SHA-1 Image Segment Overflow - Revision history

InvoxiPlayGames at 15:14, 25 October 2021

2021-10-25T15:14:23Z

IAdam1n at 13:01, 17 September 2021

2021-09-17T13:01:50Z

Spydar007 at 09:37, 26 March 2017

2017-03-26T09:37:16Z

Dialexio: Language adjustments.

2015-11-23T21:49:10Z

Language adjustments.

IAdam1n: Updating

2015-10-11T09:34:58Z

Updating

Britta: adding links; more neutral language

2015-03-17T19:16:49Z

adding links; more neutral language

IAdam1n: /* Compatibility */ Consistency please.

2014-10-18T18:00:02Z

‎Compatibility: Consistency please.

Aker: /* Compatibility */

2014-07-19T19:11:18Z

‎Compatibility

Aker: Added Reference

2014-05-14T12:44:57Z

Added Reference

IAdam1n: /* Background Info */

2013-09-25T21:18:01Z

‎Background Info

← Older revision		Revision as of 15:14, 25 October 2021
Line 1:		Line 1:
−	'''SHA-1 Image Segment Overflow''' or '''SHAtter''' was an exploit that allowed unsigned code execution from a flaw in the [[bootrom]]. It was never used in a public jailbreak because the [[limera1n]] exploit was released first, and more devices were vulnerable to it. SHAtter was patched in the [[S5L8940\|A5]] bootrom and therefore, never ~~publicly~~ released.	+	'''SHA-1 Image Segment Overflow''' or '''SHAtter''' was an exploit that allowed unsigned code execution from a flaw in the [[bootrom]]. It was never used in a public jailbreak because the [[limera1n]] exploit was released first, and more devices were vulnerable to it. SHAtter was patched in the [[S5L8940\|A5]] bootrom and therefore, never officially released.
		+
		+	An implementation of SHAtter is available in [[ipwndfu]].

	== Compatibility ==		== Compatibility ==

@@ Line 9: / Line 9: @@
 == Credit ==
-* '''vulnerability''': [[User:posixninja|posixninja]] (7 May 2010), also discovered independently by [[User:geohot|geohot]]
+* '''vulnerability''': [[User:posixninja|posixninja]] ({{date|2010|05}}), also discovered independently by [[User:geohot|geohot]]
 * '''research''': [[User:posixninja|posixninja]], [[User:pod2g|pod2g]], also [[User:MuscleNerd|MuscleNerd]]
 * '''exploit''': [[User:Pod2g|pod2g]]
 ==Background Info==
-In April 2010 [[User:pod2g|pod2g]] wrote a USB [[wikipedia:Fuzz testing|fuzzer]] (see also: [[fuzzing]]) and tested every single [[USB control messages|USB control message]] possible on his [[N72AP|iPod touch (2nd generation)]].
+In {{date|2010|04}} [[User:pod2g|pod2g]] wrote a USB [[wikipedia:Fuzz testing|fuzzer]] (see also: [[fuzzing]]) and tested every single [[USB control messages|USB control message]] possible on his [[N72AP|iPod touch (2nd generation)]].
 The [[wikipedia:Fuzz testing|fuzzer]] found 2 vulnerabilities:
 * a heap overflow caused by [[usb_control_msg(0xA1, 1) Exploit‎|usb_control_msg(0xA1, 1)]]
@@ Line 29: / Line 29: @@
 [[User:posixninja|posixninja]] and [[User:pod2g|pod2g]] worked on exploiting the vulnerability for days. Every attempt was a failure because the idea to attack the stack and bypass the [[IMG3 File Format|IMG3]] control routines was just impossible. It took them weeks to understand why they failed and why they couldn't exploit it this way.
-They both gave up in July and focused on other subjects.
+They both gave up in {{date|2010|07}} and focused on other subjects.
 == Vulnerability ==

