发帖
扫码访问
 注册
 登录
首页 ›资讯› 安全 › 查看内容

独家探寻阿里安全潘多拉实验室，完美越狱苹果iOS11.2.1

2017-12-17 00:26 |来自: 互联网 7215 0

摘要: 知道如何从攻击的视角去发现漏洞，才能建立更安全的体系，促进了整个生态的良性发展。以阿里安全潘多拉实验室为例，在对移动系统安全研究的过程中，把研究过程中发现的问题上报给厂商，促进系统安全性的提升。研究员 ...

知道如何从攻击的视角去发现漏洞，才能建立更安全的体系，促进了整个生态的良性发展。以阿里安全潘多拉实验室为例，在对移动系统安全研究的过程中，把研究过程中发现的问题上报给厂商，促进系统安全性的提升。

研究员：龙磊

小编第一时间深度探访阿里安全潘多拉实验室，采访了此次攻破苹果iOS11.2.1的重要成员之一龙磊，他本人就已向苹果报告了7个安全漏洞，并获得厂商的认可和致谢。

据了解，iOS系统的每一次升级都有可能引入新的安全缓解技术，修补一些未经公开的漏洞，这会加大漏洞利用的难度，所以每一次升级都会给安全研究人员提出新的挑战。

为了能够在最短时间内完成对最新版本的越狱工作，安全研究人员不仅要能挖掘出可以独立提权的漏洞，还要有不一样的思路，以免手上的漏洞和其他人撞车，或者是被Apple意外补上。

“越狱是一件非常具有技术挑战性的工作，也是每个iOS安全研究者都想去攀登的一个高峰。”龙磊兴奋的说道。苹果在iPhone 7(A10)往后的机型加入了SMAP机制，但值得注意的是，iOS 11.1之前苹果实现的SMAP是存在漏洞，可以通过特定的方式绕过。但在最新的版本中，这一问题已经被修复，这就要求安全研究人员使用其他的方式来解决SMAP带来的影响。此外，在老的iOS版本中，安全研究人员还可以通过mach_zone_force_gc接口来触发内核GC，否则就只能填充同类型的数据。但在iOS 11中苹果禁用了mach_zone_force_gc接口，所以就需要新的触发内核GC的方式。

攻防的博弈从来都是一个永无止境的较量，系统安全水位的不断提升促进着安全研究人员在攻击技术领域的不断进步，两者形成了一个正向的循环，共同促进了整个移动生态的良性发展！

参考资料

原文http://jaq.alibaba.com/community/art/show&articleid=1273

苹果iOS11.2.1发布，阿里安全潘多拉实验室完美越狱http://jaq.alibaba.com/community/art/show&articleid=1272

阿里聚安全

阿里聚安全（http://jaq.alibaba.com）由阿里巴巴安全部出品，面向企业和开发者提供互联网业务安全解决方案，全面覆盖移动安全、数据风控、内容安全、实人认证等维度，并在业界率先提出“以业务为中心的安全”，赋能生态，与行业共享阿里巴巴集团多年沉淀的专业安全能力。

