3 ms·
There is nothing in the digital signature check that allows it to be locked to a device, so that's logic that has to kick in AFTER the trusted layer has validat
by cbsmith 11y ago
There is nothing in the digital signature check that allows it to be locked to a device, so that's logic that has to kick in AFTER the trusted layer has validated the code. At that point, it is a simple matter of altering the device ID check in unsecured RAM and you've now got another cracked phone.
- xerxe-sans-s 11y agoSo would a signature check on the trusted layer against a signature generated with the device id (you'd need to distribute a different binary against every device id) permit the generation of an OS image that could only run on a single device?
- cbsmith 11y agoIt would, in theory. If there weren't any catches with this approach though... Apple could have avoided having itself in this position in the first place.
- pilif 11y agoActually, I would argue that this is not true. Before installing, the device wants a ticket to be signed by apple that contains a hash of the firmware to be installed, the phone's identifier and a nonce it has just generated. See here: https://www.theiphonewiki.com/wiki/SHSH https://www.theiphonewiki.com/wiki/SHSH So by not signing any requests for that particular firmware hash, Apple can effectively neuter that firmware and make sure it's never installed anywhere but on the target phone. The problem is though: If apple can be compelled to do this once, they can also be compelled to do this any other time.
- cbsmith 11y agoThat's not part of the boot chain. That's for OTA updates.