Now iOS has been compromised toSuspected Ransomware
Ju Zhu, @ju__zhu
Moony Li, @FlyicWhat We Will Cover• Who We Are• Story of iOS Profile Ransomware• Technical Analysis• Detection Solution• Demo-Ju Zhu@ju__zhu
5+ years mobilesecurity
Mobile Advanced
Threat Research
Hunt Mobile
0Day/nDay
Mobile Vulnerability

Moony Li-@Flyic
8 years security
Sandcastle
Deep Discovery
Exploit Detection
Mac/Windows
KerneliOS/Android
Vulnerability

Attack Vector by Twitter• Version 1.0 Appears (2016/11)

Attack Vector by Twitter• The Source Code Released (Next Day)

Attack Vector by Twitter• Version 2.0 Released (2016/12)

Tricks to Scare Victims• SpringBoard Icon Scare• Hundreds of Rubbish Icon
• WebClip Un-Removable• Demo or Prototype

Variation in Third-Party Store• Third-Party Apple Store• 51苹果助手• Signed Profile• Reduce Alert to User

• App Promotion• WebClip Un-Removable

Others• iTunes’s Risk
• Auto Sync

• Provision Profile• Bypass Establish TrustTechnical Analysis• Mobile Config Profile• Profile InstallMobile Profile• Mobile Profile• *.mobileconfig• PayloadType• WebClip Array• Un-Removable Key• Un-Limit/private/var/mobile/Library/Co
nfigurationProfiles/profile4ecba0b5def636872b1da380625
035b4adfb4c5f4f38788cf177457
9fe90dd3c.stub*.mobileconfig
XML/Plist format like

Key
PayloadContent
PayloadDescription

Type
Array
String

PayloadDisplayName
PayloadIdentifier

StringString

PayloadOrganization

String

PayloadUUID
PayloadRemovalDisallowed

StringBoolean

PayloadType
PayloadVersion

StringInteger

IsRemovable

Key
PayloadTypecom.apple.webClip.managed
PayloadVersion
PayloadIdentifier/private/var/mobile/Library/WebClips/
PayloadUUID
2578360D688C4384B98A6331A3F8799
7.webclip/.dat.nosync0b64.1d7xs7PayloadDisplayName
PayloadDescription
PayloadOrganization
False

Type
StringIntegerStringStringStringStringString

PayloadTypecom.apple.webClip.managed

StringStringPlist Header
PayloadType
PayloadIdentifier
PayloadUUID
URL
Icon

WebClip
Array

PayloadIdentifier
PayloadUUID

URLLabel/private/var/mobile/Library/WebClips/
xxxxyyyy
Icon

URL

IsRemovable

Icon
IsRemovable

……

False

Data
BooleanContent
Array of payload dictionaries.
A description of the profile, shown on the Detailscreen for the profile.
A human-readable name for the profile.
This string is used to determine whether a newprofile should replace an existing one or should beadded.
A human-readable string containing the name ofthe organization that provided the profile.
A globally unique identifier for the profile.
If present and set to true, the user cannot delete
the profile.
The only supported value is Configuration.
The version number of the profile format.

ContentThe payload type.
The version number of the individual payload.
A reverse-DNS-style identifier for the specific payload.
A globally unique identifier for the payload.
A human-readable name for the profile payload.
A human-readable description of this payload.
A human-readable string containing the name of theorganization that provided the profile.
The URL that the Web Clip should open when clicked.
The name of the Web Clip as displayed on the Homescreen.
A PNG icon to be shown on the Home screen.
If false, the web clip is unremovable.

Remote Entry for Profile Installation• How did the author do it?
• Template• Multiple Installations

Basic Install Flow
Trigger Profiled for Installation
Interact with “Settings”
Profiled Handling
XPC Escalation to High Privilege Process

Trigger Profiled for Installation• Safari -> Profiled

Interact with “Settings”• Profiled -> Settings• “com.apple.Preferences”• Interact with UserProfiled Handling• Profile Handle• “profie-xxxxxxxxxxxxxxx.stub”• WebClip Number Un-Limit• a Buggy ModuleEscalation to High Privilege Process• Profiled -> Misagent

Profile Install Relationship/private/var/mobile/Library/ConfigurationProfiles/profile4ecba0b5def636872b1da380625035b4adfb4c5f4f38788cf1774579fe90dd3c.stub
Profilemobilemobileroot/usr/libexec/misagent
MailDeviceactivation andsynchronization

misagent/Applications/
MobileMail.ap
p/MobileMailSettings

Profiled
Safari/Applications/Mo
bileSafari.app/M
obileSafari/System/Library/PrivateFrame
works/ManagedConfiguration.
framework/Support/profiled/Applications/
Preferences.ap
p/Preferences

