12 ms·
Apple Exclaves
- transpute 2y agoRelated thread, "Apple rearranged its XNU kernel with exclaves", https://news.ycombinator.com/item?id=43314171 https://news.ycombinator.com/item?id=43314171
- tptacek 2y agoFor what it's worth, this article is much better.
- metadat 2y ago100% agree. The discussion has been underwhelming: I read TFA and wasn't sure what to even make of it.
- gnabgib 2y agoThat is underwhelming! (But also.. that's *this* discussion.. and the other discussion is already linked by GP.. so I'm not really sure what you're aiming for here)
- metadat 2y agoOnly attempting to share information. Is there an unstated next step (or next-next step) given Apple's moves? A gentle suggestion for a more interesting / entertaining article currently on the front page with a glance: https://news.ycombinator.com/item?id=43311696 https://news.ycombinator.com/item?id=43311696 Hatching a Conspiracy: A BIG Investigation into Egg Prices https://www.thebignewsletter.com/p/hatching-a-conspiracy-a-big-investigation https://www.thebignewsletter.com/p/hatching-a-conspiracy-a-b... P.s. @gnabgib thanks for all your excellent dupe postings! I used to do a lot but life got busier. You are appreciated. Edit: @thrdbndndn: My bad, yes this submitted article is the one that sucks. Thank you! If you delete your reply it will make things less confusing, but no worries and best wishes.
- thrdbndndn 2y agoHe's saying you're posting the HN URL of this very discussion to.. this discussion.
- deleted 2y ago[deleted]
- transpute 2y agoFor more detail, there's a 3-part series on iOS SPTM and TXM: Aug 2023, https://www.df-f.com/blog/ios17 https://www.df-f.com/blog/ios17 Nov 2023, https://www.df-f.com/blog/ios-17round2 https://www.df-f.com/blog/ios-17round2 Feb 2025, https://www.df-f.com/blog/sptm3 https://www.df-f.com/blog/sptm3
- saagarjha 2y agoSomewhat less detail, actually.
- transpute 2y agoDF blog series source reference, https://randomaugustine.medium.com/on-apple-exclaves-d683a2c37194 https://randomaugustine.medium.com/on-apple-exclaves-d683a2c... I would particularly like to highlight the work of Dataflow Forensics and their much more advanced work dissecting SPTM without the benefit of source code. I enthusiastically await their promised blog post about exclaves and hope they will answer many of the remaining questions, provide gory disassembly explanations, and correct all my mistakes and assumptions!
- saagarjha 2y agoThey are being polite. The Dataflow blog post barely goes beyond running strings.
- transpute 2y ago> They are being polite. Are they? The article's closing paragraph advertises a _future_ Dataflow blog post to the reader. Their follow-up March correction is consistent with the Dataflow Feb summary, https://randomaugustine.medium.com/more-speculation-on-exclaves-d4b94182b54b https://randomaugustine.medium.com/more-speculation-on-excla...
- saagarjha 2y ago
- GeekyBear 2y agoAn overview from that piece: > exclaves refer to specific resources that are separated from the main kernel (XNU) and cannot be accessed by it, even if the kernel is compromise Also interesting: > It’s not uncommon for mid-cycle releases of macOS to gain new features in preparation for the next major version. Perhaps the most fundamental and significant added to Sonoma 14.4, together with iOS 17.4, iPadOS 17.4 and watchOS 10.4, are exclaves. https://eclecticlight.co/2024/08/20/sonomas-unfinished-business-exclaves-conclaves-and-the-kernel/ https://eclecticlight.co/2024/08/20/sonomas-unfinished-busin...
- saagarjha 2y ago> In macOS 15 and later, creation of a VM running macOS 15 or later can configure an identity derived from the host Secure Enclave, enabling access to resources requiring Apple ID including iCloud. This is accomplished using an exclave of the Secure Enclave. This is not correct
- kennysoona 2y agoHow is it incorrect?
