8 ms·
About the security content of iOS 10.3.1
- danielvf 10y ago> Impact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip" That's a major problem!
- RKearney 10y agoAnd yet Apple requires you to download this update over Wi-Fi to receive it OTA. Sure you could update via a computer, but that seems to go against Apple's vision of not requiring tethering your device to a computer every time you need to update/sync/setup.
- digi_owl 10y agoFunny how that goes, as back when the iPod was new the idea at Apple was of the Mac to be the heart of a ecosystem.
- eanzenberg 10y agoSorry for further derailment but imo: Apple sees devices as portals to the same content. Whether you currently have an iphone in your hand, a mac, the watch, an ipad, whatever, Apple sees them as interchangeable to do the work you need. So while I may be using an iphone/watch on the bus ride home, when I'm home I can grab my ipad and try to seamlessly switch what I was focused on to it. The try is the hard part that I think they are focused on and will continue to decrease friction in the future.
- euyyn 10y agoWhat you're talking about is a recent development, and your parent is talking about the past.
- JustSomeNobody 10y agoThat's a rather loose definition of requires.
- evilduck 10y agoWhat do you propose then? Typing in the patch?
- 0x0 10y agoAllowing downloads of OS updates less than 100MB over 3G/4G, just like regular apps? The 10.3.0->10.3.1 patch is ~20MB. My phone downloads multiple ~100MB app updates daily over cellular. Refusing cellular iOS updates that are smaller than one of those apps is getting pretty silly these days.
- mikeash 10y agoAre you really using 10GB of cellular data each month just for app updates? Isn't that expensive?
- RKearney 10y agoWhy[0] would[1] it[2] be[3]? [0] https://www.verizonwireless.com/plans/verizon-plan/ https://www.verizonwireless.com/plans/verizon-plan/ [1] https://www.att.com/plans/unlimited-data-plans.html https://www.att.com/plans/unlimited-data-plans.html [2] https://www.t-mobile.com/cell-phone-plans https://www.t-mobile.com/cell-phone-plans [3] https://www.sprint.com/landings/unlimited-cell-phone-plans/ https://www.sprint.com/landings/unlimited-cell-phone-plans/
- PhantomGremlin 10y agoThe only thing "unlimited" about all 4 of those plans are the weasel words. Verizon: After 22 GB/line/mo, we may prioritize your data behind other Verizon customers during network congestion. ATT: After 22GB of data usage, AT&T may slow speeds T-Mobile: On all T-Mobile plans, if congested, top 3% of data users (>30GB/mo.) may notice reduced speeds due to prioritization Sprint: Data deprioritization during congestion after 23GB/mo.
- mikeash 10y agoThose plans are pretty expensive.
- djrogers 10y agoSo by 'requires' you mean offers it as one possible option? Your post already mentions the most obvious alternative - update via iTunes, and you can also use the lightning-USB adapter and a USB NIC. I'm not sure I really understand the purpose of your post here, unless it was to incite some sort of ire from Apple haters?
- devy 10y agoHonest question, is "execute arbitrary code on the Wi-Fi chip" the same as execute arbitrary code on the SoC (e.g. A10) chip?
- mikeash 10y agoIt's not identical. The WiFi chip has its own processor running its own code, and that's what the exploit affects. It may be possible, even trivial, to leverage that into running arbitrary code on the main CPU, depending on how the stuff is designed. If the WiFi chip has unrestricted access to RAM then that would be it. If not, it's likely that the OS drivers for the chip aren't hardened against malicious input from the WiFi chip and could be exploited.
- devy 10y ago> If the WiFi chip has unrestricted access to RAM Is this the Wi-Fi chip's own internal memory? Or iPhone's main RAM in SoC?
- delinka 10y agoI'sure mikeash means main RAM, not the wifi internal memory. Given DMA to systm RAM, your device is rooted. Given access to wifi chip's RAM, rooting is probably much harder (but still not impossible.)
