4 ms·

Are there any good articles on the difference between iPhone 5, 5c, 6, and 6c in terms of security? Also, has anyone covered why NAND Flash clone attack vector

by x0054 11y ago

Are there any good articles on the difference between iPhone 5, 5c, 6, and 6c in terms of security? Also, has anyone covered why NAND Flash clone attack vector would not work? I had many people tell me that is definitely, for sure, certainly would not work, and yet no one I spoke with could explain exactly why that was the case.

ghshephard 11y ago
Good (excellent) article on IOS security: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf See Page 12 on advantage of A7 or higher processor, but, in particular: "On devices with an A7 or later A-series processor, the delays are enforced by the Secure Enclave. If the device is restarted during a timed delay, the delay is still enforced, with the timer starting over for the current period. " The question still outstanding, is whether the Secure Enclave can be modified, and also, whether it can be modified without a passcode.
- venomsnake 11y ago
  And where does Secure Enclave store the counter? Does it have flash inside the processor? Otherwise - just unplug and replug the battery Edit: Any device that is nand cloned will not be using apple power anyway. And we have all kinds of low temperature, low voltage bit flip attacks anyway.
  - x0054 11y ago
    The Secure Enclave does have it's own flash, it apparently even has it's own OS. What do you mean by bit flip attack? I am actually really interested in how it would be possible.
    - andyjohnson0 11y ago
      A bit flipping attack is where a change to the cyphertext results in a predictable change to the (decrypted) plaintext [1]. Re venomsnake's comment, I'm not sure how this applies to the secure enclave though, or the relevance of low temperatures. https://en.wikipedia.org/wiki/Bit-flipping_attack https://en.wikipedia.org/wiki/Bit-flipping_attack
      - venomsnake 11y ago
        No - I meant literal bit flipping in a processor when you play tricks with ambient temperature, voltage and so on ...
    - venomsnake 11y ago
      I know about the OS. But the key is fused, not in flash in the CPU. So they probably have cmos style persistence and not true one. Which is vulnerable to erasing. Low voltage attacks: A low-voltage fault attack is a fault attack where the fault is induced by feeding the hardware with a lower-than-normal voltage (in the "smart card" model, the card has its own CPU, RAM and ROM, but the current and clock signals are provided externally, i.e. are under the control of the attacker). For instance, if the card expect 3.3V, you give it only 2V. The real trick here is that the attacker can lower the voltage for only very short durations, a few clock cycles, so as to induce a fault in a specific part of the algorithm execution We try to get the hardware crazy. http://security.stackexchange.com/questions/69279/what-actually-happens-in-low-voltage-fault-attacks http://security.stackexchange.com/questions/69279/what-actua...
    - makomk 11y ago
      However, its flash is supposedly not inside the processor but in the form of an external flash chip, and it's not really possible for Apple to move the flash onto the main processor because the manufacturing processes they use don't support it. That's why everyone uses one-time programmable eFuses instead.
    - mikeash 11y ago
      There is no indication that the Secure Enclave has its own flash. I've looked everywhere, and while there are lots of hopeful people who think it should, there's no evidence that it does. If you read through Apple's security document, you'll see that the Secure Enclave achieves separation from the rest of the system by encrypting everything with keys that can't be replicated on the outside, and by having its own secure boot verification. It's possible that there's some internal storage that they just don't mention, but it doesn't look like the way to bet. This means that even devices with the Secure Enclave are still vulnerable to flash cloning. You can't understand the contents of the Secure Enclave's stuff, but you can still save and restore them once you desolder the flash. The attack described in the comment you're replying to won't work, of course. The counter is stored in the flash, so cutting power won't do anything. There was a bug where the OS would report an unlock failure before updating the flash memory, so if you were quick to cut the power you could bypass the counter, but that's been fixed. What does work (in theory) is to desolder the flash and hook it up so you can save and restore its contents. Then you turn on the phone, try a few passcodes, shut down, restore flash to original state, repeat until success. Of course, this only works if the passcode is simple enough that a brute force is feasible. You can attack a four-digit passcode in a few days this way. A six-digit passcode would take maybe a year, and proper passphrase would still be completely infeasible.
- x0054 11y ago
  That's a great read, still reading it now. I wish it was more specific about how the Secure Enclave times the period between passwords, however. There are 2 ways to do it, as I see it: 1. One way would be for the SE to have it's own clock function. 2. The other would be for the SE to send a message to the main CPU and ask the CPU to let it know when x number of seconds has passed. I believe that second option is more likely because of the way the feature works. On full phone reset it restarts the timeout period rather than continue it from where it was. This could be a feature, of course. But I am guessing that the way it works is that the SE asks the System to tell it when x seconds / min has past and sets a timeoutExpired flag to false. Once it get's the notification that the time has passed, it resets the flag to true. If above is how it works, than screwing around with the System clock could be effective. If the system relies on system time, then it might be possible to shift the clock by doing adjustment through a fake cell tower. Not sure how effective that would be. Just some thoughts really. Would be interesting to see if they can unlock the iPhone 6 or not.

