Beyond The 'Cript: Practical iOS Reverse Engineering

Slide 1

Slide 1 text

Slide 2

Slide 2 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Why This Talk? •  Apps more hardened against common attacks •  Bridge the gap •  Deeper understanding of what happens under the hood •  Foundation for additional research

Slide 3

Slide 3 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Outline/Agenda •  Building A General Toolkit •  iOS Application Assessment 101 –  Usual results –  “New” approach •  The Reverse Engineer’s Toolkit •  Reverse Engineering iOS Applications •  Mach-O Binary Format •  Mach Tasks •  ARM(32/64) •  Objective-C •  Swift •  Identifying and bypassing Simple Jailbreak Detection Routines •  Conclusion

Slide 4

Slide 4 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Outline/Agenda •  Building A General Toolkit •  iOS Application Assessment 101 •  The Reverse Engineer’s Toolkit •  Reverse Engineering iOS Applications •  Identifying and bypassing Simple Jailbreak Detection Routines •  Conclusion

Slide 5

Slide 5 text

Slide 6

Slide 6 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Jailbroken Device •  Removing software restrictions imposed by iOS, through the use of software exploits •  Recommend dedicated device for testing •  Latest jailbreak –  Pangu (iOS 9.2 – 9.3.3 64-bit devices only)

Slide 7

Slide 7 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Jailbroken Device (contd.) •  Tethered •  Does not persist across reboots •  Requires computer to start device •  Untethered •  Persists on device across reboots •  Semi-tethered •  Requires computer to start into jailbroken state •  Rebooting or starting device without assistance possible. But boots into non-jailbroken state

Slide 8

Slide 8 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Jailbroken Device (ProTip) •  Change default root password from alpine •  Access device over usb using usbmuxd –  sudo python tcprelay.py -t 22:22 •  Generate ssh keys –  ssh-keygen -t rsa -f ~/.ssh/ironman -N "” •  Copy public key to device –  ssh-copy-id -i ~/.ssh/ironman.pub root@localhost •  Create an alias on (~/.ssh/config)

Slide 9

Slide 9 text

Slide 10

Slide 10 text

Slide 11

Slide 11 text

Slide 12

Slide 12 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Instrumentation: Cycript •  Injects into target process •  Interactive console •  Objective-C and Javascript syntax •  Supported Architectures(iOS, Mac OS X) •  NowSecure fork where runtime powered by Frida* (Cycript on steroids)

Slide 13

Slide 13 text

Slide 14

Slide 14 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Instrumentation: Frida •  Injects Google’s V8 engine into target process •  Javascript executed with full access to memory •  Function hooking •  Access to native methods •  Inject into starting process •  Multiple architectures (Windows, Mac, Linux, iOS and Android)

Slide 15

Slide 15 text

Slide 16

Slide 16 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Automating Common Tasks •  Idb Tool - http://www.idbtool.com/ •  Snoop-IT - http://repo.nesolabs.de/ •  iRet - https://www.veracode.com/blog/2014/03/introducing-the-ios-reverse-engineering-toolkit •  IntroSpy - https://github.com/iSECPartners/Introspy-iOS •  AppMon - https://dpnishant.github.io/appmon/ •  Needle - https://github.com/mwrlabs/needle •  Varying levels of support

Slide 17

Slide 17 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Automating Common Tasks: Idb Tool •  Idb Tool •  “idb is a tool to simplify some common tasks for iOS app security assessments and research.” •  Provides general app info •  URL Handler •  Keychain dumping •  Pasteboard •  Logging

Slide 18

Slide 18 text

Slide 19

Slide 19 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Essentials: Command Line Utilities •  Command Line –  BigBoss Recommended Tools (Cydia) –  Erica Utilities (Cydia) –  Jonathan Levin compiled a number of commonly used binaries for iOS

Slide 20

Slide 20 text

Slide 21

Slide 21 text

Slide 22

Slide 22 text

Slide 23

Slide 23 text

Slide 24

Slide 24 text

Slide 25

Slide 25 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Insecure Storage: Property Lists (.plist) •  Stores serialized objects •  Key value pairs •  Maybe compacted to bplist (binary plist) –  cat filename.plist | plutil -convert xml1 - -o -