- saagarjha 2y agoIt just straight up doesn’t make sense. Honestly I would not be surprised if this was the result of going, hmm, enclave…exclave…seems like these must be related. They’re not really related other than the idea being isolation (which they do completely differently). Also Apple ID sign in on VMs is literally just “the host shares its information to the guest” there’s nothing special going on here
- totetsu 2y agoMy crusty squinty morning eyes read that as “ it can lead to a complete system compromise, as all the operating system’s functions are bundled together in the kernel’s single “breakfast of eggs”.” .. now I wish this was the idiom.
- markus_zhang 2y agoI'm not familiar with that level of knowledge, but from the look of it you can attack the enclave itself to escalate privilege higher than the kernel enjoys? Is this piece of hardware something like a co-processor?
- saagarjha 2y agoAn exclave isn’t hardware, it’s an isolated piece of software that deals with a certain sensitive operation that you don’t want the kernel to have access to. So if you exploit it, then yes you have access to something that the kernel doesn’t–but that’s the point, because the goal is if you exploit the kernel you shouldn’t get access to that.
- markus_zhang 2y agoOh thanks for the explanation!
- alfiedotwtf 2y agoIf it’s all in software but the kernel has lower privileges, I’m curious how they’ll be able to update it? And if there is an API to update via the kernel, what’s stopping a push via a malicious source pretending to be Apple?
- saagarjha 2y agoI don't think it is accurate to say that the kernel has lower privileges. It's just something the kernel isn't allowed to do, while the exclave has a list of things it isn't allowed to do. Also exclaves are shipped with normal software updates (verified by the boot chain, not the kernel).
- brookst 2y agoLess than entirely confident stab (someone please correct if I get this wrong): - Exclave exposes a small set of functions that kernel may call for sensitive operations - One of those is “update exclave”. The input to this is a blob signed with Apple’s private key. - Exclave verifies signature, so a compromised kernel and push a malicious update How the exclave gets Apple’s public key is a little opaque to me. One way would be to have the exclave have its own (per device or per global version) private key, but client side private keys are very high risk. Alternatively, perhaps some elaborate set of baked-in public keys for Apple and a way to validate a CRL?
- transpute 2y ago> SK runs on the same high speed application processors as XNU/iOS. To make this possible, additional processor privilege levels are required — likely supported by virtualization extensions Recent Apple phone and laptop SoCs include hardware support for nested virtualization, including the M4 iPad Pro where an exclave is used for the camera LED. Hopefully the next revision of the Apple Platform Security guide will cover SK exclaves and baseband mitigations for Wi-Fi radar sensing, https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf https://help.apple.com/pdf/security/en_US/apple-platform-sec... > Apple specific additions to SPTM SPTM reverse engineering, https://www.df-f.com/blog/sptm3 https://www.df-f.com/blog/sptm3 XNU is being refactored into a micro-kernel inspired architecture, aiming to reduce its code base, and move security sensitive operations out of it. The memory space isolation is performed with the help of a Secure Page Table Monitor - SPTM. The code signing, entitlement verification, Developer Mode, Restricted Execution Mode, and other security sensitive operations are handled by the Trusted eXecution Monitor - TXM. > or most likely via ARM’s TrustZone technology. The XNU source code contains several references regarding transitions to and from TrustZone’s concept of a secure world 150+ TrustZone CVEs, https://www.cve.org/CVERecord/SearchResults?query=trustzone https://www.cve.org/CVERecord/SearchResults?query=trustzone > it’s a defensive effort on a larger scale than any other end user device manufacturer is currently attempting Google implemented pKVM on Pixels with hardware nested virtualization a few years ago, and upstreamed the code to Linux mainline, including cooperative de-privileging of TrustZone relative to pKVM L0. But they have not announced defensive features using pKVM/AVF, outside of Debian "Linux Terminal" VM.
- transpute 2y agoThe author published a follow-up post and revised diagram, https://randomaugustine.medium.com/more-speculation-on-exclaves-d4b94182b54b https://randomaugustine.medium.com/more-speculation-on-excla... > While I speculated that TrustZone was being used, exclaves may well use the existing SPTM and GXF (Guarded Execution) privilege levels after all. One implication may be that there is no hard reason they couldn't be supported on iPhone 13 and higher, aside from RAM requirements and development effort. Make no mistake these are huge undertakings even for Apple.
