Reveal and Exploit IPC Logic Bugs in Apple Ecosystem
Tencent Security researchers reveal novel IPC logic bugs in Apple's XPC messaging architecture, achieving privilege escalation and sandbox escape on macOS and iOS.
Summary
Apple's Inter-Process Communication (XPC) Architecture
macOS and iOS rely heavily on XPC services for inter-process communication, using Mach messages to enforce sandboxing and privilege boundaries between user apps and system daemons.
Auditing XPC Message Deserialization and Verification
Zhipeng Huo, Yuebin Sun, and Chuanda Ding investigate how privileged daemons deserialize complex dictionary objects and validate client credentials.
Exploiting IPC Logic Flaws for Privilege Escalation
The researchers discover multiple logic vulnerabilities where privileged background daemons mishandle unverified client messages, enabling sandbox escapes and root elevation.
Defensive Architecture for Secure XPC Development
The authors provide Apple platform developers with secure coding standards for verifying audit tokens and validating XPC message structures safely.
Related talks
Main Stage·39 min
Justin Hoffman · Chris Morgan
Local attack surface analysis of the 1Password macOS desktop app and Chrome extension enabling vault data extraction.
Main Stage·43 min
Nir Even Or · Phil Pearse · Ankur Bohra
Discloses 'Migraine', a novel macOS System Integrity Protection (SIP) bypass vulnerability allowing root users to load unsigned kernel extensions.
Main Stage·35 min
Austin Emmitt
Austin Emmitt demonstrates bypassing Apple's iOS 16 NSPredicate restrictions, achieving 100% reliable PAC bypasses and code execution in SpringBoard.