你尽力了吗-25年后的再追问.pptxVIP

你尽力了吗—25年后的再追问;

Agenda

-Speakerbiography

-Didyoupushyourlimits?

Part1-Asasystemarchitect

Part2-Asasoftwareengineer

Part3-Asaqualityassurancespecialist

Part4-AsaparticipantinthesoftwaredevelopmentlifecyclePart5-Asasecurityresearcher

-Takeaways;

Aboutme

WangYu

Securityresearcher.

Serialentrepreneur,currently

servingasCEO/CTOofa

leadingdatasecurity

company.

Engineeringbackground.

Consistentlydeliveringworld-

classresearchachievements

bridgingindustryand

academia.;

Didyoupushyourlimits?

Part1-Asasystemarchitect

Case#1:ThestorybehindIOMobileFrameBufferandCVE-2024-44199Case#2andCase#3:CVE-2020-3905andCVE-2020-9928;

Case#1-ThestorybehindIOMobileFrameBuffer

ThestatisticaldataonIOMobileFrameBuffervulnerabilitiesindicatesthatthe

competitionbetweentheoffensiveanddefensivesidesoncereachedafeverpitch.

Accordingtopubliclyavailablerecords,atotalofsixteenkernelvulnerabilitiesin

IOMobileFrameBufferhavebeenreportedthroughoutitshistory.Amongthem,fourwereactivelyexploitedbyAPTgroups(CVE-2021-30807,CVE-2021-30883,CVE-2021-30983,CVE-2022-22587),twowereleveragedforiOSjailbreaktools(JailbreakMe3.0-CVE-2011-0227,Pangu9-CVE-2016-4654),andonewassuccessfullyutilizedtowinasecuritychallengecompetition(TianfuCup-CVE-2021-30983).;

Thehistoricallandscapeofkernelvulnerabilities

2011-CVE-2011-0227(Comex,JailbreakMe3.0)

2012-N/A

2013-N/A

2014-N/A

2015-CVE-2015-1097(BarakGabai),CVE-2015-5843(FilippoBigarella)

2016-CVE-2016-4654(TieleiWang-TeamPangu,Pangu9)

2017-CVE-2017-13879(Apple)

2018-CVE-2018-4335(BrandonAzad)

2019-N/A

2020-N/A;

Thehistoricallandscapeofkernelvulnerabilities(cont)

2021-CVE-2021-30807(ITWAPTattack/SaarAmar),CVE-2021-30883(ITWAPTattack/TieleiWang-TeamPangu),CVE-2021-30983(TieleiWang-TeamPangu,TianfuCup

Competition),C