iPhones have an enviable reputation for security. The close link between hardware and software, curated AppStore, and frequent security updates make exploitation of the iPhone difficult. This has, however, not deterred malware companies and others from compromising iOS devices exploit security flaws in the browser, the 4G baseband processor, and the Wireless Network Interface Controller (WNIC). In this presentation we focus on exploiting the WNIC. This avoids many of the defences built into iOS and exposes a new set of otherwise inaccessible attack surfaces within the iOS kernel. We’ll also take a look at how Apple makes the iOS WiFi stack “think different”. This includes a brief coverage of Bonjour and the Apple Wireless Direct Link (AWDL) protocol that’s at the heart of AirDrop, AirPlay, and similar services. These protocols have been implemented, in part, by offloading some of their processing onto the WNIC itself - and we’ll look at how this might help exploit the device. The approach taken here follows in the steps of Gal Beniamini’s Project Zero articles and that of SEEMOO's NexMon framework and we’ll bring things up-to-date in light of Apple’s latest security controls. In practical terms, we’ll show how to find, analyse, reverse engineer, and patch the WNIC's firmware and conclude with a discussion of WiFi fuzzing and exploit hunting.