mirror of
https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201.git
synced 2026-08-28 13:00:24 +02:00
Update Attack Chain Flow.md
This commit is contained in:
Joseph Goydish II
+3
-37
@@ -71,35 +71,15 @@
|
||||
│ 11 handler locations in BCM4387 firmware confirmed │
|
||||
│ BT identity spoofed → identityservicesd → SEP signing · no prompt │
|
||||
└─────────────────────────┬───────────────────────────────────────────────┘
|
||||
│ unsigned key operations
|
||||
▼
|
||||
┌─────────────────────────────────────────────────────────────────────────┐
|
||||
│ STAGE 4 — CVE-2026-20700 │
|
||||
│ Zombie DSC binary written to Signed System Volume │
|
||||
│ /System/Library/Caches/com.apple.dyld/ │
|
||||
│ Survives DFU restore · factory reset · OTA update │
|
||||
│ iOS 26.3 patch closes write path — does NOT remove existing implants │
|
||||
│ iOS 26.3.1: existing implant intact + second instance added │
|
||||
└─────────────────────────┬───────────────────────────────────────────────┘
|
||||
│
|
||||
▼
|
||||
┌─────────────────────────────────────────────────────────────────────────┐
|
||||
│ FORENSIC CONFIRMATION │
|
||||
│ Canary token xTtC2 — present in AMR payload bitstream │
|
||||
│ Canary token xTtC2 — recovered from zombie DSC post DFU-restore │
|
||||
│ Same token · both artefacts · delivery chain = persistence implant │
|
||||
│ Combined canary MD5: 2482d4bcec039ae7391120253a397746 │
|
||||
│ C2: 200.152.70.35:443 · stable across 2 devices / 3 iOS versions │
|
||||
└─────────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
A zero-day, zero-click exploit chain targeting iOS 18.4 and below delivers a malicious AMR audio file via iMessage. The file bypasses BlastDoor through valid container structure — fifty well-formed FT=7 frames pass every structural check while the exploit payload sits in the codec bitstream parameters one layer deeper, which BlastDoor never evaluates. The file triggers CoreAudio heap corruption (CVE-2025-31200) that escalates to kernel execution through AMPDU mishandling in AppleBCMWLAN (CVE-2025-31201). With kernel access, the chain pivots to the Broadcom BCM4387 coexistence SRAM — a hardware memory region that sits outside IOMMU protection on all iPhone 13–16 — injecting HCI commands directly into the Bluetooth controller to spoof device identity and invoke Secure Enclave-backed signing operations without user interaction. A persistent implant is then written to the Signed System Volume and survives all user-accessible remediation paths.
|
||||
A zero-day, zero-click exploit chain targeting iOS 18.4 and below delivers a malicious AMR audio file via iMessage. The file bypasses BlastDoor through valid container structure — fifty well-formed FT=7 frames pass every structural check while the exploit payload sits in the codec bitstream parameters one layer deeper, which BlastDoor never evaluates. The file triggers CoreAudio heap corruption (CVE-2025-31200) that escalates to kernel execution through AMPDU mishandling in AppleBCMWLAN (CVE-2025-31201). With kernel access, the chain pivots to the Broadcom BCM4387 coexistence SRAM — a hardware memory region that sits outside IOMMU protection on all iPhone 13–16 — injecting HCI commands directly into the Bluetooth controller to spoof device identity and invoke Secure Enclave-backed signing operations without user interaction.
