6

居然在安全性漏洞的 PoC 上面看到拿 Bad Apple!! 當作範例

 3 years ago
source link: https://blog.gslin.org/archives/2021/05/27/10169/%e5%b1%85%e7%84%b6%e5%9c%a8%e5%ae%89%e5%85%a8%e6%80%a7%e6%bc%8f%e6%b4%9e%e7%9a%84-poc-%e4%b8%8a%e9%9d%a2%e7%9c%8b%e5%88%b0%e6%8b%bf-bad-apple-%e7%95%b6%e4%bd%9c%e7%af%84%e4%be%8b/
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
neoserver,ios ssh client

居然在安全性漏洞的 PoC 上面看到拿 Bad Apple!! 當作範例

人在日本的資安專家 Hector Martin 找到了 Apple M1 的安全漏洞，可以不用透過 macOS Big Sur 提供的界面，直接透過 M1 的漏洞跨使用者權限傳輸資料，這可以用在突破 sandbox 的限制。而也如同目前的流行，他取了一個好記的名字：「M1RACLES: M1ssing Register Access Controls Leak EL0 State」，對應的 CVE 是 CVE-2021-30747。

先講比較特別的點，PoC 的影片放在 YouTube 上，作者拿 Bad Apple!! 當作示範，這很明顯是個雙關的點：

這應該是當年的影繪版本，看了好懷念啊... 當年看到的時候有種「浪費才能」的感覺，但不得不說是個經典。

在 Hacker News 上有討論可以翻翻：「M1racles: An Apple M1 covert channel vulnerability (m1racles.com)」。

依照作者的說明，Apple A14 因為架構類似，也有類似的問題，不過作者沒有 iPhone，沒辦法實際測試：

Are other Apple CPUs affected?

Maybe, but I don't have an iPhone or a DTK to test it. Feel free to report back if you try it. The A14 has been confirmed as also affected, which is expected, as it is a close relative of the M1.

另外作者覺得這個安全漏洞在 macOS 上還好，主要是你系統都已經被打穿可以操控 s3_5_c15_c10_1 register 了，應該會有更好的方式可以用：

So you're telling me I shouldn't worry?

What, really?

Really, nobody's going to actually find a nefarious use for this flaw in practical circumstances. Besides, there are already a million side channels you can use for cooperative cross-process communication (e.g. cache stuff), on every system. Covert channels can't leak data from uncooperative apps or systems.

Actually, that one's worth repeating: Covert channels are completely useless unless your system is already compromised.

比較明顯的問題應該是 iOS 這邊的 privacy issue，不過 iOS 上的 app store 有基本的保護機制：(不過想到作者可以故意寫成 RCE 漏洞...)

What about iOS?

iOS is affected, like all other OSes. There are unique privacy implications to this vulnerability on iOS, as it could be used to bypass some of its stricter privacy protections. For example, keyboard apps are not allowed to access the internet, for privacy reasons. A malicious keyboard app could use this vulnerability to send text that the user types to another malicious app, which could then send it to the internet.

However, since iOS apps distributed through the App Store are not allowed to build code at runtime (JIT), Apple can automatically scan them at submission time and reliably detect any attempts to exploit this vulnerability using static analysis (which they already use). We do not have further information on whether Apple is planning to deploy these checks (or whether they have already done so), but they are aware of the potential issue and it would be reasonable to expect they will. It is even possible that the existing automated analysis already rejects any attempts to use system registers directly.

Related

Spectre 與 Meltdown 兩套 CPU 的安全漏洞

The Register 發表了「Kernel-memory-leaking Intel processor design flaw forces Linux, Windows redesign」這篇文章，算是頗完整的說明了這次的安全漏洞 (以 IT 新聞媒體標準來看)，引用了蠻多資料並且試著說明問題。 而這也使得整個事情迅速發展與擴散超出本來的預期，使得 Google 的 Project Zero 提前公開發表了 Spectre 與 Meltdown 這兩套 CPU 安全漏洞。文章非常的長，描述的也比 The Register 那篇還完整：「Reading privileged memory with a side-channel」。 在 Google Project Zero 的文章裡面，把這些漏洞分成三類，剛好依據 CVE 編號分開描述： Variant 1: bounds check bypass (CVE-2017-5753) Variant 2: branch…

January 4, 2018

In "Computer"

最近 OpenVPN 的安全性漏洞...

看到「The OpenVPN post-audit bug bonanza」這個只有苦笑啊... 作者在 OpenVPN 經過一連串的安全加強後 (包括 harden 計畫與兩個外部單位的程式碼稽核找到不少問題)，決定出手挖看看： After a hardening of the OpenVPN code (as commissioned by the Dutch intelligence service AIVD) and two recent audits 1 2, I thought it was now time for some real action ;). 然後就挖出不少問題了... 可以看到作者透過 fuzzing 打出一卡車，包含了不少 crash XDDD：(然後有一個是 stack…

June 28, 2017

In "Computer"

SHA-1 的 chosen-prefix collision 低於 2^64 了...

算是前陣子的大消息，SHA-1 的 chosen-prefix collision 需要的運算已經低於 2^64 了：「SHA-1 is a Shambles」。 基本的 collision 指的是演算法找出 p1 與 p2 兩個字串，使得 hash(p1) == hash(p2)。但這個方法對於實際的攻擊價值並不大，因為 p1 與 p2 是透過演算法找出來 collision，都是亂數字串。 chosen-prefix collision 指的是先給定 p1 與 p2 (在實際攻擊中，兩組都會是有意義的字串)，然後攻擊的演算法可以算出 m1 與 m2，使得 hash(p1 // m1) == hash(p2 // m2)，其中的 // 就是字串加法。這樣的是先產生出有意義的字串，於是就可以在真實世界中使用。 舉例來說，我先產生出 blog.gslin.org 的 SSL certificate，然後再產生出一個 github.com…

January 20, 2020

In "Computer"

a611ee8db44c8d03a20edf0bf5a71d80?s=49&d=identicon&r=gAuthor Gea-Suan LinPosted on May 27, 2021Categories Computer, Murmuring, OS, Privacy, Security, SoftwareTags a14, apple, bad, cpu, ios, ipad, iphone, m1, privacy, register, security

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Comment

Name *

Email *

Website

Notify me of follow-up comments by email.

Notify me of new posts by email.

Post navigation


report

Recommend

About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK