HEXACON2024 - Caught in the wild, past, present and future by Clem1

### Overview In this keynote from HEXACON 2024, Clem1, an exploit hunter with Google's Threat Analysis Group (TAG), discusses ten years of hunting and discovering in-the-wild zero-day exploits. The talk sheds light on how TAG detects in-the-wild exploits, how threat actors deliver them, current exploitation trends across browsers and mobile operating systems, post-exploitation artifacts, and expectations for the future of mobile exploitation.

### Key Topics - **Exploit Discovery Methods**: How Google TAG leverages Google's internal indexing, Safe Browsing, differential snapshotting of watering holes (e.g., DPRK-linked sites and compromised Chinese websites), typosquatting domains, one-time links on social media, telemetry crash triage (Chrome and Android), and public repositories like Censys, Any.Run, and VirusTotal. - **Pre-Delivery Fingerprinting**: Server-side and client-side profiling techniques used by actors before delivering an exploit payload to filter security researchers and target specific versions (e.g., inspecting HTTP/2 handshake parameters to spot proxies, user agent reduction via Client Hints, probing the Battery API, checking custom video codecs, and monitoring developer console states). - **Exploit Chains and Trends**: Evolution of render remote code execution (RCE), sandbox escapes, pointer authentication code (PAC) bypasses, and V8 heap sandbox bypasses. The talk also highlights "n-day" exploitation—such as abusing Android intents to redirect Chrome traffic to outdated Samsung Internet browsers or targeting unbackported Linux kernel vulnerabilities (like the ion subsystem). - **Post-Exploitation and Future Shifts**: Cleanup routines designed to evade forensic tooling (e.g., an explicit `pwn_citizen_lab` cleanup function), challenges spyware faces in handling hundreds of messaging apps, and an emerging shift toward partial exploit chains and alternative high-surface targets like messaging apps.

### Technical Details - **Watering Holes & Detection Heuristics**: TAG scans known sites to spot anomalous additions, such as high-port iframes pointing to direct IP addresses. Common detection signals include encoded Mach-O or MZ PE headers within JavaScript variables, distinctive garbage-collection loops repeatedly allocating disposable strings to groom the heap, double-to-integer conversion routines, and tight JIT optimization loops followed by mismatched parameter calls. - **Crash Triage & Operation Shutdown**: Crashes showing new threads starting outside normal Chrome modules, or crashes occurring during exploit primitive setup due to garbage collection interruptions, revealed domains linked to ownCloud instances serving Android and Windows zero-days. This tracking directly contributed to TAG receiving a Pwnie Award for disrupting a counter-terrorism operation. - **Mojo and Sandbox Escapes**: Unlike public research, private Chrome sandbox escapes frequently arrive as massive blobs incorporating `libchrome` (often containing over 6,000 functions) to easily interact with Mojo interfaces. Analysts use BinDiff to match standard Chrome functions and isolate the novel exploit logic. - **Sophistication vs. Public Research**: The iOS "no-clip" exploit leveraged a copy-on-write memory mapping vulnerability (`vm_remap`) to induce integer overflows inside and outside the sandbox, adopting methods originally publicized by Loki and Ian Beer in 2017.

### Takeaways As modern browser sandboxes harden, attackers increasingly rely on partial exploit chains (stopping at cookie/token exfiltration rather than forcing full kernel takeover) and targeting alternative attack surfaces. For instance, third-party messaging apps like WeChat contain vast attack surfaces—such as 180 bundled native libraries, including outdated patched builds of FFmpeg. Exploiting a cross-platform custom JavaScript engine within a messaging app provides immediate access to sensitive communications without requiring the extensive sandbox escapes and kernel privilege escalation necessary when attacking Chrome.