@@ Line 5: / Line 5: @@
 * [[K48AP|iPad]]
 * [[iPhone 4]] (all models)
-* [[N81AP|iPod touch 4G]]
+* [[N81AP|iPod touch (4th generation)]]
-* [[K66AP|Apple TV 2G]]
+* [[K66AP|Apple TV (2nd generation)]]
 == Credit ==
@@ Line 14: / Line 14: @@
 ==Background Info==
-In April 2010 [[User:pod2g|pod2g]] wrote a USB [[wikipedia:Fuzz testing|fuzzer]] (see also: [[fuzzing]]) and tested every single [[USB control messages|USB control message]] possible on his [[N72AP|iPod touch 2G]].
+In April 2010 [[User:pod2g|pod2g]] wrote a USB [[wikipedia:Fuzz testing|fuzzer]] (see also: [[fuzzing]]) and tested every single [[USB control messages|USB control message]] possible on his [[N72AP|iPod touch (2nd generation)]].
 The [[wikipedia:Fuzz testing|fuzzer]] found 2 vulnerabilities:
 * a heap overflow caused by [[usb_control_msg(0xA1, 1) Exploit‎|usb_control_msg(0xA1, 1)]]
 * a way to dump the bootrom using USB descriptors request
-The team tested these two vulnerabilities on newer devices ([[N88AP|iPhone 3GS]], [[N18AP|iPod touch 3G]], [[K48AP|iPad]]) and both were already fixed by Apple.
+The team tested these two vulnerabilities on newer devices ([[N88AP|iPhone 3GS]], [[N18AP|iPod touch (3rd generation)]], [[K48AP|iPad]]) and both were already fixed by Apple.
 [[User:posixninja|posixninja]] continued [[wikipedia:Fuzz testing|fuzzing]] on these devices, and found that with a particular sequence of [[USB control messages]], it was possible for the first time to dump the [[wikipedia:.bss|BSS]]+Heap+Stack (on newer devices only).

@@ Line 1: / Line 1: @@
-'''SHA-1 Image Segment Overflow''' or '''SHAtter''' was an exploit that allowed unsigned code execution from a flaw in the [[bootrom]]. It was never used in a public jailbreak because the [[limera1n]] exploit got released first. SHAtter was patched in the [[S5L8940|A5]] devices and therefore, never released.
+'''SHA-1 Image Segment Overflow''' or '''SHAtter''' was an exploit that allowed unsigned code execution from a flaw in the [[bootrom]]. It was never used in a public jailbreak because the [[limera1n]] exploit was released first, and more devices were vulnerable to it. SHAtter was patched in the [[S5L8940|A5]] bootrom and therefore, never publicly released.
 == Compatibility ==
@@ Line 21: / Line 21: @@
 The team tested these two vulnerabilities on newer devices ([[N88AP|iPhone 3GS]], [[N18AP|iPod touch 3G]], [[K48AP|iPad]]) and both were already fixed by Apple.
-[[User:posixninja|posixninja]] continued the [[wikipedia:Fuzz testing|fuzzing]] on these devices and found that with a particular sequence of [[USB control messages|USB messages]] it was possible to dump the [[wikipedia:.bss|BSS]]+Heap+Stack (on new gens only).
+[[User:posixninja|posixninja]] continued [[wikipedia:Fuzz testing|fuzzing]] on these devices, and found that with a particular sequence of [[USB control messages]], it was possible for the first time to dump the [[wikipedia:.bss|BSS]]+Heap+Stack (on newer devices only).
-Also, his first attempts to dump the memory resulted in rebooting the device, a very interesting result.
+Interestingly, his first attempts to dump the memory resulted in rebooting the device. Research began to figure out why the device would reboot. [[User:posixninja|posixninja]] found the reason and proposed different ideas to exploit this. He also reversed tons of assembly code of the bootrom in this period, giving a support discussion to the team. This took months of work.
 [[User:posixninja|posixninja]] and [[User:pod2g|pod2g]] worked on exploiting the vulnerability for days. Every attempt was a failure because the idea to attack the stack and bypass the [[IMG3 File Format|IMG3]] control routines was just impossible. It took them weeks to understand why they failed and why they couldn't exploit it this way.
@@ Line 37: / Line 34: @@
 Explanation by [[p0sixninja]] at [[MyGreatFest]]:
-It tricked the bootrom to think the size of the image uploading was larger then what it actually was. Then when it would try to load the image, it would see that it was wrong. Then it would try to wipe out the entire image with all zeros and go past it and start wiping out bootrom.
+:It tricked the bootrom to think the size of the image uploading was larger then what it actually was. Then when it would try to load the image, it would see that it was wrong. Then it would try to wipe out the entire image with all zeroes and go past it and start wiping out bootrom.
-Exploitation was done by overwriting SHA-1 registers to zeros so then when it went to check images it would copy part of image into memory address zero (where the bootrom is). It would take the image uploaded and copy it over top of the bootrom (which turns out to be writable over the data portion).
+:Exploitation was done by overwriting SHA-1 registers to zeroes so then when it went to check images it would copy part of image into memory address zero (where the bootrom is). It would take the image uploaded and copy it over top of the bootrom (which turns out to be writable over the data portion).
 == References ==