SpringBoard/System/Library/CoreServices/SpringBoard.app/
SpringBoard
Profiled--misagent
xpc_connection_get_name_by_address: com.apple.misagent[2916:289299 (profiled)]: libxpc.dylib!xpc_connection_send_message_with_reply_sync:
connectionName=com.apple.misagent
connectionPid=3115
connectionProcName=misagent[2916:205566 (profiled)]: libsystem_kernel.dylib!__read_nocancel call stack:
0x26032dcb Foundation!_NSReadFromFileDescriptorWithProgress,
0x26032c11 Foundation!_NSReadBytesFromFileWithExtendedAttributes,

lockdownd/usr/libexec/lockdownd

launchd/sbin/launchd

connection=0x1575c100

New Remote Attack Interface• Reason• Bypass Apple Store Security Audit• Safari->Profiled->Misagent->Lockdownd(Root)• Vulnerabilities Hunt
• Profiled and Other System Process Heap
Overflow• Enterprise Certificate App Trust Vulnerability

SpringBoard Crash• WatchDog’s Timeout

Issue Analysis• High CPU• Null Pointer• Dead Loop

Solution to Detection• Local VPN• Sandbox Based on Frida

VPN SettingSolution for Detection• Local VPN• Network Extension Framework Ever Since iOS 8+• Dynamic Sandbox• Jail-Break iOS Devices• FridaGadget.dylib Injection• JS Behavior Rules• Nools Decision Engine

Local VPN Solution
Technically we can obtain raw TCP/UDP traffic
HTTP(s) Traffic

Raw TCP/UDP Traffic

Start a Local
VPN Tunnel
iTMMS

Local HTTP
Proxy Server
WTP Module

TCP/UDPHandler(YITM)
NetworkExtension

SystemDefault

Local VPN*.mobileconfig Pattern
Traffic Filter for File Element
VPN Extension

Sandbox Based on Frida[1] Set up frida trace

Host (e.g. MacOS)

iOS real machine

Profile!*.js
Frida-server-10.x.x-ios-armX
FridaGadget.dylib

Network!*.jsfs!*.js

Mail
FriaServer

F

Safari

ProfiledF

lockdownd

F

User

Decision Rules...

Death_Profile_.js*.pyF[4] Behavior decision

iOS_Jail_Break_.js
Frida Controller……
Nools Decision
EngineKernel

LogStreamKernel[2] Behavior trace in iOS[3] Trace log collect

USB/Wifi

Trace Log
call stack:
0x24a52dcb Foundation!_NSReadFromFileDescriptorWithProgress,
0x24a52c11 Foundation!_NSReadBytesFromFileWithExtendedAttributes,
0x24a528ad Foundation!-[NSData(NSData) initWithContentsOfFile:],0x24a57f33 Foundation!+[NSData(NSData) dataWithContentsOfFile:],0x2db263d3 ManagedConfiguration!+[MCManifest installedProfileDataWithIdentifier:],
0x2db2629d ManagedConfiguration!+[MCManifest installedProfileWithIdentifier:],
0xa8873 profiled!0x59873,
0xa9ca1 profiled!0x5aca1,
0x9a3f3 profiled!0x4b3f3,
0x9bf11 profiled!0x4cf11,
0x53f2d profiled!0x4f2d,
0x35ca4d2b libdispatch.dylib!_dispatch_call_block_and_release,
0x35cb192b libdispatch.dylib!_dispatch_queue_drain$VARIANT$mp,
0x35cb0f69 libdispatch.dylib!_dispatch_queue_invoke$VARIANT$mp,
0x35cb3af1 libdispatch.dylib!_dispatch_root_queue_drain,
0x35cb34d5 libdispatch.dylib!_dispatch_worker_thread3{"time":"2017-0830T05:05:37.526Z","txnType":"syscall","lib":"libsystem_kernel.dylib","method":"read","artifact":[{"name":"filePath","value":"/private/var/mobile/Library/ConfigurationProfiles/profile4ecba0b5def636872b1da380625035b4adfb4c5f4f38788cf1774579fe90dd3c.stub","argSeq":0}

Decision Rule
exports.deathProfileCheckProfileByObjJson = function(plistObj){ //traverse(plistObj).forEach(function (x)if (&& payload.hasOwnProperty("PayloadType")&& -1 < payload.PayloadType.search('com.apple.webClip.managed')){ payloadTemp.PayloadType = payload.PayloadType;if (payload.hasOwnProperty("IsRemovable") ){if ( payload.IsRemovable == false){ payloadTemp.IsRemovable = payload.IsRemovable;
payloadTemp.score = decision_conf.MALICIOUS_VALUE;}}
else if (evidenceInBrief.hasOwnProperty("PayloadRemovalDisallowed")){if (evidenceInBrief.PayloadRemovalDisallowed == 1){ payloadTemp.score = decision_conf.MALICIOUS_VALUE;}}

What We Will Cover• Death Profile Attack Demo
• Sandbox Detection Demo

Thanks very much