|
||||
|
||||
**iOS 18.4.1 patches CVE-2025-31200 and CVE-2025-31201. The BCM4387 coexistence bridge remains unpatched at any iOS version. iOS 26.3 addresses the CVE-2026-20700 write path for new infections but does not remove existing implants.**
|
||||
**iOS 18.4.1 patches CVE-2025-31200 and CVE-2025-31201. The BCM4387 coexistence bridge remains unpatched at any iOS version.**
|
||||
|
||||
---
|
||||
|
||||
@@ -112,7 +92,6 @@ This enabled:
|
||||
- **Forgery of identity-bound tokens**
|
||||
- **Abuse of end-to-end encryption assumptions**
|
||||
- **Untrusted signing operations using trusted keys**
|
||||
- **Persistent implant surviving all device restore paths**
|
||||
|
||||
---
|
||||
|
||||
@@ -123,18 +102,15 @@ This enabled:
|
||||
| CVE-2025-31200 CoreAudio | iOS 18.4 and below | iOS 18.4.1 | Patched |
|
||||
| CVE-2025-31201 AppleBCMWLAN | iOS 18.4 and below | iOS 18.4.1 | Patched |
|
||||
| BCM4387 coexistence SRAM | All iPhone 13–16 | No patch | **Unpatched** |
|
||||
| CVE-2026-20700 SSV persistence | iOS 18.4–26.2 | iOS 26.3 (write path only) | **Existing infections not removed** |
|
||||
|
||||
---
|
||||
|
||||
## Affected Components
|
||||
|
||||
### Directly Exploited
|
||||
- **`AudioConverterService` (CoreAudio)** — AMR 12.2 decoder heap corruption via illegal bitstream parameters in valid FT=7 frames (CVE-2025-31200).
|
||||
- **`AppleBCMWLAN.dext`** — AMPDU subframe length confusion → kernel R/W via PAC bypass (CVE-2025-31201).
|
||||
- **BCM4387 coexistence SRAM** — Unprotected hardware memory region below IOMMU boundary; HCI command injection without OS intercept. No CVE. Unpatched.
|
||||
- **`CryptoTokenKit` / `identityservicesd`** — Unauthorized signing operations invoked post-pivot via spoofed Bluetooth identity; Secure Enclave-backed keys used without user authorization.
|
||||
- **SSV / dyld shared cache** — Persistent zombie binary written to hardware-sealed system volume (CVE-2026-20700).
|
||||
|
||||
### Collateral / Leveraged Components
|
||||
- **`IMTransferAgent` / `imagent`** — Attachment decryption and materialization; confirms file reached local decoder.
|
||||
@@ -226,8 +202,6 @@ PeerLookup_SwiftData => Good to go, we have it
|
||||
|
||||
With kernel R/W, the BCM4387 MMIO base is resolved from the AppleBCMWLAN driver mapping. The coexistence SRAM at `0x102000` sits below the IOMMU protection boundary at `0x1173FF` — writes land directly in the Bluetooth controller's operational memory without fault. `HCI_BLE_Set_Coexistence_Parameters` (OCF `0x3C`) injected at payload offset 865 corrupts the coexistence arbiter, spoofs BT device identity, and triggers Auto-Unlock evaluation. The Secure Enclave performs signing without user prompt.
|
||||
|
||||
See the ZombieHunter repo at [github.com/JGoyd/ZombieHunter](https://github.com/JGoyd/ZombieHunter) for full implant analysis and detection tooling.
|
||||
|
||||
### Stage 5 — CryptoTokenKit Signing Abuse
|
||||
|
||||
With spoofed BT identity establishing a trusted peer context, `identityservicesd` invokes CryptoTokenKit signing operations using Secure Enclave-backed keys. No key material is exported — signing authority is abused in place.
|
||||
@@ -239,13 +213,9 @@ CryptoTokenKit operation:2 algo:algid:sign:ECDSA:digest-X962:SHA256
|
||||
CryptoTokenKit <sepk:p256(d) kid=<KID>> parsed for identityservicesd
|
||||
```
|
||||
|
||||
### Stage 6 — SSV Persistence (CVE-2026-20700 bypass)
|
||||
|
||||
Payload written to `/System/Library/Caches/com.apple.dyld/` inside the hardware root-of-trust-sealed Signed System Volume. Survives DFU restore, factory reset, and OTA update. iOS 26.3 closes the write path for new infections — it does not remove existing implants. iOS 26.3.1 observed leaving existing implant intact and adding a second instance. See [ZombieHunter](https://github.com/JGoyd/ZombieHunter) for full implant analysis and detection tooling.