- als0 2y ago
- saagarjha 2y ago> Apple may use SPTM to manage transitions between the secure and insecure worlds This, because they don’t have TrustZone
- neom 2y agoI think Steve truly believed at his core, very simply: your laptop is your diary, and they have a responsibility to that. I don't think Tim would be CEO if he didn't believe what Steve did. It's so weird, but I really miss Steve. https://www.youtube.com/watch?v=Ij-jlF98SzA https://www.youtube.com/watch?v=Ij-jlF98SzA
- musicale 2y agoIt is weird. Jobs was divisive and (not infrequently) abrasive, and why would you miss a tech billionaire anyway? Yet I also feel indebted to him and to the folks at Apple who helped to produce some of my favorite products like the Mac, the iPod, and the iPad. Jobs also said a lot of things that still resonate with me. Recently Apple introduced a "classic Mac" screensaver that shows how carefully designed the original Mac GUI was. I'm sure nobody misses the days when app bugs could crash the OS, but I wish Apple were as obsessive now about detail now as they were back then.
- neom 2y agoNow that I'm becoming an old man, I've taken the time to go back and listen to him properly, to analize his thoughts and words a bit more contextually, and I've come to believe that Steve Jobs was quite misunderstood, both by us, and by himself. When I miss him I think: his thoughts were so very refined for his time, it is quite incredible and I wish he was around to hear more of them. I guess I'm a fan? Oh well...worse things to be. (the article is good but giving you the hn for comments too: https://news.ycombinator.com/item?id=2131299 https://news.ycombinator.com/item?id=2131299)
- 6stringmerc 2y agoI still think about how he tried to cure cancer with crystals and then when that didn’t work he used his wealth to get residency in a different state to jump in line for a transplant and still died before his yacht got completed. I don’t misunderstand him at all. Especially the parking in handicap spaces part. Very easy to understand what kind of person he was through his actions. Perhaps we will never see eye to eye, and I feel posts like yours do deserve legitimate opposition as applicable.
- kazinator 2y agoIf most of the stuff the user cares about is inside the "Insecure World" bubble of the diagram, then this whole business is, like, for shit. It serves only the platform provider, who can decide which programs may or may not be installed based on whether they are aligned with or against their competitive interests.
- vermilingua 2y agoThis is just plainly false. Passkeys, biometrics, app permissions, and a suite of other user-centric privacy features have clear benefit from strong isolation from an "insecure world" kernel.
- hedora 2y agoHow so? Isn’t this just the xkcd authorization model? https://xkcd.com/1200/ https://xkcd.com/1200/ I tried to read the article, and know what all the words mean (sel4, enclaves, virtualization primitives, etc.). It all seems very complicated and error prone, but I couldn’t figure out what the attack model is, or what the security objectives are. Eg, what sorts of things run in exclaves, and under what circumstances will a persistent kernel level compromise on my laptop protect those things?
- timewizard 2y agoWhat he misses is "tamper evidence." In order to do those things I have to actually steal his laptop. Which would be obvious to him. It also implicates me. If I could just remotely install a driver I don't need to worry about any of that and I can steal remotely and anonymously.
- hedora 2y agoCan’t you just remotely install a keylogger (e.g. a modified version of zoom)?
- 2y ago
- akyuu 2y agoI wonder how this will affect macOS security, since SPTM is not used according to Apple documentation: https://support.apple.com/guide/security/operating-system-integrity-sec8b776536b/web https://support.apple.com/guide/security/operating-system-in... For now, I think existing exclaves such as the one that displays the camera indicator do not really apply to macOS (since MacBooks have dedicated hardware for that), but in the future there might be exclaves that do.
- wtallis 2y ago> since SPTM is not used according to Apple documentation: Try reading that footnote again: > Note 2: Page Protection Layer (PPL) and Secure Page Table Monitor (SPTM) enforce the execution of signed and trusted code on all platforms with the exception of macOS (because macOS is designed to run any code). All of the other security properties, including the protection of page tables, are present across all supported platforms. It doesn't say macOS doesn't use SPTM. It says macOS doesn't use SPTM to prevent running unsigned code, since macOS is supposed to allow unsigned code (after the user jumps through some hoops).
