一种基于Checkm8漏洞的iPhone取证方法研究

doi:10.3969/j.issn.1671-1122.2021.12.007

信息网络安全 ›› 2021, Vol. 21 ›› Issue (12): 44-50.doi: 10.3969/j.issn.1671-1122.2021.12.007

一种基于Checkm8漏洞的iPhone取证方法研究

陈光宣¹, 吴家健¹(), 操丹妮¹, 谢清泉²

1.浙江警察学院基于大数据架构的公安信息化应用公安部重点实验室,杭州 310053
2.苏州龙信信息科技有限公司,苏州 215125

收稿日期:2021-10-10 出版日期:2021-12-10 发布日期:2022-01-11
通讯作者: 吴家健 E-mail:jiajianwuinv@163.com
作者简介:陈光宣（1984—）,男,浙江,副教授,博士,主要研究方向为电子数据取证、大数据、信息安全|吴家健（2001—）,男,浙江,本科,主要研究方向为iOS取证、信息安全|操丹妮（2000—）,女,浙江,本科,主研究方向为iOS取证|谢清泉（1988—）,男,福建,工程师,本科,主要研究方向为电子数据取证
基金资助:
浙江省自然科学基金委员会基础公益研究计划项目(LGF19F020006);国家级大学生创新创业训练计划(202111481006);浙江省大学生科技创新活动计划暨新苗人才计划(2021R422003)

Research on iPhone Forensic Method Based on Checkm8 Vulnerability

CHEN Guangxuan¹, WU Jiajian¹(), CAO Danni¹, XIE Qingquan²

1. Key Laboratory of Public Security Information Application Based on Big-data Architecture, Ministry of Public Security, Zhejiang Police College, Hangzhou 310053, China
2. Suzhou Longxintec Co., Suzhou 215125, China

Received:2021-10-10 Online:2021-12-10 Published:2022-01-11
Contact: WU Jiajian E-mail:jiajianwuinv@163.com

摘要/Abstract

摘要：

Checkm8漏洞是一种基于iPhone手机固件强制升降机模式的硬件漏洞。在电子数据取证工作中,针对未知锁屏密码的iPhone手机检材,文章提出一种利用Checkm8漏洞绕过密码验证提取iPhone手机数据的方法,并通过实验演示了漏洞利用、证据数据挖掘与提取、数据解密分析与证据展示。同时利用堆漏洞对锁屏状态下的iPhone手机进行最高权限提升,获取端口通信权限与数据提取传输权限,解决了密码缺失情况下数据提取问题。

关键词: 电子数据取证, iPhone, Checkm8漏洞, 锁屏密码

Abstract:

The Checkm8 vulnerability is a hardware vulnerability based on the device firmware upgrade(DFU) mode of the iPhone firmware. This paper proposed a method of using Checkm8 vulnerability to bypass password verification to extract iPhone data, and demonstrated the exploitation of the vulnerability, digital data mining and extraction, data decryption analysis and evidence display. At the same time, the heap vulnerabilities were utilized to upgrade the highest authority, obtain the authority of port communication and transmission on the iPhone in the locked state, which could solve the problem of data extraction in the absence of passwords. This method has high practical value for forensic science.

Key words: digital forensics, iPhone, Checkm8 vulnerability, lockdown password

中图分类号:

TP309

陈光宣, 吴家健, 操丹妮, 谢清泉. 一种基于Checkm8漏洞的iPhone取证方法研究[J]. 信息网络安全, 2021, 21(12): 44-50.

CHEN Guangxuan, WU Jiajian, CAO Danni, XIE Qingquan. Research on iPhone Forensic Method Based on Checkm8 Vulnerability[J]. Netinfo Security, 2021, 21(12): 44-50.

