Azimuth Security: March 2014

Azimuth Security: March 2014 <body onload='MM_preloadImages('http://www.azimuthsecurity.com/images/a_02.gif','http://www.azimuthsecurity.com/images/r_02.gif','http://www.azimuthsecurity.com/images/t_02.gif','http://www.azimuthsecurity.com/images/s_02.gif')'><script type="text/javascript"> function setAttributeOnload(object, attribute, val) { if(window.addEventListener) { window.addEventListener('load', function(){ object[attribute] = val; }, false); } else { window.attachEvent('onload', function(){ object[attribute] = val; }); } } </script> <div id="navbar-iframe-container"></div> <script type="text/javascript" src="https://apis.google.com/js/platform.js"></script> <script type="text/javascript"> gapi.load("gapi.iframes:gapi.iframes.style.bubble", function() { if (gapi.iframes && gapi.iframes.getContext) { gapi.iframes.getContext().openChild({ url: 'https://www.blogger.com/navbar.g?targetBlogID\x3d509652393303233687\x26blogName\x3dAzimuth+Security\x26publishMode\x3dPUBLISH_MODE_HOSTED\x26navbarType\x3dBLUE\x26layoutType\x3dCLASSIC\x26searchRoot\x3dhttp://blog.azimuthsecurity.com/search\x26blogLocale\x3den\x26v\x3d2\x26homepageUrl\x3dhttp://blog.azimuthsecurity.com/?m%3D0\x26vt\x3d-4433879647623530723', where: document.getElementById("navbar-iframe-container"), id: "navbar-iframe", messageHandlersFilter: gapi.iframes.CROSS_ORIGIN_IFRAMES_FILTER, messageHandlers: { 'blogger-ping': function() {} } }); } }); </script>

	project zeus

	"You will not be informed of the meaning of Project Zeus until the time is right for you to know the meaning of Project Zeus."

Archives

	Current Posts
	April 2010
	May 2010
	August 2010
	September 2012
	February 2013
	March 2013
	April 2013
	May 2013
	June 2013
	December 2013
	March 2014
	January 2015

Posts

Attacking the iOS 7 early_random() PRNG

posted by Tarjei Mandt @ 3/12/2014 09:04:00 PM

Back in 2012, Mark and I detailed a number of iOS kernel mitigations that were introduced in iOS 6 to prevent an attacker from leveraging well-known exploitation techniques such as the zone free list pointer overwrite. Most of these mitigations rely on entropy (of varying degree) provided by the kernel, and are therefore supported by a separate random number generator known as the early_random() PRNG. As this generator is fundamental to the robustness of these mitigations, and has received additional improvements in iOS 7, it is unarguably a very interesting target that deserves further study.
Read more »

Labels: Exploitation, iOS, Kernel, PRNG

1 comments

Contact