@@ Line 3: / Line 3: @@
 == Compatibility ==
 SHAtter only works with [[S5L8930|A4]] devices:
-* [[k48ap|iPad]]
+* [[K48AP|iPad]]
 * [[iPhone 4]] (all models)
-* [[n81ap|iPod touch 4G]]
+* [[N81AP|iPod touch 4G]]
-* [[k66ap|Apple TV 2G]]
+* [[K66AP|Apple TV 2G]]
 == Credit ==
@@ Line 14: / Line 14: @@
 ==Background Info==
-In April 2010 [[User:pod2g|pod2g]] wrote a USB [[wikipedia:Fuzz testing|fuzzer]] (see also: [[fuzzing]]) and tested every single [[USB control messages|USB control message]] possible on his [[N72ap|iPod touch 2G]].
+In April 2010 [[User:pod2g|pod2g]] wrote a USB [[wikipedia:Fuzz testing|fuzzer]] (see also: [[fuzzing]]) and tested every single [[USB control messages|USB control message]] possible on his [[N72AP|iPod touch 2G]].
 The [[wikipedia:Fuzz testing|fuzzer]] found 2 vulnerabilities:
 * a heap overflow caused by [[usb_control_msg(0xA1, 1) Exploit‎|usb_control_msg(0xA1, 1)]]
 * a way to dump the bootrom using USB descriptors request
-The team tested these two vulnerabilities on newer devices ([[N88ap|iPhone 3GS]], [[N18ap|iPod touch 3G]], [[K48ap|iPad]]) and both were already fixed by Apple.
+The team tested these two vulnerabilities on newer devices ([[N88AP|iPhone 3GS]], [[N18AP|iPod touch 3G]], [[K48AP|iPad]]) and both were already fixed by Apple.
 [[User:posixninja|posixninja]] continued the [[wikipedia:Fuzz testing|fuzzing]] on these devices and found that with a particular sequence of [[USB control messages|USB messages]] it was possible to dump the [[wikipedia:.bss|BSS]]+Heap+Stack (on new gens only).

← Older revision		Revision as of 12:44, 14 May 2014
Line 40:		Line 40:

	Exploitation was done by overwriting SHA-1 registers to zeros so then when it went to check images it would copy part of image into memory address zero (where the bootrom is). It would take the image uploaded and copy it over top of the bootrom (which turns out to be writable over the data portion).		Exploitation was done by overwriting SHA-1 registers to zeros so then when it went to check images it would copy part of image into memory address zero (where the bootrom is). It would take the image uploaded and copy it over top of the bootrom (which turns out to be writable over the data portion).
		+
		+	== References ==
		+	* [[p0sixninja]]'s [http://conference.hitb.org/hitbsecconf2013kul/materials/D2T1%20-%20Joshua%20%27p0sixninja%27%20Hill%20-%20SHAttered%20Dreams.pdf HITB 2013 Kuala Lumpur presentation] (SHAttered Dreams - Adventures in BootROM Land; starting at page 51)

	[[Category:Bootrom Exploits]]		[[Category:Bootrom Exploits]]

@@ Line 30: / Line 30: @@
 In the meanwhile, [[User:pod2g|pod2g]] helped on the USB reversing side and found a way to have more control over the size of the USB packets sent. The finer-grained control of the packet sizes is the key of [[SHA-1 Image Segment Overflow|SHAtter]].
-[[User:posixninja|posixninja]] and [[User:pod2g|pod2g]] worked on exploiting the vulnerability for days. Every attempt was a failure because the idea to attack the stack and bypass the [[IMG File Format|IMG3]] control routines was just impossible. It took them weeks to understand why they failed and why they couldn't exploit it this way.
+[[User:posixninja|posixninja]] and [[User:pod2g|pod2g]] worked on exploiting the vulnerability for days. Every attempt was a failure because the idea to attack the stack and bypass the [[IMG3 File Format|IMG3]] control routines was just impossible. It took them weeks to understand why they failed and why they couldn't exploit it this way.
 They both gave up in July and focused on other subjects.