Slide 26

Slide 26 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Insecure Storage: Client-Side Data Stores •  Often see SQLite being used for client-side storage •  Lightweight client-side database •  Query using SQL

Slide 27

Slide 27 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Insecure Storage: Fun Fact About SQLite Data Stores •  Delete doesn’t do what you think •  Deleted data added to free list •  Free records not overwritten until more space required •  End result is data may not be overwritten for a while •  May be recovered with SQLite-parser

Slide 28

Slide 28 text

Slide 29

Slide 29 text

Slide 30

Slide 30 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Insecure Storage: Inspecting The Cache •  Caches directory similar function to that of a web browser’s cache •  Aimed at improving performance •  May store web cache content

Slide 31

Slide 31 text

Slide 32

Slide 32 text

Slide 33

Slide 33 text

Slide 34

Slide 34 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Inter-process Communication (Side Note) •  Malicious app could register your URL scheme •  [[UIApplication sharedApplication] openURL:myURL]; •  Universal Links introduced in iOS 9 •  Kills the openURL problem •  Developer specifies what URL’s will be processed by app (association file) •  Communication over HTTPS •  No more enumerating apps via can canOpenURL method

Slide 35

Slide 35 text

Slide 36

Slide 36 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Summary: Usual Results •  Issues relating to Local Storage –  Keep in mind most of these attacks requires the device to be unlocked •  Unsecured API’s (via Burpsuite Pro) •  Some hard-coded secrets maybe (typically run strings against binary) •  The truth however is that most of these bugs closed –  Binary protections are now standard –  Data Protection API’s (keychain etc) –  Universal links introduced with iOS 9 address IPC loophole –  …...

Slide 37

Slide 37 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Additionally What Happens When? •  The common tools fail? •  Your Google Fu returns nothing? •  There are custom security protections in place •  You want to extend an existing tool? •  You want start investigating deeply hidden logic bugs –  Crypto functions etc •  Move beyond 3rd party applications

Slide 38

Slide 38 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Towards A “New” Approach •  At this point we need to take a different approach one that involves Reverse Engineering and leverages knowledge of : •  iOS internals •  ARM(32/64) Assembly •  Deep dive into Objective-C/Swift •  ….... •  Let’s improve our toolkit •  And expand our knowledge base

Slide 39

Slide 39 text

Slide 40

Slide 40 text

Slide 41

Slide 41 text

Slide 42

Slide 42 text

Slide 43

Slide 43 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. The Reverse Engineer’s Toolkit: lldb •  Debugging an application binary with lldb •  iOS Device 1.  debugserver -x backboard ip:port •  MAC Host 1.  lldb 2.  process connect connect://: 3.  image list –o –f (ASLR)

Slide 44

Slide 44 text

Slide 45

Slide 45 text

Slide 46

Slide 46 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. The Reverse Engineer’s Toolkit: jtool •  otool type functionality with way more options •  MACH-O analysis (atos, dyldinfo, nm, strings etc) •  Multi-platform (OS X, iOS, Linux) •  ARM64 disassembler

Slide 47

Slide 47 text

Slide 48

Slide 48 text

Slide 49

Slide 49 text

Slide 50

Slide 50 text

Slide 51

Slide 51 text

Slide 52

Slide 52 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Apple’s CC Tools •  otool •  MACH-O Binary Swiss army knife •  nm •  Displays symbol table •  lipo •  Architectures embedded in binary •  Codesign •  Binary signing

Slide 53

Slide 53 text

Slide 54

Slide 54 text

Slide 55

Slide 55 text

Slide 56

Slide 56 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Application Binary Version Location < iOS 8 /var/mobile/Application/ iOS 8 + §  /var/mobile/Containers/Bundle/Application/ §  App binary, nibs, Code Signature §  /var/mobile/Containers/Data/Application/ §  Documents, Library, tmp folder iOS 9.3.x §  /var/containers/Bundle/Application/ §  App binary

Slide 57

Slide 57 text

Slide 58

Slide 58 text

Slide 59

Slide 59 text

Slide 60

Slide 60 text

Slide 61

Slide 61 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Mach-O: SEGMENTS •  __PAGEZERO(NULL pointer trap, all access permissions revoked ) •  _TEXT(program code) •  _DATA (readable/writeable program data) •  _LINKEDIT (symbol and other tables used by linker) •  _RESTRICT (see dyld.cpp, will not load DYLD_INSERT_LIBRARIES) •  Optional sections

