Fuzzing at Mach Speed: Uncovering IPC Vulnerabilities on MacOS
Reviews fuzzing at Mach Speed: Uncovering IPC Vulnerabilities on MacOS and evaluates key implications for security practitioners.
Summary
Speaker and audience
Mandiant/Google consultant Dylan Frankie presents year-long research on fuzzing macOS Mach IPC, aimed at offensive researchers and defensive engineers alike.
Fuzzing basics
Fuzzing sends unexpected inputs through attack vectors to trigger crashes in memory-unsafe C/C++ code, potentially exposing buffer overflows, use-after-free, and similar bugs.
Approach
He contrasts mutation-based fuzzing (mutating valid inputs) with grammar-based fuzzing, focusing on mutation for this work. The fuzzing cycle is his framework for finding and refining memory-corruption issues.
macOS IPC focus
The XNU Mach layer handles low-level IPC. Mach ports act as kernel-managed mailboxes; services register with the bootstrap server (e.g., com.apple.Troopers) so clients can allocate ports, register services, and exchange messages. He argues base Mach IPC is a high-value target because many higher-level mechanisms build on it.
Related talks
Nullcon Berlin·53 min
Provides fuzzing At Mach Speed: Uncovering IPC Vulnerabilities On MacOS By Dillon and evaluates key implications for security practitioners.
BSides Tallinn·48 min
Mikko Kenttäla
Evaluates #2: Mikko Kenttäla - practitioner Journey to find vulnerabilities in macOS and evaluates key implications for security practitioners.
TROOPERS24·3 min
Evaluates aftermovie and evaluates key implications for security practitioners.