After exploiting all the vulnerabilities, the JavaScript exploit can do whatever it wants to the device including running spyware, but the attackers chose to: launch the IMAgent process and inject a payload that clears the exploitation artefacts from the device; run a Safari process in invisible mode and forward it to a web page with the next stage.
The web page has a script that verifies the victim and, if the checks pass, receives the next stage: the Safari exploit.
The Safari exploit uses CVE-2023-32435 to execute a shellcode.
The shellcode executes another kernel exploit in the form of a Mach object file.
The exploit obtains root privileges and proceeds to execute other stages, which load spyware.
We are almost done reverse-engineering every aspect of this attack chain, and we will be releasing a series of articles next year detailing each vulnerability and how it was exploited.
While analyzing the exploit used in the Operation Triangulation attack, I discovered that most of the MMIOs used by the attackers to bypass the hardware-based kernel memory protection do not belong to any MMIO ranges defined in the device tree.
The exploit targets Apple A12-A16 Bionic SoCs, targeting unknown MMIO blocks of registers that are located at the following addresses: 0x206040000, 0x206140000, and 0x206150000.
Let us take a look at how they correlate with the regions used by the exploit.
Correlation of the gfx-asc MMIO ranges and the addresses used by the exploit.
To be more precise, the exploit uses the following unknown addresses: 0x206040000, 0x206140008, 0x206140108, 0x206150020, 0x206150040, and 0x206150048.
Pseudocode for the GFX power manager control code from the exploit.
It is touched only during the initialization and finalization stages of the exploit: it is the first register to be set during initialization and the last one, during finalization.
From my experience, it was clear that the register either enabled/disabled the hardware feature used by the exploit or controlled interrupts.
Below, you can see the reverse-engineered code of the exploit that I was able to recognize.
Pseudocode for the usage of the, 0x206040000 register by the exploit.
Let us look at the remaining unknown registers used by the exploit.
The registers 0x206140008 and 0x206140108 control enabling/disabling and running the hardware feature used by the exploit.
Pseudocode for the usage of the 0x206140008 and 0x206140108 registers by the exploit.
Pseudocode for the usage of the 0x206150040 and 0x206150048 registers by the exploit.
This Cyber News was published on securelist.com. Publication date: Wed, 27 Dec 2023 14:13:05 +0000