- saagarjha 2y agoThat document is wrong and has been wrong for years (FB13803014)
- deleted 2y ago[deleted]
- brcmthrowaway 2y agoWhat impact does this have in the user
- saagarjha 2y agoIt makes your device more secure.
- yalogin 2y agoWho is this author? It’s a very elaborately, well written post. Great job. Having followed exclaves myself this is well done
- eleveriven 2y agoThis was an incredibly well-researched and well-written deep dive. It's rare to see such a thorough breakdown of something as technical as exclaves while still making it engaging to read.
- ZebraDude 2y agoVery interesting
- teknologist 2y agoI wonder if it's possible for app devs to use Exclaves. The thing that irks me about Apple is that they invent this new amazing internal stuff but then completely wall it off from devs, leaving everyone else (banking apps, wallets, secure messaging, etc.) to continue running in unsecured user space.
- saagarjha 2y agoCurrently no.
- dwaite 2y agoMy understanding is no with the current design - exclaves are built into the overall OS and started as part of the boot process, so they are relatively static. I suspect these components have static relationships for security reasons. They are also kernel-to-kernel currently, so third party support would likely be limited to implementing things like secure device drivers. However, Apple has been trying to push third party drivers to user space, not to the hypervisor. Based on that migration happening in parallel with this development, I do not suspect they plan to pivot and have third party driver developers use exclaves. It is pretty common for Apple to do significantly more stabilization of kernel-imposed platform features like this internally before exposing to third parties (see also pointer authentication a la arm64e).
- mike_hearn 2y agoThey don't do that. Apple userspace has continually got more secure too. One simple example: recent versions of macOS run all apps inside a sandbox, even those that don't opt in. One thing the sandbox blocks is apps modifying each others files, which up until then had been a major weakness of the security system (signatures of a bundle were checked at first-run, but not on every execution).
- hello_computer 2y agoApple works wonders protecting their plantation, but what protects you from them? Have any of you pondered the prospect of “the last geohot”?
- vintagedave 2y agoI had to google. There's a hacker called geohot, is that what this comment is referring to? Could you explain what you mean more please?
- hello_computer 2y agohe was the first to jailbreak the iphone. where do you see things going when they release an un-jailbreakable iphone?
- vintagedave 2y agoThey're pretty close now, and I'm increasingly dissatisfied with software on both iOS and macOS. The privacy features for messaging and cloud storage, plus not having to worry (as much) about security as I might with Linux, are the only reason I still use Apple. Every year I get more and more disappointed though. More and more nostalgic for the Apple software I used to enjoy using.
- kennysoona 2y agoI wonder how this compares to Linux Virtualization based Security? From the page[1] with the video: a security feature that can a) harden the kernel and b) ensure that critical kernel resources remain untampered, even if the kernel gets compromised. VBS uses hardware virtualization and the hypervisor (Hyper-V) to create an isolated virtual environment that runs as a higher trust level, called Virtual Trust Level 1 (VTL1). VTL1 has its own kernel, separate from the Guest kernel, referred to as the Secure Kernel. [1] https://lssna24.sched.com/event/1aIeD/linux-virtualization-based-security-anna-trikalinou-microsoft-corporation-thara-gopinath-microsoft https://lssna24.sched.com/event/1aIeD/linux-virtualization-b...
- saagarjha 2y agoExclaves run at a parallel trust level.
- lambdaone 2y agoI'm quite surprised that they use a secure exclave to control the physical camera LED - this is absolutely massive overengineering to do something very simple. A tiny bit of hardwired dedicated logic integrated into the camera module would be more than adequate to do this - just gating of either the digital I/O or the power to the camera, and a pulse-stretcher so the LED goes on for at least a few seconds each time to prevent an attack by rapidly flicking the camera logic on and off. A similar circuit for the microphone with a different-coloured physical LED - not just a software-controlled dot on the screen - would be a good idea too.