Slide 62

Slide 62 text

Slide 63

Slide 63 text

Slide 64

Slide 64 text

Slide 65

Slide 65 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Mach-O: Load Commands (dyld) •  Kernel hands off to DYLD(dynamic linker) •  Uses dynamic linker specified in LC_LOAD_DYLINKER •  Loads each LC_LOAD_DYLIB •  Resolves symbols •  Interposing (method switching) •  add __interpose section to __DATA SEGMENT •  Force library loading with DYLD_INSERT_LIBRARIES •  code with __attribute(constructor) auto runs

Slide 66

Slide 66 text

Slide 67

Slide 67 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Mach Tasks •  At this point binary mapped into memory •  Process on other systems •  Port (IPC Endpoint) •  Own the port, own the task •  Mach Trap task_for_pid() •  Requires jailbreak tfp0 patch for kernel(PID0) •  processor_set_tasks() •  Any task port in system

Slide 68

Slide 68 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Mach Tasks – Interacting with the task •  Get the task port •  Read/write memory with mach_vm* api’s •  Inject your own shellcode •  Left to your imagination

Slide 69

Slide 69 text

Slide 70

Slide 70 text

Slide 71

Slide 71 text

)

Slide 72

Slide 72 text

Slide 73

Slide 73 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. ARM32 - Registers Register Purpose R0 – R12 General purpose registers R13 Stack pointer R14 Link register. Holds return address during a function call. R15 Program counter (PC) CPSR Information on current execution state (Endianness bit, Thumb bit, Mode bit)

Slide 74

Slide 74 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. ARM32 – Function Calling Convention •  Functions are invoked via a B, BX, BL, BLX Register Purpose r0-r3 §  First four function parameters. §  Other arguments passed on stack r0 Stores return value

Slide 75

Slide 75 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. ARM32 – Basic Loading Instructions Register Purpose LDR Loads a word. Ex. LDR R3, [R0] Loads the word value at R0 into R3 STR Stores a word. Ex. STR R3, [R4] Takes the value in R3 and stores at memory address R4 •  Arm is a load/store architecture •  Data must be loaded into registers before they can be used

Slide 76

Slide 76 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. ARM64 - Registers Register Purpose x0-x28 General purpose registers (64 bit) w0-w30 General purpose registers (32 bit) x29 Frame pointer x30 Link register (return address) SP Stack pointer PC Program counter

Slide 77

Slide 77 text

Slide 78

Slide 78 text

Slide 79

Slide 79 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Objective-C •  objc_msgSend •  Equivalent of calling functions in C •  id objc_msgSend(id self, SEL op,…) •  receiver(id self) •  selector(SEL op) •  Receiver is a pointer to class message is intended for •  Selector is the method to handle message

Slide 80

Slide 80 text

Slide 81

Slide 81 text

Slide 82

Slide 82 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Objective-C: Method Swizzling Under The Hood •  objc_method struct holds information about method of a class [/usr/include/objc/ runtime.h] •  Hooking Frameworks [/Library/Frameworks/CydiaSubstrate.framework] Member Description method_name Method name method_types Accepted parameters method_imp Pointer to implementation Swizzling just changes implementation using underlying C functions: •  class_replaceMethod •  method_exchangeImplementations •  method_setImplementation CydiaSubstrate: •  MSHookMessageEx •  MSHookFunction

Slide 83

Slide 83 text

Slide 84

Slide 84 text

Slide 85

Slide 85 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Swift •  Introduced with iOS 8 •  Still uses traditional message passing for Swift classes that inherit from Objective-C classes •  Swift classes may use •  Direct function calls •  Vtables •  C++ like mangled function names •  Method Swizzling if subclass of NSObject

Slide 86

Slide 86 text

Slide 87

Slide 87 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Swift: Mangled Function Names •  __TFC9jailbreak14ViewController12btnFileCheckfS0_FPSs9AnyObject_T_ –  __T Swift Symbol –  F indicates function –  C indicates it is a function belonging to a class –  9jailbreak module name prefixed with length –  14ViewController class name prefixed with length –  12btnFileCheck function name prefixed with length –  S0_FPSs no clue ?? J –  f function attribute –  9AnyObject function parameter –  T_ return type

