discovering and exploiting novel security vulnerabilities in apple

DISCOVERINGANDEXPLOITINGNOVELSECURITYVULNERABILITIESINAPPLEZEROCONF

(Xiaolong Bai, LuyiXing)(co-firstauthors),NanZhang,XiaoFengWang,Xiaojing Liao,Tongxin Li,Shi-MinHu

TsinghuaUniversity,IndianaUniversityBloomingtonGeorgiaInstituteofTechnology,

PekingUniversity 1

Who are we ?

• SystemSecurityLab,IndianaUniversityBloomington– Focus on novel problems in system security– High-impact publications on IEEE S&P, ACM CCS, Usenix Security, NDSS– http://sit.soic.indiana.edu/en/

• Our advisor: Prof. XiaoFeng Wang– Top10authorsonleadingsecurityvenuesforthepast10years– http://www.informatics.indiana.edu/xw7/

Who are we ?

• We have two talks on Black Hat USA 2016– Luyi Xing and Xiaolong Bai, DISCOVERINGANDEXPLOITINGNOVELSECURITYVULNERABILITIESINAPPLEZEROCONF, August 4, JasmineBallroom, 12:10- 13:00

– NanZhang, DANGEROUSHARE:HANGINGATTRIBUTEREFERENCESHAZARDSDUETOVENDORCUSTOMIZATION,August 4, SouthSeasGH, 17:00- 17:25

DISCOVERINGANDEXPLOITINGNOVELSECURITYVULNERABILITIESINAPPLEZEROCONF

ZeroConf

• Zero Configuration Networking• Automatically configures a usable computer network– Nomanualconfiguration– Nospecificconfigurationserver

• Designed to reduceusers’ burden– Setting up a new network– Use a new service.

ZeroConf

• Bonjourprotocol– zero-configurationnetworkingoverIPthatApplehassubmittedtotheIETF.

• Goals:–Withlittleornoconfiguration– toadddevices/servicestoalocalnetwork– Existingdevicescanautomaticallyfindandconnecttothosenewdevices/services

Bonjour

• Administrators– noneedtoassignIP,hostnames,servicenamestonetworkservices(e.g.,printer)

• Whenusingaservice,userssimply– asktoseewhatnetworkservicesareavailable– andchoosefromthelistofautomaticallydiscoveredservices.

Howabouttraditionalconfigurednetwork?

MustConfigure:– IP– Printername,

• e.g.,lh135-soic.ads.iu.edu– DNSserver

Traditionally

MustConfigure:– IP– Printername,

• e.g.,lh135-soic.ads.iu.edu– DNSserver

FeaturesofBonjour

1. Serviceconfiguresitself– IP,hostname,serviceinstancename

2. Clientsautomaticallydiscoveravailableservices– Nopre-knowledgeoftheservice’sname,hostnameorIP

1.ZeroConf Concept2.So,how?

FeaturesofBonjour

Addanewprintertoanetwork

IsanybodyusingIPfe80::abcd:1234....?

Aprinterconfiguresitself

No?Great,I’lltakeit.

IPfe80::abcd:1234

AnybodyusinghostnameHP9FE5.host.local?

IPfe80::abcd:1234

No?Wonderful,I’lltakeit.

IPfe80::abcd:1234

HostnameHP9FE5.host.local

AnybodyhavingaprintingservicenamedHP-Service-9FE5?

IPfe80::abcd:1234

ServiceInstanceNameHP-Service-9FE5

IPfe80::abcd:1234

Aprinterfinishes configuringitself

FeaturesofBonjour

Twophases:DiscoveryandResolution

Automaticallyfindtheprinter:Discovery

Q1:Anyonehasaprinterservice? A1:

IhaveHP-Service-9FE5

Q1:Anyonehasaprinterservice?

Q2:SoonwhichhostisthisHP-Service-9FE5?

A2:It’sonhostHP9fe5.host.local

Automaticallyfindtheprinter:Resolution

A1:IhaveHP-Service-9FE5

Q1:Anyonehasaprinterservice?

