Siriously Leaky: Exploring Overlooked Attack Surfaces in Apple's Ecosystem
Uncovers privacy vulnerabilities and local IPC leakage across Apple's Siri, CloudKit, and system daemon ecosystems on iOS and macOS.
Summary
Inter-Process Communication in Apple's Ecosystem
Apple's macOS and iOS operating systems feature complex XPC services and system daemons managing user preferences, voice assistants, and cloud synchronization.
Auditing Siri and System Daemon IPC Endpoints
Richard Im investigates unvalidated XPC endpoints and entitlement checks across background services, discovering mechanisms that allow sandboxed applications to access private user telemetry.
Extracting User Data and Bypassing TCC
Exploiting improper IPC authorization allows third-party applications to query voice transcription histories, access location logs, and bypass Apple's Transparency, Consent, and Control (TCC) security framework.
Hardening macOS and iOS Entitlements
Securing Apple platforms requires strengthening XPC message validation, enforcing granular entitlement requirements, and auditing system daemon APIs for cross-application leakage.
Related talks
Main Stage·38 min
Yoav Magid
Analyzes the architecture of Apple Intelligence and Private Cloud Compute, identifying privacy risks and data leakage vectors across on-device and cloud models.
Black Hat USA·36 min
Austin Emmitt
Engineers explore architecture and security mechanisms for Apple's Predicament: NSPredicate Exploits on iOS and macOS.
Videos·22 min
Jack Wilson
Jack Wilson investigates Analysing the Privacy of VPN's on iOS.