Slide 88

Slide 88 text

Slide 89

Slide 89 text

Slide 90

Slide 90 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Disclaimer •  We will discuss binary patching next •  Yeah but I could do this with ? •  Yes there are several other options: •  xCon •  tsProtector •  Officer •  Tools discussed earlier(remember CydiaSubstrate hooking with MSHookFunction) •  What happens when you can’t? •  Get comfortable reading/modifying ARM assembly •  Start with simple examples

Slide 91

Slide 91 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. But First A Note On Patching 101 •  Replace instruction with NOP •  No Operation •  Change conditional instructions to unconditional ones •  BNE, BEQ, BLT….changes to just B etc •  Update the register that determines branch taken •  reg write •  p $ = •  Remove SEGMENT •  __RESETRICT

Slide 92

Slide 92 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Identifying and bypassing Simple Jailbreak Detection Routines •  Known file paths •  Inline functions •  Sandbox integrity •  Anti-debugging •  P_TRACED •  PT_DENY_ATTACH

Slide 93

Slide 93 text

Slide 94

Slide 94 text

Slide 95

Slide 95 text

Slide 96

Slide 96 text

Slide 97

Slide 97 text

Slide 98

Slide 98 text

Slide 99

Slide 99 text

Slide 100

Slide 100 text

Slide 101

Slide 101 text

Slide 102

Slide 102 text

Slide 103

Slide 103 text

Slide 104

Slide 104 text

Slide 105

Slide 105 text

Slide 106

Slide 106 text

Slide 107

Slide 107 text

Slide 108

Slide 108 text

Slide 109

Slide 109 text

Slide 110

Slide 110 text

Slide 111

Slide 111 text

Slide 112

Slide 112 text

Slide 113

Slide 113 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. Conclusion •  Common bugs being closed •  A “new” approach and break from the norm is required for in depth assessments •  Assembly knowledge a MUST for Reversing Engineering –  Low level assembly allows you to bypass many security protections, discover hidden gems and then some •  Knowledge of iOS architecture will not only improve your assessments but also provide a launching pad for other research •  Disassemblers are your friends (IDA, Hopper, Jtool …..) •  Add the reverse engineering skillset to your arsenal !!!

Slide 114

Slide 114 text

IOActive, Inc. Copyright ©2016. All Rights Reserved. References •  Books: •  Mac OS X and iOS Internals To the Apple’s Core (Jonathan Levin) •  The Mobile Application Hacker’s Handbook (Dominic Chell, Tyrone Erasmus et al. ) •  Hacking and Securing iOS Applications (Jonathan Zdziarski) •  iOS Application Security: The Definitive Guide for Hackers and Developers (David Thiel) •  Blogs and Tools: •  processor_set_tasks() - http://newosxbook.com/articles/PST2.html •  procexp – http://newosxbook.com/tools/procexp.html •  iOSBinaries - http://newosxbook.com/tools/iOSBinaries.html •  jtool - http://newosxbook.com/tools/jtool.html •  filemon - http://newosxbook.com/tools/filemon.html •  AmIBeingDebugged - https://developer.apple.com/library/mac/qa/qa1361/_index.html •  Frida - http://www.frida.re/ •  Cycript - http://www.cycript.org/ •  iFunBox - http://www.i-funbox.com/ •  SSL Kill Switch – https://github.com/iSECPartners/ios-ssl-kill-switch •  BurpSuite - https://portswigger.net/burp/ •  IDA - https://www.hex-rays.com/products/ida/ •  Hopper - https://www.hopperapp.com/ •  Idb - http://www.idbtool.com/ •  PT_DENY_ATTACH - https://www.theiphonewiki.com/wiki/Bugging_Debuggers •  ARM - http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.den0024a/ch05s01s03.html •  SQLite-parser - https://github.com/mdegrazia/SQLite-Deleted-Records-Parser •  SQLite Deletion - http://www.zdziarski.com/blog/?p=6143 •  lsdtrip - http://newosxbook.com/src.jl?tree=listings&file=ls.m#dumpURL