malus-security / ioracle

Automated analysis of the iOS access control architecture

malus-security/ioracle Issues

Try using lsof or levin's lsof functionality in his procexp tool.
Updated 7 years ago
extract services and convert to facts
Updated 7 years ago1
backtracer sometimes needs information about policies or context that could be provided by iOracle.
Updated 7 years ago
Should we just run backtracer on every function and for r0-r3? Then we could just query for the functions we care about.
Updated 7 years ago
The ----; in ida doesn't necessarily mean there are 2 parent basic blocks.
Updated 7 years ago
Design prolog rules to find common solution of two regular expressions.
Updated 7 years ago2
query for directories getting chowned and see if we can chown a root directory to be owned by mobile
Closed 7 years ago1
Can we use strider (backtracer) to find parameters for functions other than sandbox initialization? Maybe we can find simple calls to chmod and chown.
Closed 7 years ago1
run further tests about sandbox extension reuse to resist revocation
Closed 7 years ago1
query to find sandbox profiles that allow a process to grant itself arbitrary sandbox extensions and access any file. quicklookd and afcd can do this.
Updated 7 years ago
Briefly discuss access control enforcement in the background section, but keep the emphasis on policy analysis.
Updated 7 years ago
Produce Small Step Semantics for Prolog Rule explanation.
Updated 7 years ago3
Design and list exact actions performed during dynamic analysis (backup, reboot, take photo, etc.)
Updated 7 years ago1
understand difference between global-name and local-name filters in mach service sandbox rules
Updated 7 years ago2
We claim that a process has zero or more capabilities. Does a processes signature identity count as a capability?
Closed 7 years ago2
Distinguish TTY and character device
Updated 7 years ago1
Distinguish HOME and FRONT_USER_HOME prefix variables
Updated 7 years ago1
Determine if default allow profiles are relevant, and if so, model them.
Updated 7 years ago1
model the filemode sandbox filter
Updated 7 years ago1
When debugserver launches neagent, does neagent use debugserver's sandbox?
Updated 7 years ago
Write Evaluation
Updated 7 years ago
We claim that no root process is sandboxed. Is this true? Make queries.
Updated 7 years ago
determine which jailbreaks could have been fixed with changes to the sandbox and explain why.
Updated 7 years ago
Further testing of iOS 9 exploit where third party app puts symlink in com.apple.itunes.lock_sync and then afcd makes link to this link. This bypasses restrictions that should stop afcd from making links to places out of Media/
Updated 7 years ago
How did the attackers push files to the tmp directory after afcd set up a link to it?
Updated 7 years ago
run further tests to confirm that symlink attack works for afcd extension redirection and find similar situations.
Updated 7 years ago
What if a file is created during dynamic analysis, and we don't have the metadata for the file from static analysis?
Updated 7 years ago
Investigate warnings appearing when rules are imported
Updated 7 years ago
Posix ACLs
Updated 7 years ago
Directory Stick Bit
Updated 7 years ago