Q2:SoonwhichhostisthisHP-Service-9FE5?

A2:It’sonhostHP9fe5.host.local

Automaticallyfindtheprinter:Resolution

A1:IhaveHP-Service-9FE5

Q3:WhatistheaddressofNPI9fe5.host.local?

A3:Itsaddress isfe80::abcd:1234

Added/Saved theprintertoyourlist

IPfe80::abcd:1234

Added/Saved theprintertoyourlist

IPfe80::abcd:1234

Apple:

Applicationsstoreserviceinstancenames,soiftheIP,port, or hostnamechanged,theapplicationcanstillconnect.

ServiceinstancenameHP-Service-9FE5issaved

IPfe80::abcd:1234

Savedprinter=AprinterwhoownsservicenameHP-Service-9FE5

Adversary Model

• Onadevice(malwareinfected)inyourlocalnetwork• Aimstointerceptsecrets/filestransferredbetweenuninfected devices

Adversary Model

• YourMac/printerareun-infected• Stealyourprintingdocuments?

1.ZeroConf Concept2.ZeroConf How3. ZeroConf Breaking

Printer

Case1:AttackBonjour

AttackBonjour

• Twoexamples• Printer– PrintersusingBonjour

• PhotoSync– SynchronizingphotosbetweenMacandiPhoneusingBonjour

• Notan application-specificorservice-specificproblem– Vulnerabilities in the design of Bonjourprotocol

Adeviceinfectedbymalware

IPHostnameServiceInstanceName

HP-Service-9FE5

IhaveaprintingserviceinstancenamedHP-Service-9FE5

HP-Service-9FE5

IhaveaprintingserviceinstancenamedHP-Service-9FE5

Savedprinter=AprinterwhoownsservicenameHP-Service-9FE5

NewServiceNameHP-Service-9FE5(2)

xServiceInstanceNameHP-Service-9FE5

Three Changing Attributes:– IP– Hostname– ServiceInstanceName

Apple:Applicationsstoreserviceinstancenames,soiftheIP,port, or hostnamechanged,theapplicationcanstillconnect.

Whyithappens?

• Anyonecanclaimanyvalueofthethreeattributes• Theprotocolonlyguaranteesnoduplicates.

Lackofauthentication

Three Changing Attributes:– IP– Hostname– ServiceInstanceName

Ifnotsavingserviceinstancenames,isitsecureenough?

AttackBonjour

• PhotoSync– SynchronizingphotosbetweenMacandiPhoneusingBonjour

• Notsavingserviceinstancename– Clientdiscoversandresolvestheservereachtime

Normally

• Discovery:Clientbrowsesforserver

WhohasPhotoSync service

ClientServer

means broadcast

Normally

• Discovery:Serverrespondswithserviceinstancename

Ihave.serviceinstancename:abcd

means broadcast

ClientServer

Normally

• Resolution1:Clientqueriesforthehostnameoftheservice

Whatisthehostname ofabcd

means broadcast

ClientServer

Normally

• Resolution1:Serverrespondswiththehostname

Its hostname isMacbook

means broadcast

ClientServer

Normally

• Resolution2:Clientqueriesfortheaddressofthehost

Whatistheaddress ofMacbook

means broadcast

ClientServer

Normally

• Resolution2:Serverrespondswithitsaddress

Whatistheaddress ofMacbook

Itsaddress is 192.168.0.1

means broadcast

ClientServer

WhatCanGoWrong?

• Anothermalware-infecteddevicespoofstheclient– SuccessfulMan-in-the-Middle

• DuringResolution– Serviceinstancenametohostname– Hostnametoaddress

WhatCanGoWrong?

• Attack1:serviceinstancenametohostname

What is the host name ofservice instance abcd

Client

Server

Attacker

WhatCanGoWrong?

Client

Server

Attacker

The host name of serviceinstance abcd is Macbook

The host name of serviceinstance abcd is Mallory

WhatCanGoWrong?

Client

Server

AttackerConnect

WhatCanGoWrong?

