Star 0

Abstract

As we all know, WannayCry has caused terrible disturbances worldwide to Windows PC, utilizing remote 0day SMB vulnerability. The Apple platform (especially the iOS operating system) is imaged to be immune to such kinds of security threats because of its declared system security feature by design and restrict Apple Store security policy. However, we found - possibly for the first time - a suspected ransomware remote attack towards iOS and OSX platforms distributed in the wild. In this paper, we would like to tell you the whole story of how we hunt for the remote iOS ransomware attack based on profile installation and defeat it in cradle. We will analysis how the iOS ransomware hijacks your phone screen or even causes system crashes or hang using profile installation - as we call "death profile" - in technical detail. We will also introduce both static and dynamic solution to detect and remediate such threat. Thus, we would propose one new remote attack interface on iOS system research.