Netinfo Security ›› 2021, Vol. 21 ›› Issue (12): 44-50.doi: 10.3969/j.issn.1671-1122.2021.12.007

Previous Articles     Next Articles

Research on iPhone Forensic Method Based on Checkm8 Vulnerability

CHEN Guangxuan1, WU Jiajian1(), CAO Danni1, XIE Qingquan2   

  1. 1. Key Laboratory of Public Security Information Application Based on Big-data Architecture, Ministry of Public Security, Zhejiang Police College, Hangzhou 310053, China
    2. Suzhou Longxintec Co., Suzhou 215125, China
  • Received:2021-10-10 Online:2021-12-10 Published:2022-01-11
  • Contact: WU Jiajian E-mail:jiajianwuinv@163.com

Abstract:

The Checkm8 vulnerability is a hardware vulnerability based on the device firmware upgrade(DFU) mode of the iPhone firmware. This paper proposed a method of using Checkm8 vulnerability to bypass password verification to extract iPhone data, and demonstrated the exploitation of the vulnerability, digital data mining and extraction, data decryption analysis and evidence display. At the same time, the heap vulnerabilities were utilized to upgrade the highest authority, obtain the authority of port communication and transmission on the iPhone in the locked state, which could solve the problem of data extraction in the absence of passwords. This method has high practical value for forensic science.

Key words: digital forensics, iPhone, Checkm8 vulnerability, lockdown password

CLC Number: