Assumptions and Limitations

Assumptions

• All the mach-services we find are active
• All processes are equally exploitable
• Sandboxes profiles are assigned based on the following features
  • Executable is a keyboard extension
  • Executable's filepath matches './mobile/Containers/Bundle.' ..* Executable has com.apple.private.security.container-required entitlement key ..* Executable has seatbelt-profiles entitlement key ..* Executable references sandbox_init or apply_container in its binary
• Our jailbreak did not modify the access control architecture
• A process does not call a library function if it does not contain a string with the name of the function. We also assume that the presence of such a string implies that the library function will be called.
• All Apple developed executable identifiers match ‘^com.apple..*’.
• The executable we analyze will all run on the device at some point / they are not just dead code
• A process can be compromised by reading a file that has been written to by another compromised process
• The following processes can be treated as entry points for attackers ..* Third party apps ..* Third party app extensions ..* Afcd ..* Siri? ..* etc.

Scope Limits

• Optional access control features
• • Network
• • Drivers
• • Frameworks
• • Access Control Lists
• • User data
• iOS versions
• • iOS 9.0.2
• Set up two modes (with jailbreak and with firmware filesystem)