by x0054 11y ago

ghshephard 11y ago

Good (excellent) article on IOS security: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf See Page 12 on advantage of A7 or higher processor, but, in particular: "On devices with an A7 or later A-series processor, the delays are enforced by the Secure Enclave. If the device is restarted during a timed delay, the delay is still enforced, with the timer starting over for the current period. " The question still outstanding, is whether the Secure Enclave can be modified, and also, whether it can be modified without a passcode.

venomsnake 11y ago
And where does Secure Enclave store the counter? Does it have flash inside the processor? Otherwise - just unplug and replug the battery Edit: Any device that is nand cloned will not be using apple power anyway. And we have all kinds of low temperature, low voltage bit flip attacks anyway.
- x0054 11y ago
  The Secure Enclave does have it's own flash, it apparently even has it's own OS. What do you mean by bit flip attack? I am actually really interested in how it would be possible.
  - andyjohnson0 11y ago
    A bit flipping attack is where a change to the cyphertext results in a predictable change to the (decrypted) plaintext [1]. Re venomsnake's comment, I'm not sure how this applies to the secure enclave though, or the relevance of low temperatures. https://en.wikipedia.org/wiki/Bit-flipping_attack https://en.wikipedia.org/wiki/Bit-flipping_attack
    - venomsnake 11y ago
      No - I meant literal bit flipping in a processor when you play tricks with ambient temperature, voltage and so on ...
  - venomsnake 11y ago
    I know about the OS. But the key is fused, not in flash in the CPU. So they probably have cmos style persistence and not true one. Which is vulnerable to erasing. Low voltage attacks: A low-voltage fault attack is a fault attack where the fault is induced by feeding the hardware with a lower-than-normal voltage (in the "smart card" model, the card has its own CPU, RAM and ROM, but the current and clock signals are provided externally, i.e. are under the control of the attacker). For instance, if the card expect 3.3V, you give it only 2V. The real trick here is that the attacker can lower the voltage for only very short durations, a few clock cycles, so as to induce a fault in a specific part of the algorithm execution We try to get the hardware crazy. http://security.stackexchange.com/questions/69279/what-actually-happens-in-low-voltage-fault-attacks http://security.stackexchange.com/questions/69279/what-actua...
  - makomk 11y ago
    However, its flash is supposedly not inside the processor but in the form of an external flash chip, and it's not really possible for Apple to move the flash onto the main processor because the manufacturing processes they use don't support it. That's why everyone uses one-time programmable eFuses instead.
  - mikeash 11y ago
    There is no indication that the Secure Enclave has its own flash. I've looked everywhere, and while there are lots of hopeful people who think it should, there's no evidence that it does. If you read through Apple's security document, you'll see that the Secure Enclave achieves separation from the rest of the system by encrypting everything with keys that can't be replicated on the outside, and by having its own secure boot verification. It's possible that there's some internal storage that they just don't mention, but it doesn't look like the way to bet. This means that even devices with the Secure Enclave are still vulnerable to flash cloning. You can't understand the contents of the Secure Enclave's stuff, but you can still save and restore them once you desolder the flash. The attack described in the comment you're replying to won't work, of course. The counter is stored in the flash, so cutting power won't do anything. There was a bug where the OS would report an unlock failure before updating the flash memory, so if you were quick to cut the power you could bypass the counter, but that's been fixed. What does work (in theory) is to desolder the flash and hook it up so you can save and restore its contents. Then you turn on the phone, try a few passcodes, shut down, restore flash to original state, repeat until success. Of course, this only works if the passcode is simple enough that a brute force is feasible. You can attack a four-digit passcode in a few days this way. A six-digit passcode would take maybe a year, and proper passphrase would still be completely infeasible.
x0054 11y ago
That's a great read, still reading it now. I wish it was more specific about how the Secure Enclave times the period between passwords, however. There are 2 ways to do it, as I see it: 1. One way would be for the SE to have it's own clock function. 2. The other would be for the SE to send a message to the main CPU and ask the CPU to let it know when x number of seconds has passed. I believe that second option is more likely because of the way the feature works. On full phone reset it restarts the timeout period rather than continue it from where it was. This could be a feature, of course. But I am guessing that the way it works is that the SE asks the System to tell it when x seconds / min has past and sets a timeoutExpired flag to false. Once it get's the notification that the time has passed, it resets the flag to true. If above is how it works, than screwing around with the System clock could be effective. If the system relies on system time, then it might be possible to shift the clock by doing adjustment through a fake cell tower. Not sure how effective that would be. Just some thoughts really. Would be interesting to see if they can unlock the iPhone 6 or not.