3 ms·
> Most modern systems have a MMU to prevent the peripheral from DMAing to memory areas not specifically reserved for it, but given (certainly Android) systems r
by yifanlu 9y ago
> Most modern systems have a MMU to prevent the peripheral from DMAing to memory areas not specifically reserved for it, but given (certainly Android) systems run oldschool kernels hacked together by the last kind of crowd you want working on them it's probably not enabled or setup correctly.
I'm not sure it's fair to assume iOS IOMMU isn't set up properly just because that's the case on many (most?) android phones. According to the author, most android phones don't even have KASLR which iOS had since iOS6. I would assume IOMMU exists and is working properly unless someone has evidence otherwise (quick google shows very little information on iOS + IOMMU). If a DMA attack is indeed successful on iOS devices, I think that would be substantial enough to write about.
> The other more obvious privilege escalation is that there is still a kernel driver on the application processor talking to the chipset.
I would consider that a separate exploit--but even then you still need a KASLR bypass (another exploit?) at the very least to gain control.
> so these often aren't written as defensive as they should be
On the contrary, the market rate for a iOS jailbreak chain is upwards $1 million USD so I'd be surprised if a single exploit gives you full system control.
- revelation 9y agoI didn't want to suggest that iOS is insecure because Android systems are. For Android we know most of them are hopeless, on iOS it's security by obscurity all the way with just a generally good "track record". Well, they patched something. Maybe they just patched the firmware image that is loaded onto the chipset on boot and there was no privilege escalation onto the iOS application processor. But if there was, the obscurity means criminals can easily look at the patch to see what it was and exploit that while the public knows nothing.
- yifanlu 9y agoRight, I'm guessing they just patched the actual wifi chip vulnerability. That's why I would like someone (preferably the author) to disclose if there is indeed a privilege escalation or not and to provide more details if there is.
- amazingman 9y agoHow, specifically, is iOS "security by obscurity all the way"?
- Gaelan 9y ago> criminals can easily look at the patch to see what it was and exploit that while the public knows nothing. Huh? If criminals can “easily” inspect the patch, why can’t the public?
- doctorless 9y agoThey can, but ease is a term that is conditional on expertise.
- deleted 9y ago[deleted]