The Mac Hacker's Handbook

by Miller, Charlie; Dai Zovi, Dino

• ISBN13: 9780470395363
• ISBN10: 0470395362
• Edition: 1st
• Format: Paperback
• Copyright: 2009-03-03
• Publisher: Wiley

Summary

The book focuses on how to find flaws in software on MacOS X and demonstrate their risk by developing proof-of-concept exploits for those vulnerabilities. The material shows what sort of attacks are prevented by Leopard's security defenses and what sort of attacks are not prevented. This information is valuable to security professionals securing MacOS X systems and applications that run on them (and by extension, the iPhone, which shares a very similar architecture). This is information that is known by "bad guys" and so the "good guy" authors are making sure that security professionals have access to this same information. The ideas and techniques are mostly offensive in nature.

Author Biography

CharlIe Millerwon the second CanSecWest Pwn2Own contest in 2008 and was named one of the Top 10 Computer Hackers of 2008 by Popular Mechanics.

Dino Dai Zovi won the first CanSecWest Pwn2Own contest in 2007 and was named one of the 15 Most Influential People in Security by eWEEK.

Table of Contents

Foreword

Introduction

Mac OS X Basics.

Mac OS X Architecture

Basics

XNU

Mach

BSD

I/O Kit

Darwin and Friends

Tools of the Trade

Ktrace/DTrace

Objective-C

Universal Binaries and the Mach-O File Format

Universal Binaries

Mach-O File Format

Example

Bundles

launchd

Leopard Security

Library Randomization

Executable Heap

Stack Protection (propolice)

Firewall

Sandboxing (Seatbelt)

References

Mac OS X Parlance

Bonjour!

Get an IP Address

Set Up Name Translation

Service Discovery

Bonjour

mDNSResponder

Source Code

QuickTime

.mov

RTSP

Conclusion

References

Attack Surface

Searching the Server Side

Nonstandard Listening Processes

Cutting into the Client Side

Safari

All of SafariÆs Children

Safe File Types

Having Your Cake

Conclusion

References

Discovering Vulnerabilities.

Tracing and Debugging

Pathetic ptrace

Good OlÆ GDB

DTrace

D Programming Language

Describing Probes

Example: Using Dtrace

Example: Using ltrace

Example: Instruction Tracer/Code-Coverage Monitor

Example: Memory Tracer

PyDbg

PyDbg Basics

Memory Searching

In-Memory Fuzzing

Binary Code Coverage with Pai Mei

iTunes Hates You

Conclusion

References

Finding Bugs

Bug-Hunting Strategies

Old-School Source-Code Analysis

Getting to the Source

Code Coverage

CanSecWest 2008 Bug

vi + Changelog = Leopard 0-day

AppleÆs Prerelease-Vulnerability Collection

Fuzz Fun

Network Fuzzing

File Fuzzing

Conclusion

References

Reverse Engineering

Disassembly Oddities

EIP-Relative Data Addressing

Messed-Up Jump Tables

Identifying Missed Functions

Reversing Obj-C

Cleaning Up Obj-C

Shedding Light on objc_msgSend Calls

Case Study

Patching Binaries

Conclusion

References

Exploitation.

Exploiting Stack Overflows

Stack Basics

Stack Usage on PowerPC

Stack Usage on x86

Smashing the Stack on PowerPC

Smashing the Stack on x86

Exploiting the x86 Nonexecutable Stack

Return into system()

Executing the Payload from the Heap

Finding Useful Instruction Sequences

PowerPC

x86

Conclusion

References

Exploiting Heap Overflows

The Heap

The Scalable Zone Allocator

Regions

Freeing and Allocating Memory

Overwriting Heap Metadata

Arbitrary 4-Byte Overwrite

Large Arbitrary Memory Overwrite

Obtaining Code Execution

Taming the Heap with Feng Shui

Fill æEr Up

Feng Shui

WebKitÆs JavaScript

Case Study

Feng Shui Example

Heap Spray

References

Exploit Payloads

Mac OS X Exploit Payload Development

Restoring Privileges

Forking a New Process

Executing a Shell

Encoders and Decoders

Staged Payload Execution

Payload Components

PowerPC Exploit Payload

execve_binsh

system

decode_longxor

tcp_listen 231

tcp_connect

tcp_find

dup2_std_fds

vfork

Testing Simple Components

Putting Together Simple Payloads

Intel x86 Exploit Payloads

remote_execution_loop

inject_bundle

Testing Complex Components

Conclusion

References

Real-World Exploits

QuickTime RTSP Content-Type Header Overflow

Triggering the Vulnerability

Exploitation on PowerPC

Exploitation on x86

mDNSResponder UPnP Location Header Overflow

Triggering the Vulnerability

Exploiting the Vulnerability

Exploiting on PowerPC

QuickTime QTJava toQTPointer() Memory Access

Exploiting toQTPointer()

Obtaining Code Execution

Conclusion

References

Post-Exploitation.

Injecting, Hooking, and Swizzling

Introduction to Mach

Mach Abstractions

Mach Security Model Mach Exceptions

Mach Injection

Remote Threads

Remote Process Memory

Loading a Dynamic Library or Bundle

Inject-Bundle Usage

Example: iSight Photo Capture

Function Hooking

Example: SSLSpy

Objective-C Method Swizzling

Example: iChat Spy

Conclusion

References

Rootkits

Kernel Extensions

Hello Kernel

System Calls

Hiding Files

Hiding the Rootkit

Maintaining Access across Reboots

Controlling the Rootkit

Creating the RPC Server

Injecting Kernel RPC Servers

Calling the Kernel RPC Server

Remote Access

Hardware-Virtualization Rootkits

Hyperjacking

Rootkit Hypervisor

Conclusion

References

Index

Table of Contents provided by Publisher. All Rights Reserved.