/home

My journey at OFTW v4.0

• ... • ...

entrance
Recently, I had the opportunity to attend to OFTW v4.0, an Apple-security based event organised by the Objective-See foundation. This event was an invite-only and student-focused event that was held in Berlin. It's the little brother of the main Objective by the Sea conference that takes place every year aiming at gathering Apple security experts from all around the world. The OFTW is free of charge but you still have to take care of the lodging and transportation costs (luckily you could find affordable prices in Berlin), so here I was, after a 12-hour (long) train journey from Paris!

I would like to thank Andy and Patrick (the Objective-See founders) for giving me the opportunity, along with the other students to attend this event, I think it has a very positive impact on the community and the whole Apple security ecosystem. Also thanks a lot to @Jaybird1291 for the (very) valuable tips and tricks!

The event was split in two days, the first one was dedicated to trainings, the other one for the talks, here is a list of the trainers and speakers:

speakers

Day 1 - Training

Introduction and context

Multiple trainings were held and I decided to go with the “Building and Breaking iOS Apps” training from Jiska Classen (@naehrdine on BlueSky), a mobile security researcher and professor now teaching at the Hasso Plattner Institute.

As its title says, the main focus of this training is to build and break apps. Jiska started by presenting the basics of the Apple development ecosystem before continuing on (xcode, signing capabilities…). Before introducing the main security concepts that hold Apple’s security together (sandbox, entitlements, protected resources…).

We then had an overview of the jailbreaks available to allow us to work on vulnerable devices.

Session 1

Now that the introduction was done, it was time for the exercises! Those are divided into sessions that can contain multiple ones.

We started by developing a dummy iOS app that requests some permissions (microphone, location) and learning how to call native C functions from Swift. The .ipa then needed to be sent over to our test device and installed from the TrollStore.

Here is a stub showing how to ask for the microphone access:

1
2
3
4
5

func requestMicrophonePermission() {
  AVAudioApplication.requestRecordPermission(completionHandler: {_ in
    Self.logger.info("got permission?")
  })
}

Once the exercise was done, Jiska continued the training with the overview of an .ipa file structure, presenting how to unpack the file and find valuable information such as the codesignature, the information property list, or the main binary with entitlement segments.

Session 2

The next exercise was dedicated to the analysis of a well-known app. For this you could use ipatool (brew install Kosthi/tap/ipatool) to download the app or use one given by Jiska for the training.

The goal was to analyse the app’s permissions, entitlements and protected resources to point out anything seeming out of the ordinary.

I personally chose Signal since I use the app daily.

You can unzip the archive and inspect the files you want:

1

unzip org.whispersystems.signal_874139669_8.20.1.ipa -d extracted

Here is a glimpse of the Info.plist showcasing how the app handles media attachments:

1
2

    <key>NSAppleMusicUsageDescription</key>
    <string>Signal needs to use Apple Music to play media attachments.</string>

After seeing the internals of an ipa file, we now needed to discover Mach-O files. We were presented with the structure of those binaries:

  • a header: composed of multiple parts; metadata, load commands to load external libraries and segments to memory.
  • segments: containing the name, permissions r/w/x, file offset, size(s), sections.

All of those can be inspected with otool, here are some examples of usage:

  • List libraries otool -L <binary>
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

otool -L Signal
Signal:
        @rpath/BonMot.framework/BonMot (compatibility version 1.0.0, current version 1.0.0)
        @rpath/CocoaLumberjack.framework/CocoaLumberjack (compatibility version 1.0.0, current version 1.0.0)
        /System/Library/Frameworks/Contacts.framework/Contacts (compatibility version 0.0.0, current version 3804.255.21, weak)
        /System/Library/Frameworks/CoreGraphics.framework/CoreGraphics (compatibility version 64.0.0, current version 1965.5.1)
...
        /usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 1.0.0)
        /usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
        /usr/lib/swift/libswiftUIKit.dylib (compatibility version 1.0.0, current version 1.0.0)
        /usr/lib/swift/libswiftPhotosUI.dylib (compatibility version 1.0.0, current version 852.0.102)
  • See whether the binary is encrypted or not otool -l <binary> | grep -A4 LC_ENCRYPTION_INFO (a cryptid of 0 means plaintext, 1 means encrypted)
1
2
3
4
5
6

otool -l Signal | grep -A4 LC_ENCRYPTION_INFO
          cmd LC_ENCRYPTION_INFO_64
      cmdsize 24
     cryptoff 16384
    cryptsize 13336576
      cryptid 1

