Reverse Engineering & Research
Reverse Engineering iOS 18 Inactivity Reboot iOS 18 introduced a new inactivity reboot security feature. What does it protect from and how does it work? This blog post covers all the details down to a kernel extension and the Secure Enclave Processor. Security Before First Unlock / After First Unlock Did you know that entering your passcode for the first time after your phone starts is something…
Learning reverse engineering on mobile devices can be challenging, especially on iOS, where tooling is less accessible than on Android. On YouTube, I published various videos on reverse engineering with Frida , which is a tool for dynamic reverse engineering of applications during runtime. Last year, I started giving public reversing trainings via BlackHoodie and the university I'm teaching at,…
On an M1 Mac, Frida needs some extra steps to be able to attach to system processes. Mainly writing this down here because it was spread across multiple GitHub issues. Hope it helps some of you who are working with Frida on M1 Macs :) Versions macOS Ventura 13.0.1 Frida 16.0.2 Apple M1 Pro Setup Disable System Integrity Protection (SIP). Power off Mac, power on with very long press to get the…
There are a few configurations that I apply to almost every research iPhone. While these methods are documented publicly, the information is at many different places. Driven by laziness to search them on the Internet every time, I document them here, hoping that it also helps other researchers :) Logs Increase log level For many targets, Apple has predefined debug profiles. They will print…
Update: We wrote a paper with even more technical details :) iOS 15.0 introduces a new feature: an iPhone can be located with Find My even while the iPhone is turned "off". How does it work? Is it a security concern? I saw this feature rather early on one of my iPhones with an iOS 15 beta. Here's a screenshot I took in July. The user interface changed a little bit since then. It took a bit longer…
There's a new Bluetooth vulnerability collection, called BrakTooth . PoCs are under NDA until end of October. Are these bugs real? Do they affect more than the Cypress dev kit, for example, iPhones and MacBooks? Jan, who developed the Frankenstein emulator for Cypress chips and discovered the BlueFrag vulnerability within Android, joined my efforts in reproducing these bugs. All tooling we used is…
If you ever looked into one of Broadcom's combo chip datasheets, you might have noticed a feature called "WLAN RAM Sharing". In the following, I will explain how to use it to get controlled code execution on Wi-Fi via Bluetooth, which can be helpful in a couple of scenarios: Hack around in Wi-Fi firmware during runtime without disabling SELinux on Android ( Nexmon requires kernel patching with…
Found some time for another Bluetooth rant :) This time it's going to be about BlueZ , the Linux Bluetooth stack. Note that there are other Bluetooth stacks for Linux such as BTstack , but I didn't find the time to play around with these, and BlueZ is still what you get these days if you install a normal Linux distribution. This is my view on about BlueZ and a couple of things might be…
The perfect Bluetooth research tooling doesn't exist ;) But since I'm maintaining InternalBlue I can provide you with an overview of compatible devices and the advantages or shortcomings of all of these. There is some open tooling for Bluetooth LE out there. Bluetooth LE is mostly used in IoT devices and modern gadgets. When it comes to Classic Bluetooth, which is still used a lot for audio…
When looking into the most recent Bluetooth patches of the Samsung Galaxy Note 20 5G, I found something interesting. Once again, it's about the Random Number Generator (RNG). Jörn, Felix and me already published a WOOT paper about this last year. But there were some updates since then, which will be covered in this blog post. Oh, and it also contains assembly for the curious reverse engineer,…
Due to some vulnerabilities found recently, Broadcom started to see the "Bluetooth host -> Bluetooth controller" communication as an attack surface. In Bluetooth terminology, the host is the operating system with a Bluetooth daemon, e.g. iOS or Android, and the controller is Broadcom's Bluetooth chip. A lot of manufacturers see that as attack surface - to protect their intellectual property or to…
A lot of people asked me about my OBS setup. So I'm releasing a few details here. Feel free to ask questions in case I forgot anything. Recording on a laptop Yes, I'm recording my videos on a laptop. Initially, I tried a 5 year old X1 Yoga running Linux. While this works okay-ish, once I used a dual camera setup, my recordings sometimes had very low frames per second and other weird effects. Using…
Water, electricity, transportation—all of them are critical infrastructures. In Germany, everything classified as part of a critical infrastructure has to conform to security and safety guidelines. I had some nightmares^Wexperiences with these in the past. And I decided to only work on projects classified as critical infrastructure if I could do defensive research, despite being a mostly offensive…
What to expect from supervising students So far, I supervised approximately 30 B.Sc./M.Sc. students. My supervision style might not work for everyone—but it turned out to work quite well for the average chaotic nerd with an interest in IT security. When deciding to supervise a thesis, many people think this could be a great workforce in accelerating their PhD. I didn't have that illusion, as my…