Client

Server

AttackerConnect

Connect

WhatCanGoWrong?

What is the address ofhost Macbook

Client

Server

Attacker

WhatCanGoWrong?

Client

Server

Attacker

The address of host Macbookis 192.168.0.1

The address of host Macbookis 192.168.0.100

WhatCanGoWrong?

Client

Server

AttackerConnect

WhatCanGoWrong?

Client

Server

AttackerConnect

Connect

• https://www.youtube.com/watch?v=WUWusqgqFr0&feature=youtu.be

FundamentalProblem

• Lackofauthentication• Anyonecanclaimanyvalueoftheidentificationattributes• Theprotocolonlyguaranteesnoduplicates,butnotsecurity.

Isiteasytoprovideauthentication?

1.ZeroConf Concept2.ZeroConf How3.ZeroConf Breaking

Case2:Airdrop

AirdropbetweenAppledevices

• WithAirDrop,youcansharephotos,videos,websites,locations,andmorewithpeoplenearbywithanAppledevice.

Jeff’sMacbook:Q1:Anyonehasanairdropservice?

Alice’siPhone:

AttackAirdrop

Ihaveaservicenamedabcd.airdrop.service

AttackAirdrop

Jeff’sMacbook:Q2:SoonwhichhostisAlice’sservice?

AttackAirdrop

Alice’siPhone:A2:It’sonhostAlices.iphone.local

Bob’siMac:A2:It’sonhostBobs.imac.local

Alice’siPhonehasservicenamedabcd.airdrop.tcp,whichisonhostBobs.imac.local

DoesTLShelp?

Jeff’sMacbook:Connecthttps://Bobs.imac.local

TLSinAirdrop

Servercertificateissuedtoappleid.CDEF…

https://Bobs.imac.local

Bob’siMac

Jeff’sMacbook

Servercertificateissuedtoappleid.ABCD…

https://Alices.iphone.local

Alice’siPhone

Sothecertificateinairdropcanhardlybeusedforauthentication.

Bob’siMac

Jeff’sMacbook

Alice’siPhone

Domainshouldmatchthecertificate

https://google.com

Certificateissuedtogoogle.com

Jeff’sMacbook

Bob’siMac

Jeff’sMacbook

Alice’siPhone

Domainshouldmatchthecertificate

What’swrongwithTLSinAirdrop

• Thecertificateinairdropcannotbeusedforauthentication– E.g,certificateshouldbeissuedtoAlice– butindeedissuedtoappleid.ABCD…

• ThecertificateshouldbeissuedtoWHAT?

• Issuethecertificatetothedomain(hostname)?– No.Hostnamemaychange andnotrepresentingauser

• Issuethecertificatetotheuser’sname?– No.Namecanbeduplicated

• Issuethecertificatetotheuser’ssocialsecuritynumber?– No.socialsecuritynumberistooprivate

• Linkingahumantohercertificateiscomplicated– challengeinfindinganyidentifiableinformationthatare• well-known• noprivacyimplication• andunique

• https://www.youtube.com/watch?v=2JEJLpvnRO4

TechnicalDetails

• Airdropservicedaemon:/usr/libexec/sharingd– ResponsibleforBonjourprocessandhttpsconnection

• Notethernet interface,Appleprivateinterface– awdl0:AppleWirelessDirectLink– Device-to-devicedirectlink

TechnicalDetails

• Howtoworkonthisinterface?– sharingd usesanApple-privatesocketoptionSO_RECV_ANYIF(0x1104)

SomecustomizedZeroConf protocols

• FileDrop– TCPpacketsfordiscovery– ellipticcurvecryptographyforsecurity– Failedinauthentication• challengeinlinkingahumantoherpublickey

Case3:Apple’sVulnerableframework

Apple’sVulnerableframework

• Multipeer Connectivity(MC)– AframeworkforautomaticservicediscoverybetweennearbydevicesacrossWi-FiandBluetoothwithoutconfiguration

• Objecttoidentifyeachapp:peerID– displayName (public)&uniqueID (private)

