it works
it's all based on yes line ever again so
one issue with this it means if you want
to write the value 0 X 2 0
do you want to exact the toxic you would
have to be at line 32 in the script it
also means you cannot read it or write
the same bike it also means that
unfortunately you cannot write to stack
you cannot create those addresses or you
cannot also the gadgets from yeah
dynamic linker because those are two
pardonable but we were in the
overflowing is starts back there's a
string buffer here 256 so everything
below that you can overwrite the stack
top of stack like
interesting thing about this is nesting
when it was only 16 but it was declined
there's a way to do so they're literally
indexing 32 bits and Saturday 16 already
I'm sure for all right but there's some
other fun stuff we can actually
overwrite beyond this one my personal
favorite is Gino stirring down there I
can James an audio and all those defined
as a Pascal string consisting of one
place that one body is a space zero to
zero but since we can overwrite this we
can actually also use it as a scratch
register if you look at how it's the bar
string if we string is greater than your
next on the strings it just returns that
to you know string literal right so as
far as how to exploit this we see Co
engines tight loop that basically is
constantly generating these callbacks
pictures you see it's basically just a
linked list which contains other
call-out structures to be executed in
order almost better than laughs
part of the problem is actually figuring
out a clear and memory these things are
something out of here because it's in a
very tightly
luckily though you can actually delay
this for a bit by adding a character
Glade it's back in the day modems are
really slow well they were slow by
today's standards by their standards
they were really really fast so they had
to go really really slowly defended
something gives you a little bit more
time and controlling the heat finally
position this is one it's actually kind
of a freebie so it includes a resource
file for PvP so if you just crazy that
eg PRC in your home directory so will
automatically launch it shelter for you
whenever he is becomes online okay for
their lecture those routes
let you see it PCC it's probably fifty
guys that's it
but however you still need to code
execution for the persistent like
however lovingly a collection ships
nitpick by default and also next a
yeasty version at least ten excess fuel
exactly it's very simple like that Reina
pipes to tep kok day and you're using
Apple's own sign programs to service
exploit Apple doesn't use Apple Mac OSX
phones I eventually just shared this
with them a quick they even working on
the VPN application they might not go
comfortable I'm quoting all this VPN
bugs so I see reporting the hooked up a
little bit of a reputation within many
years finally got it into the App Store
as the very first beat the entire wall
that was definitely not anything but
this is only a scratch on the surface of
the number of bugs in there this was the
path of least resistance there are other
ones which look like demand injections
quite a few more it's a very very old
portion of only actually very people
even understand it
however you can't really have a VPN
security product if the BPM on the phone
is broken
so really hoping that more people will
start looking into this
we're doing some amazing things here at
13 or 13 I should be out oh especially
out of later next month and I had some
other amazing things in the pipeline so
working on the future and that's about
it