publication . Preprint . 2016

SandBlaster: Reversing the Apple Sandbox

Deaconescu, Răzvan; Deshotels, Luke; Bucicoiu, Mihai; Enck, William; Davi, Lucas; Sadeghi, Ahmad-Reza;
Open Access English
  • Published: 15 Aug 2016
Abstract
In order to limit the damage of malware on Mac OS X and iOS, Apple uses sandboxing, a kernel-level security layer that provides tight constraints for system calls. Particularly used for Apple iOS, sandboxing prevents apps from executing potentially dangerous actions, by defining rules in a sandbox profile. Investigating Apple's built-in sandbox profiles is difficult as they are compiled and stored in binary format. We present SandBlaster, a software bundle that is able to reverse/decompile Apple binary sandbox profiles to their original human readable SBPL (SandBox Profile Language) format. We use SandBlaster to reverse all built-in Apple iOS binary sandbox prof...
Subjects
ACM Computing Classification System: Software_OPERATINGSYSTEMS
free text keywords: Computer Science - Cryptography and Security, Computer Science - Operating Systems, D.4.6
Download from

[1] ant4g0nist. iOS Shared Cache Extraction to solve "redacted" problem. http:// ant4g0nist.blogspot.ro/2015/04/ios-shared-cache-extraction-to-solve. html. Accessed: 2016-07-04.

[2] Apple. iOS Security Guide. https://www.apple.com/business/docs/iOS_ Security_Guide.pdf. Accessed: 2016-04-11.

[3] Apple Inc. App Sandbox Design Guide. https://developer.apple.com/ library/mac/documentation/Security/Conceptual/AppSandboxDesignGuide/ AboutAppSandbox/AboutAppSandbox.html. Accessed: 2016-07-24.

[4] D. Blazakis. The Apple Sandbox. In In Black Hat DC, 2011.

[5] S. Esser. iOS8 Containers, Sandboxes and Entitlements. http://www.slideshare.net/i0n1c/ ruxcon-2014-stefan-esser-ios8-containers-sandboxes-and-entitlements. Accessed: 2016-04-11.

[6] fG! Apple's Sandbox Guide v1.0. http://reverse.put.as/wp-content/uploads/ 2011/09/Apple-Sandbox-Guide-v1.0.pdf. Accessed: 2016-04-11.

[7] IDC Research, Inc. Smartphone OS Market Share, 2015 Q2. http://www.idc.com/ prodserv/smartphone-os-market-share.jsp. Accessed: 2016-07-24.

[8] C. Miller, D. Blazakis, D. DaiZovi, S. Esser, V. Iozzo, and R.-P. Weinmann. iOS Hacker's Handbook. John Wiley & Sons, 2012.

[9] NowSecure. iOS Kernel Reversing Step by Step. https://www.nowsecure.com/ blog/2014/04/14/ios-kernel-reversing-step-by-step/. Accessed: 2016-07-04.

[10] the iPhone wiki. Firmware Keys. Firmware_Keys. Accessed: 2016-07-04.

Abstract
In order to limit the damage of malware on Mac OS X and iOS, Apple uses sandboxing, a kernel-level security layer that provides tight constraints for system calls. Particularly used for Apple iOS, sandboxing prevents apps from executing potentially dangerous actions, by defining rules in a sandbox profile. Investigating Apple's built-in sandbox profiles is difficult as they are compiled and stored in binary format. We present SandBlaster, a software bundle that is able to reverse/decompile Apple binary sandbox profiles to their original human readable SBPL (SandBox Profile Language) format. We use SandBlaster to reverse all built-in Apple iOS binary sandbox prof...
Subjects
ACM Computing Classification System: Software_OPERATINGSYSTEMS
free text keywords: Computer Science - Cryptography and Security, Computer Science - Operating Systems, D.4.6
Download from

[1] ant4g0nist. iOS Shared Cache Extraction to solve "redacted" problem. http:// ant4g0nist.blogspot.ro/2015/04/ios-shared-cache-extraction-to-solve. html. Accessed: 2016-07-04.

[2] Apple. iOS Security Guide. https://www.apple.com/business/docs/iOS_ Security_Guide.pdf. Accessed: 2016-04-11.

[3] Apple Inc. App Sandbox Design Guide. https://developer.apple.com/ library/mac/documentation/Security/Conceptual/AppSandboxDesignGuide/ AboutAppSandbox/AboutAppSandbox.html. Accessed: 2016-07-24.

[4] D. Blazakis. The Apple Sandbox. In In Black Hat DC, 2011.

[5] S. Esser. iOS8 Containers, Sandboxes and Entitlements. http://www.slideshare.net/i0n1c/ ruxcon-2014-stefan-esser-ios8-containers-sandboxes-and-entitlements. Accessed: 2016-04-11.

[6] fG! Apple's Sandbox Guide v1.0. http://reverse.put.as/wp-content/uploads/ 2011/09/Apple-Sandbox-Guide-v1.0.pdf. Accessed: 2016-04-11.

[7] IDC Research, Inc. Smartphone OS Market Share, 2015 Q2. http://www.idc.com/ prodserv/smartphone-os-market-share.jsp. Accessed: 2016-07-24.

[8] C. Miller, D. Blazakis, D. DaiZovi, S. Esser, V. Iozzo, and R.-P. Weinmann. iOS Hacker's Handbook. John Wiley & Sons, 2012.

[9] NowSecure. iOS Kernel Reversing Step by Step. https://www.nowsecure.com/ blog/2014/04/14/ios-kernel-reversing-step-by-step/. Accessed: 2016-07-04.

[10] the iPhone wiki. Firmware Keys. Firmware_Keys. Accessed: 2016-07-04.

Powered by OpenAIRE Open Research Graph
Any information missing or wrong?Report an Issue