图/表 9

表1

图1

图2

图3

图4

图5

表2

表3

图6

参考文献 18

[1]	SPAULDING J, KRAUSS A, SRINIVASAN A. Exploring an Open WiFi Detection Vulnerability as A Malware Attack Vector on iOS Devices[C]// IEEE. 7th International Conference on Malicious and Unwanted Software, October 16-18, 2012, Fajardo, PR, USA. New Jersey: IEEE, 2012: 87-93.
[2]	CHRISTIAN C J D, CHOO K, YANG L Y. Data Exfiltration from Internet of Things Devices: IOS Devices as Case Studies[J]. IEEE Internet of Things Journal, 2016, 4(2):524-535. doi: 10.1109/JIOT.2016.2569094 URL
[3]	CHRISTIAN D O, CHOO K. A Generic Process to Identify Vulnerabilities and Design Weaknesses in iOS Healthcare Apps[C]// IEEE. 48th Annual Hawaii International Conference on System Sciences(HICSS), January 5-8, 2015, Kauai, Hawaii State, USA. New Jersey: IEEE, 2015: 5175-5184.
[4]	LIN Chunhan, YU Fang, JIANG J H R, et al. Static Detection of API Call Vulnerabilities in iOS Executables[C]// IEEE. 40th ACM/IEEE International Conference on Software Engineering(ICSE), May 27-June 3, 2018, Gothenburg, Sweden. New Jersey: IEEE, 2018: 394-395.
[5]	Sxi0mx. EPIC JAILBREAK: Introducing Checkm8[EB/OL]. https://twitter.com/axi0mX/status/1177542201670168576, 2019-09-28.
[6]	TAMMA R, MAHALIK H, SKULKIN O, et al. Practical Mobile Forensics: A Hands-on Guide to Mastering Mobile Forensics for the iOS, Android, and Windows Phone platforms[M]. Birmingham: Packt Publishing, 2018.
[7]	Apple. Glossary[EB/OL]. https://support.apple.com/en-gb/guide/security/sec93292bfa6/web, 2021-09-14.
[8]	GARG S, BALIYAN N. Comparative Analysis of Android and iOS from Security Viewpoint[EB/OL]. https://doi.org/10.1016/j.cosrev.2021.100372, 2021-08-11.
[9]	GUNNAR A, STEFAN A, GEIR O D. Chip Chop-smashing the Mobile Phone Secure Chip for Fun and Digital Forensics[EB/OL]. https://doi.org/10.1016/j.fsidi.2021.301191, 2021-04-14.
[10]	IEEE. 1619-2007-IEEE Standard for Cryptographic Protection of Data on Block-Oriented Storage Devices[EB/OL]. https://ieeexplore.ieee.org/document/4493450, 2008-03-04.
[11]	DING Liping, LIU Xuehua, CHEN Guangxuan, et al. Overview of Digital Forensics Technologies of RAM in Android Devices[J]. Netinfo Security, 2019, 19(2):10-17.
	丁丽萍, 刘雪花, 陈光宣, 等. Android 智能手机动态内存取证技术综述[J]. 信息网络安全, 2019, 19(2):10-17.
[12]	KIPERBERG M, LEON R, RESH A, et al. Hypervisor-assisted Atomic Memory Acquisition in Modern Systems[C]// IEEE. 5th International Conference on Information Systems Security and Privacy(ICISSP), February 23-25, 2019, Prague, Czech Republic. New Jersey: IEEE, 2019: 155-162.
[13]	LIU Pengfei. The Analyses and Prevention of Attact Methods of iOS Applications[D]. Chengdu: University of Electronic Science and Technology of China, 2014.
	刘朋飞. iOS应用程序的攻击手段分析及防护[D]. 成都:电子科技大学, 2014.
[14]	XU Xin, ZHANG Songnian, HU Jianwei. Research on ASLR Bypass Technology Based on Arbitrary Function Address[J]. Netinfo Securtiy, 2016, 16(7):47-52.
	徐鑫, 张松年, 胡建伟. 基于任意函数地址的ASLR绕过技术研究[J]. 信息网络安全, 2016, 16(7):47-52.
[15]	GAO Qiang. A First Look at the Encryption Techniques Commonly Used in iOS Development[J]. Computer Knowledge and Technology, 2021, 17(10):51-53.
	高强. iOS开发过程中常用的加密技术初探[J]. 电脑知识与技术, 2021, 17(10):51-53.
[16]	DEMPSEY P. The Teardown-apple iPhone X[J]. Engineering & Technology, 2018, 1(13):80-81.
[17]	KO H J, HUANG Chengta, ZHUANG Zhiwei. et al. Cloud Evidence Tracks of Storage Service Linking with iOS Systems[J]. Journal of Supercomputing, 2021, 77(1):77-94. doi: 10.1007/s11227-020-03255-5 URL
[18]	LIU Feng, LIU Kesheng, CHANG Chao, et al. Research on the Technology of iOS Jailbreak[C]// IEEE. 6th International Conference on Instrumentation and Measurement, Computer, Communication and Control(IMCCC), July 21-23, 2016, Harbin, China. New Jersey: IEEE, 2016: 644-647.

