Skip to main content

Media Layer

The Media layer provides the audio, video, graphics, and animation frameworks that apps use to render content. It is also one of the most interesting attack surfaces on iOS, because media data is complex, attacker-controlled, and historically under-hardened: parsing untrusted media files has produced a long line of kernel and userland bugs.

Core Audio​

  • The low-level audio stack: Core Audio, AudioToolbox, and AudioUnit.
  • Handles playback, recording, and audio processing pipelines.
  • Malformed audio files (MP3, AAC, CAF) must be parsed by the OS before they ever reach an app, making audio parsing a classic remote-exploit entry point.

AVFoundation​

  • The high-level media framework for playback, recording, and media editing (AVPlayer, AVAsset).
  • Supports a huge matrix of containers and codecs: MP4, MOV, M4A, H.264, HEVC, and more.
  • Media metadata (EXIF, chapters, captions) is parsed by the system, so a crafted video or image can attack the parser even if the app itself does nothing with it.

Core Animation​

  • The rendering and animation engine (the CA* classes: CALayer, CATransaction).
  • GPU-backed; rendering commands and layer contents flow to the graphics stack.
  • Less directly attacker-facing, but it is part of the attack surface between the app and the GPU.

Core Graphics​

  • The 2D drawing framework (CGContext, CGImage, Quartz).
  • Rasterization and image decoding happen here; malformed PNG/JPEG/PDF input is funneled through Core Graphics/ImageIO.
  • ImageIO (the image decoder underneath Core Graphics) and PDF rendering have been the source of many "malicious image" bugs. Sending a crafted image to a target app (e.g. via a chat or an upload) is a legitimate test vector.

Why media expands the attack surface​

  • Parsing is the vulnerable boundary. Every container demuxer and codec decoder is a parser, and parsers written in C/C++ for speed are memory-corruption magnets.
  • Untrusted input flows. Apps routinely accept images, videos, audio, and PDFs from other users or the network. The user sees a preview; the OS sees untrusted bytes in a decoder.
  • Wide codec support means a lot of code paths, each with its own history of CVEs.
  • In the process. Media decoding generally happens in-process or in a system daemon, so a parser bug can give an attacker the same privileges as the calling app (or a privileged daemon), skipping the app's sandbox entirely.

Pentest relevance​

  • When testing an app that ingests media, fuzz and submit malformed images/audio/video; the crash will tell you whether the system parser or the app's own parsing code is at fault.
  • Check whether the app passes media to system frameworks (AVAsset, UIImage, PDFKit) untouched these paths route to the hardened-but-buggy system parsers.
  • On jailbroken devices, crash logs under /private/var/mobile/Library/Logs/CrashReporter/ will point you at the faulting framework after you deliver a crashing sample.