diff --git a/Attack Chain Flow.md b/Attack Chain Flow.md index cf14ff5..817eaf2 100644 --- a/Attack Chain Flow.md +++ b/Attack Chain Flow.md @@ -71,35 +71,15 @@ │ 11 handler locations in BCM4387 firmware confirmed │ │ BT identity spoofed → identityservicesd → SEP signing · no prompt │ └─────────────────────────┬───────────────────────────────────────────────┘ - │ unsigned key operations - ▼ -┌─────────────────────────────────────────────────────────────────────────┐ -│ STAGE 4 — CVE-2026-20700 │ -│ Zombie DSC binary written to Signed System Volume │ -│ /System/Library/Caches/com.apple.dyld/ │ -│ Survives DFU restore · factory reset · OTA update │ -│ iOS 26.3 patch closes write path — does NOT remove existing implants │ -│ iOS 26.3.1: existing implant intact + second instance added │ -└─────────────────────────┬───────────────────────────────────────────────┘ - │ - ▼ -┌─────────────────────────────────────────────────────────────────────────┐ -│ FORENSIC CONFIRMATION │ -│ Canary token xTtC2 — present in AMR payload bitstream │ -│ Canary token xTtC2 — recovered from zombie DSC post DFU-restore │ -│ Same token · both artefacts · delivery chain = persistence implant │ -│ Combined canary MD5: 2482d4bcec039ae7391120253a397746 │ -│ C2: 200.152.70.35:443 · stable across 2 devices / 3 iOS versions │ -└─────────────────────────────────────────────────────────────────────────┘ ``` --- ## Summary -A zero-day, zero-click exploit chain targeting iOS 18.4 and below delivers a malicious AMR audio file via iMessage. The file bypasses BlastDoor through valid container structure — fifty well-formed FT=7 frames pass every structural check while the exploit payload sits in the codec bitstream parameters one layer deeper, which BlastDoor never evaluates. The file triggers CoreAudio heap corruption (CVE-2025-31200) that escalates to kernel execution through AMPDU mishandling in AppleBCMWLAN (CVE-2025-31201). With kernel access, the chain pivots to the Broadcom BCM4387 coexistence SRAM — a hardware memory region that sits outside IOMMU protection on all iPhone 13–16 — injecting HCI commands directly into the Bluetooth controller to spoof device identity and invoke Secure Enclave-backed signing operations without user interaction. A persistent implant is then written to the Signed System Volume and survives all user-accessible remediation paths. +A zero-day, zero-click exploit chain targeting iOS 18.4 and below delivers a malicious AMR audio file via iMessage. The file bypasses BlastDoor through valid container structure — fifty well-formed FT=7 frames pass every structural check while the exploit payload sits in the codec bitstream parameters one layer deeper, which BlastDoor never evaluates. The file triggers CoreAudio heap corruption (CVE-2025-31200) that escalates to kernel execution through AMPDU mishandling in AppleBCMWLAN (CVE-2025-31201). With kernel access, the chain pivots to the Broadcom BCM4387 coexistence SRAM — a hardware memory region that sits outside IOMMU protection on all iPhone 13–16 — injecting HCI commands directly into the Bluetooth controller to spoof device identity and invoke Secure Enclave-backed signing operations without user interaction. -**iOS 18.4.1 patches CVE-2025-31200 and CVE-2025-31201. The BCM4387 coexistence bridge remains unpatched at any iOS version. iOS 26.3 addresses the CVE-2026-20700 write path for new infections but does not remove existing implants.** +**iOS 18.4.1 patches CVE-2025-31200 and CVE-2025-31201. The BCM4387 coexistence bridge remains unpatched at any iOS version.** --- @@ -112,7 +92,6 @@ This enabled: - **Forgery of identity-bound tokens** - **Abuse of end-to-end encryption assumptions** - **Untrusted signing operations using trusted keys** -- **Persistent implant surviving all device restore paths** --- @@ -123,18 +102,15 @@ This enabled: | CVE-2025-31200 CoreAudio | iOS 18.4 and below | iOS 18.4.1 | Patched | | CVE-2025-31201 AppleBCMWLAN | iOS 18.4 and below | iOS 18.4.1 | Patched | | BCM4387 coexistence SRAM | All iPhone 13–16 | No patch | **Unpatched** | -| CVE-2026-20700 SSV persistence | iOS 18.4–26.2 | iOS 26.3 (write path only) | **Existing infections not removed** | --- ## Affected Components - ### Directly Exploited - **`AudioConverterService` (CoreAudio)** — AMR 12.2 decoder heap corruption via illegal bitstream parameters in valid FT=7 frames (CVE-2025-31200). - **`AppleBCMWLAN.dext`** — AMPDU subframe length confusion → kernel R/W via PAC bypass (CVE-2025-31201). - **BCM4387 coexistence SRAM** — Unprotected hardware memory region below IOMMU boundary; HCI command injection without OS intercept. No CVE. Unpatched. - **`CryptoTokenKit` / `identityservicesd`** — Unauthorized signing operations invoked post-pivot via spoofed Bluetooth identity; Secure Enclave-backed keys used without user authorization. -- **SSV / dyld shared cache** — Persistent zombie binary written to hardware-sealed system volume (CVE-2026-20700). ### Collateral / Leveraged Components - **`IMTransferAgent` / `imagent`** — Attachment decryption and materialization; confirms file reached local decoder. @@ -226,8 +202,6 @@ PeerLookup_SwiftData => Good to go, we have it With kernel R/W, the BCM4387 MMIO base is resolved