• AutomaticServiceDiscoveryWithoutConfiguration– ServersadvertisepeerIDs

Normally

Server

Server Client

peerIDdisplayName:AliceuniqueID:8573a

peerIDdisplayName:BobuniqueID:6c5b3

• AutomaticServiceDiscoveryWithoutConfiguration– ServersadvertisepeerIDs,ClientbrowsepeerIDs (showdisplayName)

Normally

peerIDdisplayName:AliceuniqueID:8573a

peerIDdisplayName:BobuniqueID:6c5b3

Server

Server Client

• EvenifservershavethesamedisplayName

Normally

peerIDdisplayName:AliceuniqueID:abcde

peerIDdisplayName:AliceuniqueID:54321

Server

Server Client

• EvenifservershavethesamedisplayName– uniqueIDs generatedbyMCwillalwaysbedifferent

Normally

Server

Server Client

• EvenifservershavethesamedisplayName– uniqueIDs generatedbyMCwillalwaysbedifferent

Normally

Server

Server Client

• Attackeractsasbothclientandserver– BrowseandacquirepeerID objectfromvictimserver

WhatCanGoWrong?

Server

Client&Server Client

• Attackeractsasbothclientandserver– AdvertiseusingthesamepeerID object

WhatCanGoWrong?

Server

• ClientcannotdistinguishbecauseofsameuniqueID

WhatCanGoWrong?

AnUpdate?

Server

• ClientcannotdistinguishbecauseofsameuniqueID• Clientmapstheonlypeertoattacker’saddress(MitM)

WhatCanGoWrong?

Server

• MitM attacker– First acts as client browsing for advertising servers– Once found a server, advertise using the same peerID

Technical Details

IfnotusingpeerID toforidentification,isitsecureenough?

Case4:MCinQQ

MCinQQ

• PopularinstantmessagingsoftwareinCN– 829millionactiveaccounts (Wikipedia)

• Face-To-FaceTransfer– TransferfilesbetweennearbypeersbyusingMultipeer Connectivity

• NotusingpeerID foridentification– CustomizeduniqueQQID

FacetoFaceTransfer

SendFile

Recv File

• ReceiveradvertisesitsQQID

Normally

Receiver

ReceiverSender

Lookingforreceiver

MyQQIDis1234

MyQQIDis4321

• SenderbrowsesforreceiversandfoundtheirQQIDs

Normally

Receiver

ReceiverSender

FoundReceivers:QQID:1234QQID:4321

MyQQIDis1234

MyQQIDis4321

• SenderconnectstoreceiverandgivesitsQQID

Normally

Receiver

ReceiverSender

MyQQIDis5678

Connect

• SenderconnectstoreceiverandgivesitsQQID

Normally

Receiver

ReceiverSender

MyQQIDis5678

Connect

SenderConnected:QQID:5678

• ReceiveradvertisesitsQQID

WhatCanGoWrong?

ReceiverSender

Lookingforreceiver

MyQQIDis1234

Attacker

Lookingforreceiver

• Attackerfoundvictimreceiver’sQQID

WhatCanGoWrong?

ReceiverSender

Lookingforreceiver

MyQQIDis1234

Attacker

FoundReceiver:QQID:1234

• AttackeradvertiseusingthesameQQID

WhatCanGoWrong?

ReceiverSender

Lookingforreceiver

MyQQIDis1234

Attacker

AdvertisingQQID:1234

• SenderfoundonlyoneQQID

WhatCanGoWrong?

ReceiverSender

MyQQIDis1234

Attacker

• SenderconnectstoAttacker

WhatCanGoWrong?

ReceiverSender Attacker

Connect

QQID:5678

• AttackerconnectstoReceiverusingtheSender’sQQID

WhatCanGoWrong?

ReceiverSender Attacker

Connect

QQID:5678

• https://www.youtube.com/watch?v=B71FlD3_vrc

Case5:Bluetooth

AllyouriOS notificationsbelongtome

• ZeroConf onBluetooth:AppleHandoff– AservicethatletsiOSandOSXsynchronizedatathroughBluetoothwithoutconfiguration

Normally

• HandoffcreatesBluetoothChannelwithoutconfiguration– DevicesloggedinwiththesameiCloudaccount– PairingautomaticallythroughiCloudaccount

Bluetooth

WhatCanGoWrong?