- brookst 2y agoIt gets complicated. “The camera” is a bunch of parts. You’d probably want to key off of the CMOS sensor power, but that has several power levels for standby, sleep, idle. So your hardware circuit would likely to know current, not just voltage. Or maybe go upstream and parse the I2C (or whatever) messages signaling power mode changes? And then your LED driver would need to know screen brightness (or connect to the ambient light sensor) because you want to be bright enough to see in direct sunlight, but that level of brightness would be unpleasant (and maybe screw up legit camera use) in low light. So if you believe your SK is secure, you can do a better job more simply by using it. And if you don’t think SK is secure, all bets are off anyway.
- jjtheblunt 2y agoYou can’t just add circuits and discrete components like an extra led without screwing up RF sensitivity. Cf. “Rf desense”, for example.
- andrewcl 2y agoYou have to wonder if it is over engineering, or a resolution for something they've discovered from shipping so many phones. I wouldn't think of the camera as a security vector, but maybe Apple thinks it is?
- TheNewsIsHere 2y agoThe camera and mic are generally regarded as security sensitive because of the possibility that they can be used to surveil. That’s why it’s a selling point to have physical hardware or hardware-bound controls or indicators that can’t be bypassed by the OS.
- talkingtab 2y agoReference to Mach for historical reasons. Using IPC instead of traps. https://en.wikipedia.org/wiki/Mach_(kernel) https://en.wikipedia.org/wiki/Mach_(kernel)
- api 2y agoWe could have avoided so much hardware and OS complexity if we'd instead (mostly) discarded the idea of shipping and running compiled code directly on the hardware. TL;DR: we are doing things in hardware that ought to be done in software, and we're giving software too close to metal access. User mode should be something like the JVM, but more language-neutral, something based around WASM for example. The runtime for this should ideally be written in a memory safe language and very extensively tested. User mode code should not have access to raw pointers, raw CPU, etc. If we'd done this we also could have elevated things like the common API beyond the lowest common denominator of C. We used to have a ton of research and some fielded systems like this: Smalltalk, LISP machines, the JVM, the CLR, etc. The JVM and the CLR are still quite alive and well but the HN world seems to hate them for some reason. Smalltalk and efforts like the LISP machines died out.
- jandrewrogers 2y agoSo your solution is to nerf the computer in terms of both performance and functionality? There is a lot of software that cannot be properly written without being very close to the metal e.g. database kernels.
- api 2y agoThere would almost certainly be an escape hatch, but it would require user approval to run native code. It would probably be in the form of libraries that could be 'blessed' to run native. The vast majority of software does not need this.
- sroussey 2y agoMS had a research project that built an OS from CLR. One of the great things about it (in my opinion) was the lack of context switching. It broke a fundamental assumption about how an OS should work. It could also do global optimizations.
- api 2y agoOh yeah, forgot about that: you can do profile guided optimization on the entire running image of code in the machine. I wonder how much of a boost you'd get for that? I'm sure it would depend on the work load.
- curtisszmania 2y ago[dead]
- cantrecallmypwd 2y agoseL4 is awesome for its formal engineering. One of the main gotchas though with purer (less hybrid) microkernel architectures is the coordination of transactions that touch multiple services, i.e., a system call or event that touches multiple hardware areas and must execute rollback code should any one of them fail.
- Cheng2023 2y ago[dead]
- Cheng2023 2y ago[dead]
- cytocync 2y ago[dead]
- fedxc 2y agoI see exclaves as a significant but intermediate step. Apple is making XNU less of a liability, but they're still playing defense instead of fully embracing a microkernel architecture. If I had to bet, exclaves will be a bridge to something bigger, either a more modular OS (like Fuchsia) or a CHERI-inspired security model where memory safety is enforced at the hardware level. Apple is leading the pack in consumer OS security, but exclaves are a patchwork improvement rather than a total rethinking of system design. That said, this is probably the biggest security shift in mainstream OS design in the last decade, and it will take years before we see its full impact.
- deleted 2y ago[deleted]
- JoachimS 2y agoI see it as a way to move back to the micro kernel it once was - with modern solutions and new requirements. Security was much less of a concern when Mach was created. With the insane performance we now get in the machines, the overhead caused by the micro kernel process communication may well be negligible.
- prolefeed 2y agoI enjoyed the obvious references to The Expanse in the naming of secure/insecure world transitions (Ring Gate) and the RPC framework (Tightbeam)