3 ms·
> a bank of 0-days, we don't know how deep. I think Apple should randomize data structure ordering, change flags and logic in the the memory allocator, and cho
by londons_explore 3y ago
> a bank of 0-days, we don't know how deep.
I think Apple should randomize data structure ordering, change flags and logic in the the memory allocator, and choose a different set of compiler optimizations with every release.
At least that way, most exploits and bugs will at least require an expert to put in substantial effort to update them to work on a new OS release, and many exploits won't be possible at all on a new release - if for example the exploit allows a stack buffer to overrun by 1 byte, then it depends what data follows the buffer - and if the compiler randomizes that, then in the next release it might become non-exploitable.
- saagarjha 3y agoThis is generally only a minor annoyance unless you really know what you're doing.
- paulryanrogers 3y agoDefense in depth. It raises the bar and making it more expensive and therefore less likely to be exploited
- newsclues 3y agoAlso makes the value of Pegasus increase.
- paulryanrogers 3y agoYet increases their costs to get / develop exploits
- saagarjha 3y agoThat’s not really how this works; the cost is marginal.
- paulryanrogers 3y agoIs it marginal only for best-in-the-world experts and a serious hurdle for everyone else? If so that's still worthwhile as it means the attacker must hire (or be) an expensive expert.
- saagarjha 3y agoThe bar for iOS exploitation is already one that only admits best-in-the-world experts.
- pc86 3y agoAnd if it really become anything more wouldn't they just buy a popular app through a shell company and get early access to the betas?
- saagarjha 3y agoThe betas are freely available to download.
- AdamN 3y agoMy understanding is that most of these zero-days are runtime so the above wouldn't help at all. The most recent one took advantage of Apple Wallet taking first dibs on a (virus) image and loading in the payload. Changing data structures/flags/compiler optimizations wouldn't have made a difference.
- londons_explore 3y agoThe process of going from [malicious image which gets loaded by apple wallet] to [shellcode running] depends hugely on compiler flags, memory layout, etc.