Min(Spark) Zheng

Android/iOS Senior Security Engineer @ Alibaba, CUHK PhD, a member of Blue-lotus and Insight-labs, worked in FireEye , Baidu and Tencent.

[Min(Spark) Zheng @SparkZheng]

The slides of our BlackHat USA 2019 talk: https://t.co/ITlqAsrGHx Thank you~

[checkra1n @checkra1n]

We planned to open source checkra1n in 2020, but unfortunately we're not quite ready for a full release yet.

HOWEVER: We just open sourced the entirety of PongoOS, including our kernel patchfinder and SEP exploit! All available at: https://t.co/8ISUttWGmS

[Objective-See Foundation @objective_see]

An @objective_see tool, flagged what may be the first instance of malicious code that natively targets Apple Silicon (M1)! 🍎🐛

Read: "Arm'd & Dangerous"
https://t.co/htw8K6qq1Y

[[email protected] @CodeColorist]

See No Eval: Runtime Dynamic Code Execution in Objective-C https://t.co/7EC2KsZAXn

It reveals more detail that I didn't have time to cover in my previous talk slides

[Corellium @CorelliumHQ]

It's been a long time coming: we’re very excited to announce that virtual iOS-based devices are now available for individual accounts on our groundbreaking security research platform. https://t.co/cUDhD6gROd

[Min(Spark) Zheng @SparkZheng]

You can use frida or lldb to hook or debug iOS apps on MacBook with M1 chip. hits: disable SIP and resign apps.

[Min(Spark) Zheng @SparkZheng]

COOL!

[Ian Beer @i41nbeer]

Excited to finally publish my lockdown project from earlier this year: an iOS zero-click radio proximity exploit odyssey.
https://t.co/UXQvemH0hG

[simo @_simo36]

Here is a PoC kernel exploit, it demonstrates how to get kernel task port on iOS 13.7. I will update the PoC with a writeup later.
https://t.co/NnJQ7ZRou0

[Tielei @WangTielei]

Cann’t believe that I also missed the bug. Motived by this blog, I also prepared a blog, sharing another bug in the same extension. https://t.co/THH3Z5KdDb

[Min(Spark) Zheng @SparkZheng]

Cool! iOS 14 GM pwned by @WangTielei from @PanguTeam yesterday.👍

[Min(Spark) Zheng @SparkZheng]

zone_require() mitigation (address verification for Mach port objects) was changed on iOS 13.6, looking forward to seeing a new bypass~

[CoolStar @CStar_OW]

Who needs a write-up when you can see the source code?

tardy0n for iOS 13.0 - 13.5, co-developed by @tihmstar and me:

https://t.co/S9byskHFWm

[Objective-See Foundation @objective_see]

📝 new (guest) blog post:
"CVE-2020–9934: Bypassing TCC
...for unauthorized access to sensitive user data"

🔗 https://t.co/qhcQx4sHdM
✍️ by: Matt Shockley (@mattshockl)

"...and then directly modify the TCC database to give myself every TCC entitlement" ...no code required 🤩

[Brandon Azad @_bazad]

One Byte to Rule Them All: An iOS 13 exploit technique that turns a one-byte kernel heap overflow into an arbitrary physical address mapping primitive, all while avoiding the kernel task port and sidestepping mitigations like PAC, KASLR, and zone_require.
https://t.co/QtI3By2s0i

[Min(Spark) Zheng @SparkZheng]

Mosec 2020, iOS 14 JailBreak DEMO by Pangu

[Min(Spark) Zheng @SparkZheng]

@cxm95 I am writing an email to ask them about this issue.

[Min(Spark) Zheng @SparkZheng]

Nice summary

[Brandon Azad @_bazad]

I've compiled a summary of every original public iOS kernel exploit from app context since iOS 10, describing the high-level exploit flow to get stable kernel read/write. The trends of how these exploits have evolved over time are quite interesting: https://t.co/bmXwdzWywU

[Brandon Azad @_bazad]

KTRW now has proper support for kernel debugging iOS 13. It uses checkra1n to insert an XNU kernel extension into the kernelcache before boot.

[Min(Spark) Zheng @SparkZheng]

The exp uses IOGraphicsAccelerator2 and IOSurfaceRoot to do heap fengshui in kalloc.16, but the bug is in XNU.

[Min(Spark) Zheng @SparkZheng]

Cool and good job! I am more interested in what 0day vulnerabilities are used, but the entire payload has been obfuscated and it will take some time to analyze. 😅

[Min(Spark) Zheng @SparkZheng]

make old bug great again...

[Synacktiv @Synacktiv]

Return of the iOS sandbox escape: lightspeed's back in the race!! The XNU bug @JohnCool__ described last year was reintroduced and is still exploitable in the last version of iOS, as shown by @unc0verTeam: https://t.co/XQHCw5vsXh

[Min(Spark) Zheng @SparkZheng]

Cool and good job! I am more interested in what 0day vulnerabilities are used, but the entire payload has been obfuscated and it will take some time to analyze. 😅

[@Pwn20wnd @Pwn20wnd]

#unc0ver v5.0.1 is now out - https://t.co/FtG9c9kNtg.

[unc0ver Team @unc0verTeam]

We are going to release #unc0ver 5.0.0 with support for every signed iOS version on every device using a 0day kernel vulnerability from @Pwn20wnd in sponsorship with https://t.co/l4SDOTDUla very soon. Update your devices to 13.5 and follow our progress on https://t.co/cNIUANaJr2.