, groupId: 6499594970020708878, itemId: 6499594970020708878, type: 1, subInfo: { isOriginal: false, source: 阿里聚安全, time: 2017-12-15 10:28:00 }, tagInfo: { tags: [{"name":"潘多拉"},{"name":"iPhone"},{"name":"iOS"},{"name":"苹果公司"},{"name":"iPhone 7"}], groupId: 6499594970020708878, itemId: 6499594970020708878, repin: 0, }, has_extern_link: 0 }, commentInfo: { groupId: 6499594970020708878, itemId: 6499594970020708878, comments_count: 18, ban_comment: 0 }, mediaInfo: { uid: 50096914854, name: 阿里聚安全, avatar: //p3.pstatp.com/large/78f001f64dd3538e11b, openUrl: /c/user/50096914854/, follow: false }, pgcInfo: {"media_info":{"open_url":"/c/user/50096914854/","avatar_url":"https://p3.pstatp.com/large/78f001f64dd3538e11b","media_id":50096801210,"name":"阿里聚安全","user_verified":false},"articles":[{"item_id":"6499672245667889678","url":"/item/6499672245667889678","title":"阿里聚安全周刊：潘多拉实验室完美越狱iOS11.2.1｜Janus漏洞"},{"item_id":"6499594970020708878","url":"/item/6499594970020708878","title":"独家探寻阿里安全潘多拉实验室，完美越狱苹果iOS11.2.1"},{"item_id":"6499221129419293197","url":"/item/6499221129419293197","title":"阿里安全潘多拉实验室首先完美越狱苹果iOS 11.2"},{"item_id":"6498948518282002957","url":"/item/6498948518282002957","title":"阿里安全专家玄泰独家解密：“如何防止信息泄露”"}]}, feedInfo: { url: /api/pc/feed/, category: __all__, initList: [{"comments_count":3,"media_avatar_url":"//p2.pstatp.com/large/13540014bb83b4f001aa","is_feed_ad":false,"is_diversion_page":false,"title":"百度布局最早，腾讯下血本追上，而阿里这次有点掉队了","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6499632965906072078/","source":"量子位","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/4e68000389e21c517403","group_id":"6499632965906072078","is_related":true,"media_url":"/c/user/53624121633/"},{"comments_count":81,"media_avatar_url":"//p5a.pstatp.com/large/1781000469c42c0be123","is_feed_ad":false,"is_diversion_page":false,"title":"苹果发布iOS 11.2.1紧急更新：漏洞太致命苹果建议用户必须升级！","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6499976570562675213/","source":"喻拓","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/4e710001423a2b996d00","group_id":"6499976570562675213","is_related":true,"media_url":"/c/user/2805591500/"},{"comments_count":0,"media_avatar_url":"//p8.pstatp.com/large/4ae60002979792ba74b4","is_feed_ad":false,"is_diversion_page":false,"title":"12月16日阿里天气预报","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6499899331129115150/","source":"天气小秘","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/4e6f0000702ed8a13d55","group_id":"6499899331129115150","is_related":true,"media_url":"/c/user/78931595728/"},{"comments_count":0,"media_avatar_url":"//p2.pstatp.com/large/8937/3984179112","is_feed_ad":false,"is_diversion_page":false,"title":"智达于心 阿里文娱智能营销平台诠释新营销","single_mode":true,"gallary_image_count":6,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6500013145568838158/","source":"文化产业先锋","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/4e7000031e5c704a2289","group_id":"6500013145568838158","is_related":true,"media_url":"/c/user/5592472251/"},{"comments_count":0,"media_avatar_url":"//p1.pstatp.com/large/e59000f96d3f8a045a2","is_feed_ad":false,"is_diversion_page":false,"title":"大公司的食堂饭菜就是不一样，阿里感觉顿顿像去五星级酒店！","single_mode":true,"gallary_image_count":8,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6500028985097847310/","source":"磊磊的小厨房","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/4e6c0003a87a85e9669b","group_id":"6500028985097847310","is_related":true,"media_url":"/c/user/52198422850/"},{"comments_count":249,"is_related":true,"is_feed_ad":false,"is_diversion_page":false,"title":"某成人视频网站上的视频，过半视频水印显示来自360摄像头，是360摄像头真的存在漏洞？还是有人蓄意抹黑360？","single_mode":true,"gallary_image_count":0,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6499785079399645453/","source":"悟空问答","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/50400001f768b54719dc","group_id":"6499785079399645453"},{"comments_count":0,"media_avatar_url":"//p3.pstatp.com/large/1a6d0015d6c98e7c75b4","is_feed_ad":false,"is_diversion_page":false,"title":"阿里腾讯后劲不足，2018年美团小米或引发互联网新的变局！","single_mode":true,"gallary_image_count":5,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6499243036197782029/","source":"高兴拍拍手","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/4e6700009f92c6b04bee","group_id":"6499243036197782029","is_related":true,"media_url":"/c/user/59365638087/"},{"comments_count":0,"media_avatar_url":"//p4.pstatp.com/large/3c6100013057b336b469","is_feed_ad":false,"is_diversion_page":false,"title":"阿里云Redis典型场景：如何构建可扩展通用排行榜系统","single_mode":true,"gallary_image_count":7,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6498618733500563981/","source":"云栖社区","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/4e5b000315844a74ded5","group_id":"6498618733500563981","is_related":true,"media_url":"/c/user/5834235532/"},{"comments_count":0,"media_avatar_url":"//p1.pstatp.com/large/46f4000101ea74a2f341","is_feed_ad":false,"is_diversion_page":false,"title":"23岁程序员现场30分钟打造最强粒子特效，目前已入职阿里！","single_mode":true,"gallary_image_count":7,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6499681356639896078/","source":"IT咨讯","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/4e6e000073435effdc37","group_id":"6499681356639896078","is_related":true,"media_url":"/c/user/76569788267/"},{"comments_count":501,"media_avatar_url":"//p2.pstatp.com/large/4d001579287f2768a3","is_feed_