Hack, Make & Break
Breaking the Mirror – A Look at Apple’s New iPhone Remote Control Feature
Exploring the security of the new iPhone Mirroring feature as well as the current threat model of the iOS ecosystem
The tight integration between devices is something you only get in Apple’s Continuity ecosystem. It enables seamless interaction between devices, such as using your iPhone as a webcam for your Mac and even letting an iPad act as a second screen with stylus input.
All of this relies on Apple’s Continuity framework, a system that builds on local wireless protocols such as Bluetooth and Wi-Fi to communicate among a user’s devices. The interactions enabled between the devices result in a complex threat model that researchers have started to explore over the past years.
This summer, Apple newly introduced iPhone Mirroring, a feature that allows users to remote control their locked iPhone wirelessly from their Mac, further blurring the security boundaries in the ecosystem.
How does this new feature work? Are the security and privacy checks introduced for iPhone Mirroring sufficient or is it possible to trick the system? What do they protect against and how might this differ from how iOS devices are used in practice? In this talk, you will get demos and explanations of bypasses found in early versions of the iOS 18 beta along with an explanation of why and how they work.
Additional information
| Type | Talk 40 (30min +10 Q&A) |
|---|---|
| Language | English |
More sessions
| 12/27/24 |
A field guide to dumping and reverse engineering a bare-metal U-Boot binary, including all the good stuff like funky hardware setups, UART logs, a locked bootloader and unknown base addresses.
|
| 12/27/24 |
Everyone kind of forgot about DNS. How does it work, how to claim it back and why?
|
| 12/27/24 |
How to remote-control (and build) the weirdest devices with Bluetooth Low Energy and no programming.
|
| 12/28/24 |
In this talk, an advocate of (un)making, Yoshinari Nishiki, dives into the historical foundation of the concept. Starting from the Maker movement, transitioning to Critical Making, evolving into unmaking, and culminating in (un)making, Yoshinari emphasizes a process defined by the deliberate absence of production, where (un)making itself embodies the act of not producing. Unmaking is a newly emerged term in the fields of HCI and design that references the idea of unlearning. In unmaking, ...
|
| 12/28/24 |
In Zeiten, in denen digitale Bildung immer wichtiger wird, bleiben viele Schulen hinter den aktuellen Anforderungen zurück. Ein Ansatz, um das zu ändern, ist der MakerSpace – ein offener Raum, in dem Schüler:innen kreativ arbeiten und selbstständig Projekte umsetzen können. An unserer Schule nutzen wir 3D-Drucker, Lasercutter und andere Technologien, die sowohl für private Projekte als auch im Unterricht eingesetzt werden. Damit haben wir die Möglichkeit, eigene Ideen zu verwirklichen ...
|
| 12/28/24 |
Look behind the scenes with filmmaker, inventor, and former Mythbuster Davis DeWitt and learn how Hollywood hackers combine prototyping and art to bring movie magic to life! Through real-world examples, this talk will explore the unique challenges of creating builds for the entertainment industry, from designing prototypes to filming the final sequence and everything in between.
|
| 12/28/24 |
Im vergangenen Jahr wurden von uns in fünf kritische Schwachstellen in Endpoint Protection Software entdeckt, die es uns ermöglichen, auf Basis von COM-Hijacking unsere Privilegien auf Windows-Endpunkten zu erweitern. In diesem Vortrag demonstrieren wir, wie COM-Hijacking genutzt werden kann, um Code im Kontext geschützter Frontend-Prozesse auszuführen. Zudem zeigen wir auf, wie COM Hijacking das Vertrauensverhältnis zwischen geschützten Frontend-Prozessen und Backend-Diensten aushebelt um ...
|