from the AppleBCMWLAN driver mapping. The coexistence SRAM at `0x102000` sits below the IOMMU protection boundary at `0x1173FF` — writes land directly in the Bluetooth controller's operational memory without fault. `HCI_BLE_Set_Coexistence_Parameters` (OCF `0x3C`) injected at payload offset 865 corrupts the coexistence arbiter, spoofs BT device identity, and triggers Auto-Unlock evaluation. The Secure Enclave performs signing without user prompt. -See the ZombieHunter repo at [github.com/JGoyd/ZombieHunter](https://github.com/JGoyd/ZombieHunter) for full implant analysis and detection tooling. - ### Stage 5 — CryptoTokenKit Signing Abuse With spoofed BT identity establishing a trusted peer context, `identityservicesd` invokes CryptoTokenKit signing operations using Secure Enclave-backed keys. No key material is exported — signing authority is abused in place. @@ -239,13 +213,9 @@ CryptoTokenKit operation:2 algo:algid:sign:ECDSA:digest-X962:SHA256 CryptoTokenKit > parsed for identityservicesd ``` -### Stage 6 — SSV Persistence (CVE-2026-20700 bypass) - -Payload written to `/System/Library/Caches/com.apple.dyld/` inside the hardware root-of-trust-sealed Signed System Volume. Survives DFU restore, factory reset, and OTA update. iOS 26.3 closes the write path for new infections — it does not remove existing implants. iOS 26.3.1 observed leaving existing implant intact and adding a second instance. See [ZombieHunter](https://github.com/JGoyd/ZombieHunter) for full implant analysis and detection tooling. - ### Forensic Confirmation — Canary Token Cross-Stage Thread -Canary token `xTtC2` was identified inside the encrypted AMR payload during bitstream analysis. The same token was subsequently recovered from the zombie DSC binary on a fully DFU-restored device. Same token, both artefacts — delivery chain and persistence implant are confirmed as the same operation. The three-token canonical sequence `q9PK|xTtC2|NrER` (encoded beacon `cTlQS3x4VHRDMnxOckVS`) base64-decodes to an 11-byte fragment consistent with a truncated HMAC-SHA1 beacon matching the NSO Pegasus C2 check-in format (`device_id|campaign_id|version`). Combined canary MD5: `2482d4bcec039ae7391120253a397746`. +Canary token `xTtC2` was identified inside the encrypted AMR payload during bitstream analysis. The same token was subsequently recovered from a zombie DSC binary on a fully DFU-restored device. Same token, both artifacts — delivery chain and persistence implant are confirmed as the same operation. The three-token canonical sequence `q9PK|xTtC2|NrER` (encoded beacon `cTlQS3x4VHRDMnxOckVS`) base64-decodes to an 11-byte fragment consistent with a truncated HMAC-SHA1 beacon matching the NSO Pegasus C2 check-in format (`device_id|campaign_id|version`). Combined canary MD5: `2482d4bcec039ae7391120253a397746`. **Shutdown log corroboration** (confirmed infected device — `logarchive/extra/shutdown.0.log`): - `IOMFB_bics_daemon` persisted across two SIGTERM cycles → AGX framebuffer capture hook @@ -273,7 +243,6 @@ Canary token `xTtC2` was identified inside the encrypted AMR payload during bits - **Device impersonation and token forgery** — Legitimate identity tokens and signatures forged across Apple services. - **Service-level authentication undermined** — Identity, messaging, and authentication trust assumptions subverted. - **Zero-click remote compromise** — Full chain triggered without user interaction, no sender trust dependency. -- **Unremovable persistence** — SSV-layer implant survives all user-accessible remediation. Confirmed infected devices have no available clean path. - **Unpatched hardware vector** — BCM4387 coexistence bridge exploitable from kernel context on all iPhone 13–16 regardless of iOS version. - **System stability impact** — PME enforcement failures and SoC stalls observed as collateral. @@ -286,8 +255,6 @@ Canary token `xTtC2` was identified inside the encrypted AMR payload during bits 3. **Extend codec input validation to bitstream parameters.** Legal range enforcement for AMR pitch lag, LSF coefficients, and codebook indices per 3GPP TS 26.090. 4. **Harden AMPDU handling in AppleBCMWLAN.** Validate subframe length fields against allocated buffer size. 5. **Extend BCM4387 IOMMU boundary.** IOMMU protection must cover the coexistence SRAM region (`0x102000`–`0x1173FF`). Requires Broadcom firmware update. -6. **Remediate SSV persistence.** iOS 26.3 closes the write path but does not clean existing infections. Architectural review of SSV write primitives required. -7. **Use ZombieHunter and MVT for device triage.** DFU restore is not sufficient for confirmed infected devices. --- @@ -299,7 +266,6 @@ Canary token `xTtC2` was identified inside the encrypted AMR payload during bits | Re-reported to Apple & US-CERT | Jan 21, 2025 (VRF#25-01-MPVDT) | | Patched (CVE-2025-31200, CVE-2025-31201) | Apr 16, 2025 — iOS 18.4.1 | | CISA KEV listing | Apr 16, 2025 — federal deadline May 8, 2025 | -| Acknowledged SSV persistence (CVE-2026-20700) | Feb 11, 2026 — iOS 26.3 | | BCM4387 submitted to Broadcom PSIRT | Mar 2026 — no CVE, no patch | | Exploit vector confirmed by Apple | Yes — malicious audio file via iMessage | | Exploit type | Zero-day, zero-click, remote |