序号	数据保护方法	说明
1	密码保护机制	包括数字字母密码、指纹密码、脸部认证
2	沙箱运行模式	限制应用访问其他资源
3	文件系统加密	使用硬件密钥进行加密
4	数据保护机制	使用强密钥二次加密,防止设备锁定时的数据访问
5	内存地址空间布局随机化	随机化对象在内存中的位置
6	权限控制	用户只能使用低权限进行操作
7	栈保护	防止栈溢出攻击
8	数据执行限制	通过区分代码和数据减少攻击
9	数据擦除	通过数据加密密钥的擦除完成
10	激活锁	调用高权限的身份认证
11	安全启动链	基于机器公钥的设备启动机制

	检材信息		提取信息
	iPhone 5s	iPhone SE	Linux	MacOS X
系统版本	iOS 12.4	iOS 14.2	Ubuntu 20.04	MacOS 10.16
checkra1n版本	/	/	0.9.7	0.12.2
libimobiledevice	/	/	apt-get安装	brew安装
SSH工具	/	/	SSHPASS	usbmuxd
提取前状态	未越狱	未越狱	root	root
root密码	alpine	alpine	用户自定义	用户自定义
芯片信息	A7	A9	Inter i7-9750H	Inter Core i5
内存信息	2 GB	2 GB	32 GB	8 GB

内容	iPhone SE检材结果	iPhone 5s检材结果
Chip UniqueID	7105110176120	6276159644976
BasebandCertld	3840149528	3554301762
UniqueDevicelD	f69aad5a72222285e50cd64cb9860cfc6b88c904	9006aa682a8f1e59829e6985df4a0d8d54047b20
WiFiAddress	98:9e:63:51:db:d7	24:e3:14:36:b3:29
系统版本	14.2	12.4
设备名称	测试机	iPhone
提取速度	4375.1 kbps	4643 kbps

一种基于Checkm8漏洞的iPhone取证方法研究

Research on iPhone Forensic Method Based on Checkm8 Vulnerability

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 9

参考文献 18

相关文章 11

编辑推荐

Metrics

本文评价

[1]	倪雪莉, 王群, 梁广俊. 微信证据的鉴真方法研究[J]. 信息网络安全, 2021, 21(12): 60-69.
[2]	丁丽萍, 刘雪花, 陈光宣, 李引. Android智能手机动态内存取证技术综述[J]. 信息网络安全, 2019, 19(2): 10-17.
[3]	刘浩阳. MS SQL数据库在线取证研究[J]. 信息网络安全, 2016, 16(9): 26-30.
[4]	韩马剑. 路由器取证研究[J]. 信息网络安全, 2016, 16(9): 51-55.
[5]	刘浩阳. Android设备取证研究[J]. 信息网络安全, 2015, 15(9): 29-32.
[6]	罗文华, 沈成轩. 利用KPCR结构获取内存敏感信息[J]. 信息网络安全, 2015, 15(3): 44-47.
[7]	刘浩阳. iOS设备取证技术[J]. 信息网络安全, 2014, 14(9): 167-170.
[8]	. 基于虚拟机与API调用监控技术的APT木马取证研究[J]. , 2014, 14(4): 78-.
[9]	刘琼;叶猛. 基于SQLite的iPhone数据恢复方法研究[J]. , 2013, 13(11): 0-0.
[10]	贺滢睿;陆道宏;李建新;徐云峰. 面向iPhone手机的电子数据取证分析[J]. , 2013, 13(10): 0-0.
[11]	邹荣兴. iPhone手机安全技术分析[J]. , 2012, 12(2): 0-0.