Abstract:On modern operating systems, applications under the same user are separated from each other, for the purpose of protecting them against malware and compromised programs. Given the complexity of today's OSes, less clear is whether such isolation is effective against different kind of cross-app resource access attacks (called XARA in our research). To better understand the problem, on the less-studied Apple platforms, we conducted a systematic security analysis on MAC OS~X and iOS. Our research leads to the discovery of a series of high-impact security weaknesses, which enable a sandboxed malicious app, approved by the Apple Stores, to gain unauthorized access to other apps' sensitive data. More specifically, we found that the inter-app interaction services, including the keychain, WebSocket and NSConnection on OS~X and URL Scheme on the MAC OS and iOS, can all be exploited by the malware to steal such confidential information as the passwords for iCloud, email and bank, and the secret token of Evernote. Further, the design of the app sandbox on OS~X was found to be vulnerable, exposing an app's private directory to the sandboxed malware that hijacks its Apple Bundle ID. As a result, sensitive user data, like the notes and user contacts under Evernote and photos under WeChat, have all been disclosed. Fundamentally, these problems are caused by the lack of app-to-app and app-to-OS authentications. To better understand their impacts, we developed a scanner that automatically analyzes the binaries of MAC OS and iOS apps to determine whether proper protection is missing in their code. Running it on hundreds of binaries, we confirmed the pervasiveness of the weaknesses among high-impact Apple apps. Since the issues may not be easily fixed, we built a simple program that detects exploit attempts on OS~X, helping protect vulnerable apps before the problems can be fully addressed.

Methodically Defeating Nintendo Switch Security

POP and PUSH: Demystifying and Defending Against (mach) Port-oriented Programming.

One Exploit to Rule them All? On the Security of Drop-in Replacement and Counterfeit Microcontrollers

Return-to-Non-Secure Vulnerabilities on ARM Cortex-M TrustZone: Attack and Defense.

Reversing the operating system of a Java based smart card

Co-processor-based Behavior Monitoring: Application to the Detection of Attacks Against the System Management Mode

Security Evaluation of State Space Obfuscation of Hardware IP through a Red Team – Blue Team Practice

Heckler: Breaking Confidential VMs with Malicious Interrupts

On the Susceptibility of Texas Instruments SimpleLink Platform Microcontrollers to Non-invasive Physical Attacks

Network-on-Chip Firewall: Countering Defective and Malicious System-on-Chip Hardware

The Forgotten Threat of Voltage Glitching: A Case Study on Nvidia Tegra X2 SoCs

Downgrade Attack on TrustZone

Securing Embedded System from Code Reuse Attacks: A Lightweight Scheme with Hardware Assistance

Cracking App Isolation on Apple

DirtyCred: Escalating Privilege in Linux Kernel

Fallout: Reading Kernel Writes From User Space

A Look at the Dark Side of Hardware Reverse Engineering -- A Case Study

Exploiting Binary-Level Code Virtualization to Protect Android Applications Against App Repackaging

Injecting Software Vulnerabilities with Voltage Glitching

Bypassing Isolated Execution on RISC-V using Side-Channel-Assisted Fault-Injection and Its Countermeasure

Taking a Look into Execute-Only Memory