5 ms·

Examining Pointer Authentication on the iPhone XS

56 points by phenylene 8y ago

stefan_ 8y ago
So Apple publishes some kernel source code under a license that basically only permits you to look at it, presumably for security researchers. Apple then also redacts security related code from the published code, going so far as to partially redact functions, only making them appear complete. Weaknesses are then found, of course, in code they redacted. Feeling a bit schizophrenic here.
- profquail 8y ago
  I didn’t see the article say anything about redacting code? The XNU kernel (used in macOS and iOS) is open-source and has been for some time: https://github.com/apple/darwin-xnu https://github.com/apple/darwin-xnu My reading of the article was that Apple has some custom logic in the A12 (for the implementation of the pointer authentication extensions) and have made some (unreleased) modifications to the XNU code to utilize that custom logic. The article is the author reverse-engineering the unreleased modifications and working out how they interact with the A12, to try to discover exploitable weaknesses in the implementation.
  - stefan_ 8y ago
    The code obviously had enum values for pointer authentication in it. So why was the other code for it missing?
  - csande17 8y ago
    From the article: > The part [of the comments in the released source] about the "pointer" containing authenticated, hasBKey, and hasDKey bits suggests that this code is dealing with authenticated pointers, although all the code that actually performs PAC operations has been removed from the public sources. The researcher suspects Apple started with a version of the XNU code that supported the A12 logic, then removed the lines of code that actually performed the operations before publicly releasing it. In other words, Apple redacted security-related parts of the XNU source. To me, at least, that's different from Apple creating a new XNU version that supports pointer authentication and not releasing it at all.
- comex 8y ago
  xnu is licensed under a combination of the APSLv2 and BSD licenses, both of which are OSI- and FSF-approved open source/free software licenses. Perhaps you’re thinking of the corecrypto source code release from a while back, which was indeed “under a license that basically only permits you to look at it”? That’s unrelated, though.
openloop 8y ago
Good work. So now you know. Open source it all.
bepvte 8y ago
I love project zeros write-ups, but I wish they published more about Android.
- close04 8y ago
  I remember seeing more Google product related articles on their blog up until a couple of years ago. Then they stopped or slowed down, or at least they seem to concentrate a lot more on Apple and Microsoft. I guess some bugs are disclosed internally and fixed before they go public and some may not warrant blog posts. I am sure they're working on finding bugs in Google code but just like any other company they're not going to shoot themselves in the foot by advertising these internal findings more than needed.
  - zamadatix 8y ago
    Just to take a look I opened the Project Zero main blog page and the newest article was on a bug in https://github.com/google/skia/ https://github.com/google/skia/ so I'm not sure I can take your comment with any ounce of credibility.
    - deleted 8y ago
      [deleted]
  - londons_explore 8y ago
    Most security researchers are specialized in just a few pieces of software. If their Android expert leaves the team, there could be a gap in android exploits till a new one is hired.
- magicalist 8y ago
  The most recent post is a pretty fantastic one about exploiting polygon convexity in skia. https://googleprojectzero.blogspot.com/2019/02/the-curious-case-of-convexity-confusion.html https://googleprojectzero.blogspot.com/2019/02/the-curious-c...
- mehrdada 8y ago

56 points by phenylene 8y ago

So Apple publishes some kernel source code under a license that basically only permits you to look at it, presumably for security researchers. Apple then also redacts security related code from the published code, going so far as to partially redact functions, only making them appear complete. Weaknesses are then found, of course, in code they redacted. Feeling a bit schizophrenic here.

profquail 8y ago
I didn’t see the article say anything about redacting code? The XNU kernel (used in macOS and iOS) is open-source and has been for some time: https://github.com/apple/darwin-xnu https://github.com/apple/darwin-xnu My reading of the article was that Apple has some custom logic in the A12 (for the implementation of the pointer authentication extensions) and have made some (unreleased) modifications to the XNU code to utilize that custom logic. The article is the author reverse-engineering the unreleased modifications and working out how they interact with the A12, to try to discover exploitable weaknesses in the implementation.
- stefan_ 8y ago
  The code obviously had enum values for pointer authentication in it. So why was the other code for it missing?
- csande17 8y ago
  From the article: > The part [of the comments in the released source] about the "pointer" containing authenticated, hasBKey, and hasDKey bits suggests that this code is dealing with authenticated pointers, although all the code that actually performs PAC operations has been removed from the public sources. The researcher suspects Apple started with a version of the XNU code that supported the A12 logic, then removed the lines of code that actually performed the operations before publicly releasing it. In other words, Apple redacted security-related parts of the XNU source. To me, at least, that's different from Apple creating a new XNU version that supports pointer authentication and not releasing it at all.
comex 8y ago
xnu is licensed under a combination of the APSLv2 and BSD licenses, both of which are OSI- and FSF-approved open source/free software licenses. Perhaps you’re thinking of the corecrypto source code release from a while back, which was indeed “under a license that basically only permits you to look at it”? That’s unrelated, though.

openloop 8y ago

Good work. So now you know. Open source it all.

bepvte 8y ago

I love project zeros write-ups, but I wish they published more about Android.

close04 8y ago
I remember seeing more Google product related articles on their blog up until a couple of years ago. Then they stopped or slowed down, or at least they seem to concentrate a lot more on Apple and Microsoft. I guess some bugs are disclosed internally and fixed before they go public and some may not warrant blog posts. I am sure they're working on finding bugs in Google code but just like any other company they're not going to shoot themselves in the foot by advertising these internal findings more than needed.
- zamadatix 8y ago
  Just to take a look I opened the Project Zero main blog page and the newest article was on a bug in https://github.com/google/skia/ https://github.com/google/skia/ so I'm not sure I can take your comment with any ounce of credibility.
  - deleted 8y ago
    [deleted]
- londons_explore 8y ago
  Most security researchers are specialized in just a few pieces of software. If their Android expert leaves the team, there could be a gap in android exploits till a new one is hired.
magicalist 8y ago
The most recent post is a pretty fantastic one about exploiting polygon convexity in skia. https://googleprojectzero.blogspot.com/2019/02/the-curious-case-of-convexity-confusion.html https://googleprojectzero.blogspot.com/2019/02/the-curious-c...
mehrdada 8y ago