4 ms·

> It is worth noting that none of the exploits bypassed the new, PAC-based JIT hardenings that are enabled on A12 devices. I'm surprised Apple doesn't talk mor

> It is worth noting that none of the exploits bypassed the new, PAC-based JIT hardenings that are enabled on A12 devices. I'm surprised Apple doesn't talk more about how they're continuously upgrading the security of iPhones with new chip generations. I remember the BlackHat presentation on iPhone security from a few years ago [0] also found that there were attacks on older iPhones which didn't work on the (then-)newer ones. Is Apple afraid it will give the impression that existing phones are not secure? [0]: https://news.ycombinator.com/item?id=12231758 https://news.ycombinator.com/item?id=12231758

kccqzy 7y ago
It is also worth noting that PAC is not a panacea. It's just one more thing to break before an attacker takes control. Given that one of the keys used in PAC is shared across all user-space processes including highly privileged unsandboxed processes (it must, as it's used by shared dynamic libraries), it's just a matter of finding one more user-space bug to leak the key and break PAC.
- idividebyzero 7y ago
  Even if the same key is shared by all processes, keys are stored in registers that are meant to be not accessible to userspace, so a disclosure vulnerability would not help here anyways.
  - kccqzy 7y ago
    You don't need to get the key per se, depending on your exploit. You just need a single valid signed pointer that's involved in your ROP gadget.
arthurofbabylon 7y ago
Talking about security inevitably triggers fear. That’s fine for some products, but absolutely unacceptable for large consumer brands with positive reputations.
saagarjha 7y ago
Apple gave a talk this year at BlackHat that talked about some of the new security mechanisms.
- chillaxtian 7y ago
  Link?
  - saagarjha 7y ago
    No slides, unfortunately: https://blackhat.com/us-19/briefings/schedule/#behind-the-scenes-of-ios-and-mac-security-17220 https://blackhat.com/us-19/briefings/schedule/#behind-the-sc...
- kccqzy 7y ago
  And researchers gave a talk this year at DEF CON that talked about defeating this exact security mechanism.
bt848 7y ago
Perhaps it would behoove security-sensitive users to use such devices, but they make up a tiny fraction of all iOS devices in the field. 90% of deployed iOS devices in the USA lack the A12 CPU and the number is higher abroad. Obsolete 32-bit CPUs are more common than CPUs with PAC.
- saagarjha 7y ago
  > Obsolete 32-bit CPUs are more common than CPUs with PAC. According to this (taken soon after iPhone XS/XR went on sale) this is not true: https://www.statista.com/statistics/755593/iphone-model-device-market-share-worldwide/ https://www.statista.com/statistics/755593/iphone-model-devi...
  - bt848 7y ago
    That apparently costs $50/mo to read. But it seems to discuss iPhone only. The universe of iOS devices is not limited to iPhones.
ryacko 7y ago
You don’t need PAC if you disable scripts in Safari. Besides, baseband/browser/iMessage vulnerabilities are in the same price range. [i] It also isn’t difficult to infer what a “code signing bypass” is, so I guess being arrested is a good excuse to buy a new phone? (Assuming we’re talking about a state based actor, in control of the territory you live in) i. https://zerodium.com/program.html https://zerodium.com/program.html
- saagarjha 7y ago
  > You don’t need PAC if you disable scripts in Safari. Safari has multiple JITs. For example, aside from the JavaScriptCore compiler, there’s also a CSS selector JIT.

kccqzy 7y ago

It is also worth noting that PAC is not a panacea. It's just one more thing to break before an attacker takes control. Given that one of the keys used in PAC is shared across all user-space processes including highly privileged unsandboxed processes (it must, as it's used by shared dynamic libraries), it's just a matter of finding one more user-space bug to leak the key and break PAC.

idividebyzero 7y ago
Even if the same key is shared by all processes, keys are stored in registers that are meant to be not accessible to userspace, so a disclosure vulnerability would not help here anyways.
- kccqzy 7y ago
  You don't need to get the key per se, depending on your exploit. You just need a single valid signed pointer that's involved in your ROP gadget.

arthurofbabylon 7y ago

Talking about security inevitably triggers fear. That’s fine for some products, but absolutely unacceptable for large consumer brands with positive reputations.

saagarjha 7y ago

Apple gave a talk this year at BlackHat that talked about some of the new security mechanisms.

chillaxtian 7y ago
Link?
- saagarjha 7y ago
  No slides, unfortunately: https://blackhat.com/us-19/briefings/schedule/#behind-the-scenes-of-ios-and-mac-security-17220 https://blackhat.com/us-19/briefings/schedule/#behind-the-sc...
kccqzy 7y ago
And researchers gave a talk this year at DEF CON that talked about defeating this exact security mechanism.

bt848 7y ago

Perhaps it would behoove security-sensitive users to use such devices, but they make up a tiny fraction of all iOS devices in the field. 90% of deployed iOS devices in the USA lack the A12 CPU and the number is higher abroad. Obsolete 32-bit CPUs are more common than CPUs with PAC.

saagarjha 7y ago
> Obsolete 32-bit CPUs are more common than CPUs with PAC. According to this (taken soon after iPhone XS/XR went on sale) this is not true: https://www.statista.com/statistics/755593/iphone-model-device-market-share-worldwide/ https://www.statista.com/statistics/755593/iphone-model-devi...
- bt848 7y ago
  That apparently costs $50/mo to read. But it seems to discuss iPhone only. The universe of iOS devices is not limited to iPhones.

ryacko 7y ago

You don’t need PAC if you disable scripts in Safari. Besides, baseband/browser/iMessage vulnerabilities are in the same price range. [i] It also isn’t difficult to infer what a “code signing bypass” is, so I guess being arrested is a good excuse to buy a new phone? (Assuming we’re talking about a state based actor, in control of the territory you live in) i. https://zerodium.com/program.html https://zerodium.com/program.html

saagarjha 7y ago
> You don’t need PAC if you disable scripts in Safari. Safari has multiple JITs. For example, aside from the JavaScriptCore compiler, there’s also a CSS selector JIT.