Attacking the macOS Kernel Graphics Driver
Yu Wang presents attacking the macos kernel graphics driver: Just like the Windows platform, graphic drivers of macOS kernel are complicated and provide a large promising attack surface for EoPs and sandbox escapes...
Summary
Architecture and Background
Just like the Windows platform, graphic drivers of macOS kernel are complicated and provide a large promising attack surface for EoPs and sandbox escapes from low-privileged processes.
Vulnerability Analysis
After auditing part of the binaries, I discovered a number of vulnerabilities last year. Including, NULL pointer dereference, stack-based buffer overflow, arbitrary kernel memory read and write, use-after-free, etc.
Exploitation and Demonstrations
Some of these vulnerabilities were reported to Apple Inc., such as the CVE-2017-7155, CVE-2017-7163, CVE-2017-13883.
Remediation and Defensive Strategies
In this presentation, I will share with you the detailed information about these vulnerabilities. Furthermore, from the attacker's perspective, I will also reveal some new exploit techniques and zero-days.
Related talks
Main Stage·47 min
Alexei Bulazel
Alexei Bulazel presents reverse engineering windows defenders emulator: Windows Defender Antivirus's mpengine.dll implements the core of Defender's functionality in an enormous ~11 MB, 30,000+ function DLL.
Main Stage·42 min
Greenstadt · Dr Caliskan
Greenstadt and Dr Caliskan presents de-anonymizing programmers from source code: Many hackers like to contribute code, binaries, and exploits under pseudonyms, but how anonymous are these contributions really?
Main Stage·25 min
Guang Gong
Guang Gong presents pwning thetoughest target, the largest bug bounty in the history of asr: In recent years, Google has made many great efforts in exploit mitigation and attack surface reduction to strengthen the s...