5 ms·
While iOS seems to pioneer every mitigation technique ever described in the literature, they also shipped ancient versions of C image parsing libs (OpenEXR), ha
by stefan_ 6y ago
While iOS seems to pioneer every mitigation technique ever described in the literature, they also shipped ancient versions of C image parsing libs (OpenEXR), have an endless stream of remote code execution vulnerabilities from their peculiar serialization schemes and all the other issues you would expect from the use of native ObjC.
Their commitment is squarely to mitigating issues that threaten the walled garden (and therefore the kernel), not so much userspace.
- RL_Quine 6y agoI don't think that's really fair, those classes of exploits (ie, libtiff / jailbreak.me) were around a decade ago now.
- tsbinz 6y agohttps://googleprojectzero.blogspot.com/2020/04/fuzzing-imageio.html https://googleprojectzero.blogspot.com/2020/04/fuzzing-image... isn't a decade old, on the contrary.
- pjmlp 6y agoSolaris on SPARC did hardware memory tagging much earlier than iOS.
- saagarjha 6y agoiOS doesn’t actually do hardware memory tagging at all.
- pjmlp 6y agoYes it does after iPhone X, aka pointer validation in Apple speak.
- saagarjha 6y agoPointer authentication is not hardware memory tagging. (Also, PAC shipped with iPhone XS.)
- pjmlp 6y agoPlaying word games when the actual technical outcome for preventing memory corruption is the same one.
- saagarjha 6y agoNo, they are entirely different features. Pointer authentication is largely a control-flow integrity feature. Hardware memory tagging attempts to prevents arbitrary overwrites/memory corruption, even to data. There are dozens of other features that prevent memory corruption and it's not really "playing word games" to distinguish between them.
- pjmlp 6y agoIt is still conceptually the same from my point of view, and the data structures used by the hardned runtime.
- saagarjha 6y agoI assume you're not talking about this: https://developer.apple.com/documentation/security/hardened_runtime https://developer.apple.com/documentation/security/hardened_...? And to your other point: the difference between these things do matter because they have entirely different semantics and protect against different things, although the overarching goal of preventing undesired operation is the same. Taking the metaphor one level up to apply to computer science rather than security, this is like saying that the borrow checker and asserts are both the same from a certain point of view because they both help prevent bugs. Which is true, of course, but when you're talking about a programming language's safety features saying something like "C can prevent use-after-free because of its borrow checker" is not correct nor can you make it relevant by saying something like "yeah but C has asserts and they also help prevent bugs so from my point of view I think you're being pedantic".
- amluto 6y agoThe issue doesn’t seem to be ObjC per se. It’s the use of a facility that tries to transparently serialize an object in any rich language. Python pickle has the same issue, although it’s arguably worse in Python. The solution is to abandon the whole approach — these systems should not be used across trust boundaries. Apple should create iMessage v2 using a real serialization system (protobuf, JSON, XML, ASN.1, etc) and deprecate the old scheme. It’s surely possibly to write a safe but non-extensible deserializer for the old protocol if compatibility is needed.
- saagarjha 6y agoiOS also sometimes creates their own mitigation techniques. Sometimes these are quite strong but often they are…not really mitigating anything; in rare cases they make the situation worse. Shipping every mitigation under the sun is not necessary a good idea.
- dontbenebby 6y ago>Their commitment is squarely to mitigating issues that threaten the walled garden (and therefore the kernel), not so much userspace. As a practical matter, doesn't this mean if I'm confident in my ability to avoid phishing messages, iOS is better? Anything that "roots" a phone can also run roughshod, turn on my mic, grab signal messages stored locally, etc, correct? What I'm getting at is a phone in a walled garden + a laptop that's open source might be the best way to get the security of the walled garden and the utility of open source.
- stefan_ 6y agoI'd argue it is the opposite. The people that want to grab your Signal or WhatsApp messages can often do so by simply sending your some picture or specially crafted message; it's only the people that want to run their own software that need to break all the kernel defenses and 'root' the device.
- fomine3 6y ago"confident in my ability to avoid phishing messages" is not a good way for security.
- dontbenebby 6y agoI literally designed antiphishing trainings. I also have Firefox containers for important things like banking - a phishing url from my email will not open in the correct container. Huge red flag.