Type of Publication: Article in Collected Edition

SandScout: Automatic Detection of Flaws in iOS Sandbox Profiles

Author(s):

Deshotels, Luke; Deaconescu, Razvan; Chiroiu, Mihai; Davi, Lucas; Enck, William; Sadeghi, Ahmad-Reza

Title of Anthology:

Proc. of 23rd ACM Conference on Computer and Communications Security (CCS)

Publication Date:

2016

Digital Object Identifier (DOI):

doi:10.1145/2976749.2978336

Link to complete version:

https://dl.acm.org/authorize?N27212

Citation:

Download BibTeX

Abstract

Recent literature on iOS security has focused on the malicious potential of third-party applications, demonstrating how developers can bypass application vetting and code-level protections. In addition to these protections, iOS uses a generic sandbox profile called "container" to confine malicious or exploited third-party applications. In this paper, we present the first systematic analysis of the iOS container sandbox profile. We propose the SandScout framework to extract, decompile, formally model, and analyze iOS sandbox profiles as logic-based programs. We use our Prolog-based queries to evaluate file-based security properties of the container sandbox profile for iOS 9.0.2 and discover seven classes of exploitable vulnerabilities. These attacks affect non-jailbroken devices running later versions of iOS. We are working with Apple to resolve these attacks, and we expect that SandScout will play a significant role in the development of sandbox profiles for future versions of iOS.