We then studied the options we had to decrypt apps (since they are now all encrypted by default and decrypted at runtime), including using a jailbroken device with a debugger, appdecrypt (https://github.com/paradiseduo/appdecrypt), TrollDecryptJB (https://github.com/34306/TrollDecryptJB) Along with tools to dump apps such as dumpster (https://github.com/ChiChou/dumpster), TrollDecrypt (https://github.com/34306/TrollDecryptJB), appdecrypt (https://github.com/paradiseduo/appdecrypt), bagbak (https://github.com/ChiChou/bagbak), frida-ios-dump patched version to handle the NetworkExtension (https://github.com/miticollo/frida-ios-dump), r2fultch (https://github.com/as0ler/r2flutch).

Session 3

The last exercises were dedicated to finding flags inside a given dummy app named SharkStay.

The first flag was a plaintext string:

oftw{4loha_h4rdcoded_c0up0n}

The second flag was some data xored with 0x5a:

oftw{x0r_1snt_encryption}

For the third flag, we had a little course of Swift strings and how they are handled by the system, it lead us to the following flag:

1
2

0x3474737b7774666f
0xeb000000007d6b63

oftw{st4ck}

There was initially a dynamic part for this exercise but we (sadly) didn’t have time to finish, here is still the workflow you would use to debug an app: Start by jailbreaking your device. Once done set up an iproxy tunnel (iproxy 2222 2222 &), then connect to SSH.

You will then need a debugserver binary with the correct entitlements. For this you can copy the debugserver from your device into a new location:

1

cp /usr/libexec/debugserver /var/jb/bin/

You can then create an entitlement file with the following content:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

<?xml version=
"1.0" encoding=
"UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version=
"1.0">
<dict>
  <key>com.apple.backboardd.debugapplications</key>
  <true/>
  <key>com.apple.backboardd.launchapplications</key>
  <true/>
  <key>com.apple.diagnosticd.diagnostic</key>
  <true/>
  <key>com.apple.frontboard.debugapplications</key>
  <true/>
  <key>com.apple.frontboard.launchapplications</key>
  <true/>
  <key>com.apple.security.network.client</key>
  <true/>
  <key>com.apple.security.network.server</key>
  <true/>
  <key>com.apple.springboard.debugapplications</key>
  <true/>
  <key>com.apple.system-task-ports</key>
  <true/>
  <key>get-task-allow</key>
  <true/>
  <key>platform-application</key>
  <true/>
  <key>run-unsigned-code</key>
  <true/>
  <key>task_for_pid-allow</key>
  <true/>
</dict>
</plist>

Before signing your newly created debugserver:

1

ldid -S/tmp/entitlements.xml /var/jb/bin/debugserver

Once done, start the debugserver with an arbitrary port and the PID of the target process:

1

debugserver 0.0.0.0:1234 --attach=1472

And set up an iproxy tunnel to forward the traffic:

1

iproxy 5678 1234 &

You can now start lldb and set up the correct settings. Select the platform:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

lldb
(lldb) platform select remote-ios
Platform: remote-ios
Connected: no
SDK Roots: [ 0]
"/Users/oftw/Library/Developer/Xcode/iOS
DeviceSupport/iPad7,11 18.1 (22B83)"
(lldb) process connect connect://localhost:5678
Process 1472 stopped
* thread #1, stop reason = signal SIGSTOP
frame #0: 0x00000001d4c200ec
libsystem_kernel.dylib`__sigsuspend_nocancel + 8
libsystem_kernel.dylib`__sigsuspend_nocancel:

You can also use llef, a fancy lldb (https://github.com/foundryzero/llef) or use pwndbg-lldb (my preferred option https://github.com/pwndbg/pwndbg).

Day 2 - talks

The second day was dedicated to talks, here is the list:

I especially enjoyed the talks from Swantje Lange, Sebastian Schnorbus, Nils Rollshausen, Lukas Arnold though it is based on my personal interests :)

Conclusion

This event was a blast, I hope it doesn’t sound like a linkedin post but I’m really grateful for the opportunity I was given to attend this event. I met super great people and the relatively small size of the event allows for better exchanges. Remember to always be curious and ask questions even though you’re scared it might sound stupid.

And thanks to @ricbent for showing me around Berlin!

If you stumble upon this post wanting to apply for OFTW, you can dm me if you have any questions, I would be happy to help.