• BluetoothZeroConf:Noapp-levelauthentication• AppleNotificationCenterService(ANCS)– designedforBluetoothaccessoriestoaccessnotificationsoniOSdevices

Bluetooth

WhatCanGoWrong?

• BluetoothZeroConf:Noapp-levelauthentication• AppleNotificationCenterService(ANCS)• ThroughBluetoothchannelcreatedbyHandoff

Bluetooth

WhatCanGoWrong?

• BluetoothZeroConf:Noapp-levelauthentication• AppleNotificationCenterService(ANCS)• ThroughBluetoothchannelcreatedbyHandoff

Bluetooth

• https://www.youtube.com/watch?v=c5viAzAs0Uo

Summaryofattacks

• AttacksonAppleZeroConf channels– Bonjour (Printer,PhotoSync)– Airdrop– CustomizedZeroConf protocols (Filedrop)– Multipeer Connectivity(MCBrowserViewController,QQ)– Handoff

• Allvulnerabilitieswerereportedtovendors,acknowledgedbymostvendors

1.ZeroConf Concept2.ZeroConf How3.ZeroConf Breaking4.Impact

Impact

• Measurement–Weanalyzed61popularMacandiOSappsworkingwithZeroConf– 88.5%arevulnerabletoman-in-the-middleorimpersonationattacks

ZeroConfChannels

Vulnerable/Sampled SensitiveInformationLeaked

Bonjour 18/22 files,directoriesandclipboardsynced,documentsprinted,instantmessage

MC 24/24 filesandphotostransferred,instantmessage

BLE 10/13 Usernameandpassword forOSX

Customizedprotocols 2/2 remote keyboardinputandfilestransferred

1.ZeroConf Concept2.ZeroConf How3.ZeroConf Breaking4.Impact5.ProtectingZeroConf

ProtectingZeroConf

• Problem:linkahumantohercertificateiscomplicated• SpeakingoutYourCertificate(SPYC)– Voicebiometricstiescertificatetoidentity

SpeakingOutYourCertificate

Partitiontokn-bitsegments

Δ1||Δ2||…||Δk

nk mostsignificantbits

<w1, w2, …, wk>Wordslistlinkingtothecertificate

ProtectingZeroConf

• Challenge:linkahumantohercertificate• SpeakingoutYourCertificate(SPYC)– Voicebiometricstiescertificatetoidentity– HumanSubjectStudy:convenientandeffective

Conclusion

• Apple’sZeroConf techniquesarenotsecureasexpected– Theusability-orienteddesignaffectssecurity

• Addressingsuchsecurityrisksisnontrivial– Challengeinbindingahumantohercertificate

• OurDefense:SPYC– Voicebiometricstiescertificatetoidentity

discovering and exploiting novel security vulnerabilities in apple

Documents

assessing and exploiting bignum vulnerabilities

discovering, learning and exploiting...

exploiting format string vulnerabilities engineering... ·...

exploiting the vulnerabilities of lte wi-fi sharing devices

exploiting the client vulnerabilities in internet e-voting...

metasploit framework.” — hd moore, “the best guide to...

exploiting vulnerabilities in multifunction printers

exploiting vulnerabilities in location based commerce

exploiting format string vulnerabilities

finding and exploiting access control vulnerabilities in...

assessing and exploiting xml schema's vulnerabilities ·...

exploiting deserialization vulnerabilities in java

curs 5 - exploiting concurrency vulnerabilities in system...

exploiting memory corruption vulnerabilities in the java...

exploiting blind vulnerabilities

discovering, assessing, and remediating new critical...

exploiting software vulnerabilities program binary

discovering vulnerabilities in power...

exploiting the vulnerabilities on metasploit 3(ubuntu

modeling and discovering vulnerabilities with code ... ·...