摘要
Checkm8漏洞是一种基于i Phone手机固件强制升降机模式的硬件漏洞。在电子数据取证工作中,针对未知锁屏密码的i Phone手机检材,文章提出一种利用Checkm8漏洞绕过密码验证提取i Phone手机数据的方法,并通过实验演示了漏洞利用、证据数据挖掘与提取、数据解密分析与证据展示。同时利用堆漏洞对锁屏状态下的i Phone手机进行最高权限提升,获取端口通信权限与数据提取传输权限,解决了密码缺失情况下数据提取问题。
The Checkm8 vulnerability is a hardware vulnerability based on the device firmware upgrade(DFU) mode of the iPhone firmware. This paper proposed a method of using Checkm8 vulnerability to bypass password verification to extract iPhone data, and demonstrated the exploitation of the vulnerability, digital data mining and extraction, data decryption analysis and evidence display. At the same time, the heap vulnerabilities were utilized to upgrade the highest authority, obtain the authority of port communication and transmission on the iPhone in the locked state, which could solve the problem of data extraction in the absence of passwords. This method has high practical value for forensic science.
作者
陈光宣
吴家健
操丹妮
谢清泉
CHEN Guangxuan;WU Jiajian;CAO Danni;XIE Qingquan(Key Laboratory of Public Security Information Application Based on Big-data Architecture,Ministry of Public Security,Zhejiang Police College,Hangzhou 310053,China;Suzhou Longxintec Co.,Suzhou 215125,China)
出处
《信息网络安全》
CSCD
北大核心
2021年第12期44-50,共7页
Netinfo Security
基金
浙江省自然科学基金委员会基础公益研究计划项目[LGF19F020006]
国家级大学生创新创业训练计划[202111481006]
浙江省大学生科技创新活动计划暨新苗人才计划[2021R422003]。