Brandon Azad

@_bazad

github.com/bazad
Joined April 2018
3 Photos and videos Photos and videos

Tweets

You blocked @_bazad

Are you sure you want to view these Tweets? Viewing Tweets won't unblock @_bazad

  1. May 7

    I will be presenting "A study in PAC" at MOSEC 2019. The talk will cover my analysis of how Apple implemented (and improved on) Pointer Authentication on the A12 and look at 5 ways to bypass it.

    17 replies 45 retweets 309 likes
    Undo
  2. Mar 8

    I'll be presenting the technical details of voucher_swap, a kernel exploit for CVE-2019-6225 on iOS 12.1.2, at this June.

    6 replies 108 retweets 529 likes
    Undo
  3. Feb 1

    My analysis of Apple's implementation of PAC on the A12 (a substantial improvement over the ARM standard for protecting against kernel attackers):

    13 replies 228 retweets 603 likes
    Undo
  4. Jan 29

    The A12, now with more kernel code execution; introducing voucher_swap:

    52 replies 340 retweets 971 likes
    Undo
  5. Jan 22

    If you're interested in bootstrapping iOS kernel security research (including the ability to forge PACs and call arbitrary kernel functions), keep an A12 research device on iOS 12.1.2.

    64 replies 241 retweets 867 likes
    Undo
  6. 21 Sep 2018

    iOS full userspace compromise via malicious crashing: . Versions up to 11.4 are vulnerable, but the exploit only targets 11.2.6. The writeup also discloses some new mitigation bypasses.

    10 replies 254 retweets 555 likes
    Undo
  7. 30 Jul 2018

    I'll be presenting "Crashing to root: How to escape the iOS sandbox using abort()" at @bevxcon this September. I'll show how to exploit CVE-2018-4280, fixed in iOS 11.4.1, by crashing maliciously in order to elevate privileges, defeat codesigning, and spawn a shell on iOS 11.2.6.

    26 replies 337 retweets 1,003 likes
    Undo
  8. 21 Jun 2018

    The ida_kernelcache analysis toolkit now supports the new iOS 12 kernelcache format, including untagging pointers to restore IDA's xrefs:

    2 replies 54 retweets 202 likes
    Undo
  9. 20 Jun 2018

    The iOS 12 kernelcache is changing. Here's my analysis on the new static pointer tagging found in the kernelcache:

    5 replies 105 retweets 279 likes
    Undo
  10. 29 Apr 2018

    This is a userspace-only exploit (no kernel vulnerabilities), but still gets you a shell. I'm submitting a talk about this work to a security conference. When the exploit becomes public will depend on when the issue gets fixed and whether the talk is accepted.

    15 replies 43 retweets 166 likes
    Show this thread
    Show this thread
    Undo
  11. 22 Apr 2018

    For those on iOS 11.2.6 or below, I'm working on a userspace security research platform. You'll be able to spawn pseudo-signed binaries to run as unsandboxed root with arbitrary entitlements (including task_for_pid-allow).

    52 replies 161 retweets 574 likes
    Show this thread
    Show this thread
    Undo

@_bazad hasn't Tweeted yet.

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

    You may also like

    ·