Difference between revisions of "SHA-1 Image Segment Overflow"

From The iPhone Wiki
Jump to: navigation, search
m (Compatibility: Consistency please.)
(adding links; more neutral language)
Line 1: Line 1:
'''SHA-1 Image Segment Overflow''' or '''SHAtter''' was an exploit that allowed unsigned code execution from a flaw in the bootrom. It was never used in a public jailbreak due to the exploit used in [[limera1n]] being released first. SHAtter was patched in the [[S5L8940|A5]] devices and therefore, never released.
+
'''SHA-1 Image Segment Overflow''' or '''SHAtter''' was an exploit that allowed unsigned code execution from a flaw in the [[bootrom]]. It was never used in a public jailbreak because the [[limera1n]] exploit got released first. SHAtter was patched in the [[S5L8940|A5]] devices and therefore, never released.
   
 
== Compatibility ==
 
== Compatibility ==
Line 14: Line 14:
   
 
==Background Info==
 
==Background Info==
In April 2010 [[User:pod2g|pod2g]] wrote a USB [[wikipedia:Fuzz testing|fuzzer]] and tested every single [[USB control messages|USB control message]] possible on his [[N72ap|iPod touch 2G]].
+
In April 2010 [[User:pod2g|pod2g]] wrote a USB [[wikipedia:Fuzz testing|fuzzer]] (see also: [[fuzzing]]) and tested every single [[USB control messages|USB control message]] possible on his [[N72ap|iPod touch 2G]].
 
The [[wikipedia:Fuzz testing|fuzzer]] found 2 vulnerabilities:
 
The [[wikipedia:Fuzz testing|fuzzer]] found 2 vulnerabilities:
 
* a heap overflow caused by [[usb_control_msg(0xA1, 1) Exploit‎|usb_control_msg(0xA1, 1)]]
 
* a heap overflow caused by [[usb_control_msg(0xA1, 1) Exploit‎|usb_control_msg(0xA1, 1)]]
Line 24: Line 24:
 
Having a memory dump is really helpful to make exploits and it was also the first time we had this kind of dump. (Previous bootrom exploits like the [[0x24000 Segment Overflow]] were done blind!)
 
Having a memory dump is really helpful to make exploits and it was also the first time we had this kind of dump. (Previous bootrom exploits like the [[0x24000 Segment Overflow]] were done blind!)
   
Also, his first attempts to dump the memory resulted in rebooting the device. Interesting! We'll see after that this reboot is the base of the [[SHA-1 Image Segment Overflow|SHAtter]] exploit.
+
Also, his first attempts to dump the memory resulted in rebooting the device, a very interesting result.
   
Research began to figure out why the device would reboot. [[User:posixninja|posixninja]] found the reason and proposed different ideas to exploit this. He also reversed tons of assembly code of the bootrom in this period, giving a support discussion to the team. We're not talking about days, but months of work. So, major props to [[User:posixninja|posixninja]]: [[SHA-1 Image Segment Overflow|SHAtter]] would not have been possible without the clever vulnerability he found and the research he did on the bootrom.
+
Research began to figure out why the device would reboot. [[User:posixninja|posixninja]] found the reason and proposed different ideas to exploit this. He also reversed tons of assembly code of the bootrom in this period, giving a support discussion to the team. This took months of work.
   
 
In the meanwhile, [[User:pod2g|pod2g]] helped on the USB reversing side and found a way to have more control over the size of the USB packets sent. The finer-grained control of the packet sizes is the key of [[SHA-1 Image Segment Overflow|SHAtter]].
 
In the meanwhile, [[User:pod2g|pod2g]] helped on the USB reversing side and found a way to have more control over the size of the USB packets sent. The finer-grained control of the packet sizes is the key of [[SHA-1 Image Segment Overflow|SHAtter]].

Revision as of 19:16, 17 March 2015

SHA-1 Image Segment Overflow or SHAtter was an exploit that allowed unsigned code execution from a flaw in the bootrom. It was never used in a public jailbreak because the limera1n exploit got released first. SHAtter was patched in the A5 devices and therefore, never released.

Compatibility

SHAtter only works with A4 devices:

Credit

Background Info

In April 2010 pod2g wrote a USB fuzzer (see also: fuzzing) and tested every single USB control message possible on his iPod touch 2G. The fuzzer found 2 vulnerabilities:

The team tested these two vulnerabilities on newer devices (iPhone 3GS, iPod touch 3G, iPad) and both were already fixed by Apple.

posixninja continued the fuzzing on these devices and found that with a particular sequence of USB messages it was possible to dump the BSS+Heap+Stack (on new gens only). Having a memory dump is really helpful to make exploits and it was also the first time we had this kind of dump. (Previous bootrom exploits like the 0x24000 Segment Overflow were done blind!)

Also, his first attempts to dump the memory resulted in rebooting the device, a very interesting result.

Research began to figure out why the device would reboot. posixninja found the reason and proposed different ideas to exploit this. He also reversed tons of assembly code of the bootrom in this period, giving a support discussion to the team. This took months of work.

In the meanwhile, pod2g helped on the USB reversing side and found a way to have more control over the size of the USB packets sent. The finer-grained control of the packet sizes is the key of SHAtter.

posixninja and pod2g worked on exploiting the vulnerability for days. Every attempt was a failure because the idea to attack the stack and bypass the IMG3 control routines was just impossible. It took them weeks to understand why they failed and why they couldn't exploit it this way.

They both gave up in July and focused on other subjects.

Vulnerability

Explanation by p0sixninja at MyGreatFest:

It tricked the bootrom to think the size of the image uploading was larger then what it actually was. Then when it would try to load the image, it would see that it was wrong. Then it would try to wipe out the entire image with all zeros and go past it and start wiping out bootrom.

Exploitation was done by overwriting SHA-1 registers to zeros so then when it went to check images it would copy part of image into memory address zero (where the bootrom is). It would take the image uploaded and copy it over top of the bootrom (which turns out to be writable over the data portion).

References