|
||||
|
||||
### Forensic Confirmation — Canary Token Cross-Stage Thread
|
||||
|
||||
Canary token `xTtC2` was identified inside the encrypted AMR payload during bitstream analysis. The same token was subsequently recovered from the zombie DSC binary on a fully DFU-restored device. Same token, both artefacts — delivery chain and persistence implant are confirmed as the same operation. The three-token canonical sequence `q9PK|xTtC2|NrER` (encoded beacon `cTlQS3x4VHRDMnxOckVS`) base64-decodes to an 11-byte fragment consistent with a truncated HMAC-SHA1 beacon matching the NSO Pegasus C2 check-in format (`device_id|campaign_id|version`). Combined canary MD5: `2482d4bcec039ae7391120253a397746`.
|
||||
Canary token `xTtC2` was identified inside the encrypted AMR payload during bitstream analysis. The same token was subsequently recovered from a zombie DSC binary on a fully DFU-restored device. Same token, both artifacts — delivery chain and persistence implant are confirmed as the same operation. The three-token canonical sequence `q9PK|xTtC2|NrER` (encoded beacon `cTlQS3x4VHRDMnxOckVS`) base64-decodes to an 11-byte fragment consistent with a truncated HMAC-SHA1 beacon matching the NSO Pegasus C2 check-in format (`device_id|campaign_id|version`). Combined canary MD5: `2482d4bcec039ae7391120253a397746`.
|
||||
|
||||
**Shutdown log corroboration** (confirmed infected device — `logarchive/extra/shutdown.0.log`):
|
||||
- `IOMFB_bics_daemon` persisted across two SIGTERM cycles → AGX framebuffer capture hook
|
||||
@@ -273,7 +243,6 @@ Canary token `xTtC2` was identified inside the encrypted AMR payload during bits
|
||||
- **Device impersonation and token forgery** — Legitimate identity tokens and signatures forged across Apple services.
|
||||
- **Service-level authentication undermined** — Identity, messaging, and authentication trust assumptions subverted.
|
||||
- **Zero-click remote compromise** — Full chain triggered without user interaction, no sender trust dependency.
|
||||
- **Unremovable persistence** — SSV-layer implant survives all user-accessible remediation. Confirmed infected devices have no available clean path.
|
||||
- **Unpatched hardware vector** — BCM4387 coexistence bridge exploitable from kernel context on all iPhone 13–16 regardless of iOS version.
|
||||
- **System stability impact** — PME enforcement failures and SoC stalls observed as collateral.
|
||||
|
||||
@@ -286,8 +255,6 @@ Canary token `xTtC2` was identified inside the encrypted AMR payload during bits
|
||||
3. **Extend codec input validation to bitstream parameters.** Legal range enforcement for AMR pitch lag, LSF coefficients, and codebook indices per 3GPP TS 26.090.
|
||||
4. **Harden AMPDU handling in AppleBCMWLAN.** Validate subframe length fields against allocated buffer size.
|
||||
5. **Extend BCM4387 IOMMU boundary.** IOMMU protection must cover the coexistence SRAM region (`0x102000`–`0x1173FF`). Requires Broadcom firmware update.
|
||||
6. **Remediate SSV persistence.** iOS 26.3 closes the write path but does not clean existing infections. Architectural review of SSV write primitives required.
|
||||
7. **Use ZombieHunter and MVT for device triage.** DFU restore is not sufficient for confirmed infected devices.
|
||||
|
||||
---
|
||||
|
||||
@@ -299,7 +266,6 @@ Canary token `xTtC2` was identified inside the encrypted AMR payload during bits
|
||||
| Re-reported to Apple & US-CERT | Jan 21, 2025 (VRF#25-01-MPVDT) |
|
||||
| Patched (CVE-2025-31200, CVE-2025-31201) | Apr 16, 2025 — iOS 18.4.1 |
|
||||
| CISA KEV listing | Apr 16, 2025 — federal deadline May 8, 2025 |
|
||||
| Acknowledged SSV persistence (CVE-2026-20700) | Feb 11, 2026 — iOS 26.3 |
|
||||
| BCM4387 submitted to Broadcom PSIRT | Mar 2026 — no CVE, no patch |
|
||||
| Exploit vector confirmed by Apple | Yes — malicious audio file via iMessage |
|
||||
| Exploit type | Zero-day, zero-click, remote |
|
||||
|
||||
Reference in New Issue
Block a user