- acdha 10y agoApple's been shipping hardware DMA restrictions on Macs for awhile - that first appeared on the security radar in the FireWire era – so it's not inconceivable that it's not as simple as getting DMA access but https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf seems to be silent on that unless I'm missing something.
- mikeash 10y agoIOMMUs are important for external interfaces, but much less so for internal hardware. It's certainly possible that they're doing it here, but I wouldn't bet on it.
- bdrool 10y agoSomething I just noticed about the iOS update process: it appears that when it tries to "verify" an update (which requires that you be online), it does not do so over a secure connection. I was on a captive network (the kind where HTTPS goes through but plain HTTP does not, until you click through an agreement page), and while it was able to download the update just fine, it couldn't verify it until I opened Safari and tried to go to neverssl.com to click past the captive network's "I agree" button. Doesn't that seem wrong? Or perhaps it's just the "check to see if the user is online before verifying" step that is unsecured. Either way that seems like a bug.
- deleted 10y ago[deleted]
- klodolph 10y agoThe way iOS and macOS applications are verified is by signing the application package itself, presumably the OS updates use a similar mechanism. At that point it is irrelevant whether the connection used to download the package is secure. This is similar to the way that packages for most (sane) Linux distributions are signed. The advantage to this technique is twofold: that there are network environments where SSL communication is not possible, and you can distribute updates offline or from your own server and devices will still accept the updates.
- 0x0 10y agoNo, iOS updates require online validation because the boot rom will issue a one-time challenge based in part on the device's unique serial number, and it needs to be granted a "ticket" response by the apple servers. This is why you usually can't downgrade iOS versions (as the apple servers will refuse to grant a ticket for old versions). Google keywords: apnonce, apticket, shsh blobs, signing window
- klodolph 10y agoThis comment appears to add additional, specific information to my general comment rather than disagreeing with what I said, but the comment starts with "no", which implies otherwise. The core idea here is that SSL is not necessary if the data is signed through some other mechanism.
- dep_b 10y agoCould this also work on "cold" devices, so devices that have Wi-Fi but it's turned off?
- danudey 10y agoPresumably not, since the wifi chip in those cases is usually powered down entirely (hence why it can't be used for geolocation).
- duskwuff 10y agoReceiving any sort of communications over wifi would require the radio to be powered on, and sucking down battery the whole time. There's no way Apple would have missed such an obvious way to extend battery life -- I'd be surprised if it's even powered on unless the phone is actively communicating on the wireless network.
- 0x0 10y agoIt looks a lot like this google project zero bug (same reporter, same bug type (stack overflow on the wifi chip)) but the CVE number has the last two digits swapped https://bugs.chromium.org/p/project-zero/issues/detail?id=1051 https://bugs.chromium.org/p/project-zero/issues/detail?id=10... Looks like it's hitting android devices as well as ios devices? Edit: Apple must have known when they released iOS 10.3.0 since they named the next-day-beta 10.3.2. Perhaps they were embargoed because of other broadcom customers, but didn't want to delay the other crazy security fixes that 10.3.0 brought. Were they forced to ship an known insecure broadcom firmware because of Android then? Double edit: Or more likely they just wanted to get some more testing time. Looks like the p0 bug was unrestricted on Mar 23.
- jeroenhd 10y agoVery interesting to note: > However, searching a small sample of firmwares I have present, I've been able to verify the existence of the "ccx" tag in the Galaxy S7 (G930F, G930V), Galaxy S6 Edge (G925V), Galaxy S7 Edge (G935F, G9350), Galaxy Note 4 (N910F) and Galaxy S5 (G900F). This could mean that not only Apple devices are affected. Broadcom chips are everywhere and bringing out patches and firmware update is a big problem in the Android world.
- tedunangst 10y agoWell, it's quite obvious to see what went wrong. void function_79390(void* unk, char* ie, char* buf) Those are terrible names for functions and variables. Very shoddy development.
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]