ad":false,"is_diversion_page":false,"title":"全球最烧钱公司，华为和阿里之间，差了四五只企鹅","single_mode":true,"gallary_image_count":5,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6499594928849420813/","source":"科技富能量","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":20,"image_url":"//p1.pstatp.com/list/190x124/4e6700044042a15f437c","group_id":"6499594928849420813","is_related":true,"media_url":"/c/user/6011994322/"},{"media_avatar_url":"//p1.pstatp.com/large/e590010b6d4c9b2452b","is_feed_ad":false,"is_diversion_page":false,"title":"腾讯乘车码在智慧交通领域开疆拓土4个月后，阿里急了","single_mode":false,"gallary_image_count":0,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6498169695185666573/","source":"艾黑马科技","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"comments_count":52,"group_id":"6498169695185666573","is_related":true,"media_url":"/c/user/50303356080/"},{"comments_count":1,"media_avatar_url":"//p9.pstatp.com/large/47010005900ac6f8a96f","is_feed_ad":false,"is_diversion_page":false,"title":"盒马鲜生，阿里的亲儿子？","single_mode":true,"gallary_image_count":6,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6498227916285936142/","source":"我有一颗浮躁的心","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/4b040000519e1b3698e6","group_id":"6498227916285936142","is_related":true,"media_url":"/c/user/59875653581/"},{"comments_count":0,"media_avatar_url":"//p6.pstatp.com/large/3c78000034694722eeec","is_feed_ad":false,"is_diversion_page":false,"title":"星巴克臻选烘焙工坊携手阿里，打造新零售黑科技顶级秀场","single_mode":true,"gallary_image_count":21,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6498240336039510541/","source":"歪星人","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/4b030003292b365645d9","group_id":"6498240336039510541","is_related":true,"media_url":"/c/user/5759834037/"},{"comments_count":0,"media_avatar_url":"//p3.pstatp.com/large/632/2050190313","is_feed_ad":false,"is_diversion_page":false,"title":"宗宁：马云刘强东乌镇互怼背后 阿里、京东、三星们的公益路","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6499383141386420749/","source":"万能的大熊","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":152992,"image_url":"//p3.pstatp.com/list/190x124/4e6a000101d18e95cdd2","group_id":"6499383141386420749","is_related":true,"media_url":"/c/user/3159937254/"},{"comments_count":0,"media_avatar_url":"//p1.pstatp.com/large/3ec800025a397997ebb7","is_feed_ad":false,"is_diversion_page":false,"title":"新零售：腾讯向左，阿里向右！国芳集团成西北地区零售龙头","single_mode":true,"gallary_image_count":4,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6499648147613024781/","source":"瀚文财经","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/4e6a000300c9cef686f0","group_id":"6499648147613024781","is_related":true,"media_url":"/c/user/71697723847/"},{"comments_count":89,"media_avatar_url":"//p1.pstatp.com/large/4acd00087a456687c53d","is_feed_ad":false,"is_diversion_page":false,"title":"阿里达摩院又有新动作 要去以色列“买头脑”","single_mode":true,"gallary_image_count":7,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6498613389873381901/","source":"新科技之窗","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/4e5d000017c9cc7ed40a","group_id":"6498613389873381901","is_related":true,"media_url":"/c/user/74739935676/"},{"comments_count":0,"media_avatar_url":"//p4.pstatp.com/large/438d0002a2648f2c6286","is_feed_ad":false,"is_diversion_page":false,"title":"阿里京东血拼生态内容，内容电商的时代已经来临？","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6499270820819370509/","source":"互联网次位面","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p9.pstatp.com/list/190x124/4e66000171ed05987d3b","group_id":"6499270820819370509","is_related":true,"media_url":"/c/user/62925472312/"},{"comments_count":0,"media_avatar_url":"//p4.pstatp.com/large/432f00030ff9ad27f8fb","is_feed_ad":false,"is_diversion_page":false,"title":"到了阿里南线，多次去过西藏的我们沉默了……","single_mode":true,"gallary_image_count":10,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6499704586733879821/","source":"冯家三少","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/4e6a0004164ee8d6f6dc","group_id":"6499704586733879821","is_related":true,"media_url":"/c/user/50422187564/"},{"comments_count":0,"media_avatar_url":"//p3.pstatp.com/large/46f900027f429ba55f7e","is_feed_ad":false,"is_diversion_page":false,"title":"马云阿里爸爸出手阔绰 支付宝扫码红包 到底富了多少人","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6499799132926902797/","source":"骗局终结者","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/4e6f00003324314ace5c","group_id":"6499799132926902797","is_related":true,"media_url":"/c/user/61779935041/"},{"comments_count":0,"media_avatar_url":"//p3.pstatp.com/large/d29000e5c231670ddd7","is_feed_ad":false,"is_diversion_page":false,"title":"分析：分众传媒，与百度、阿里携手提速","single_mode":true,"gallary_image_count":1,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6498952713261285901/","source":"阿图","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/4e6300012946ebc8829c","group_id":"6498952713261285901","is_related":true,"media_url":"/c/user/6962447923/"}] }, shareInfo: { shareUrl: https://m.toutiao.com/group/6499594970020708878/, abstract: 知道如何从攻击的视角去发现漏洞，才能建立更安全的体系，促进了整个生态的良性发展。以阿里安全潘多拉实验室为例，在对移动系统安全研究的过程中，把研究过程中发现的问题上报给厂商，促进系统安全性的提升。研究员：龙磊小编第一时间深度探访阿里安全潘多拉实验室，采访了此次攻破苹果iOS11.
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系 [邮箱地址] 删除

路过
雷人
握手
鲜花
鸡蛋
收藏 分享 邀请
上一篇：Facebook悄然修复阻止用户屏蔽扎克伯格的漏洞下一篇：人工智能与黑客帝国，Web安全从入门到放弃｜佛系 FIT 2018 大会

最新评论

相关分类

返回顶部