The iPhone USB Exploit that Apple Can’t Fix YT

Description

Are you a security researcher or reverse engineer?

For 50% off IDA Products use promo code BILLY50, https://hex-rays.com/pricing *
For 30% off IDA Training use promo code BILLY30, https://hex-rays.com/training **

- License discounts are only valid for individuals, not corporations. Cannot be combined with any other promo code or discount.
** Cannot be combined with any other promo code or discount.

/////////////////////////////////////

Hey guys, today we're looking at the newly-released iPhone BootROM exploit - usbliter8.

Research group Paradigm Shift published a PoC and a blog post detailing a vulnerability within the USB controller of iPhones with the A12 and A13 chips. The bug provides a 'buffer underflow' primitive, allowing a malicious host to corrupt data in SRAM, and ultimately gain code execution within the iPhone's earliest boot stage.

The PoC implements a ROP chain, followed by a shellcode payload, leaving the device in 'pwned DFU' mode.

This is a pretty significant discovery in the world of iPhone security. BootROM exploits are very rare, and indeed very powerful.

Thanks for watching,
~ bellis1000
https://zygosec.com

Links:
https://ps.tc/pages/blog-usbliter8.html
https://github.com/prdgmshift/usbliter8
https://newosxbook.com/bonus/iboot.pdf
https://github.com/axi0mX/ipwndfu
https://github.com/checkra1n