4 ms·
Apple has already largely crushed hacking with memory tagging on the iPhone 17 and lockdown mode. Architectural changes, safer languages, and sandboxing have do
by Gigachad 7mo ago
Apple has already largely crushed hacking with memory tagging on the iPhone 17 and lockdown mode. Architectural changes, safer languages, and sandboxing have done more for security than just fixing bugs when you find them.
- mcast 7mo agoLockdown mode is opt-in only though
- Gigachad 7mo agoIt is, but if you are the kind of person these exploits are likely to target, you should have it on. So far there have been no known exploits that work in Lockdown Mode.
- JumpCrisscross 7mo ago> if you are the kind of person these exploits are likely to target, you should have it on You can also selectively turn it on in high-risk settings. I do so when I travel abroad or go through a border. (Haven't started doing it yet with TSA domestically. Let's see how the ICE fiasco evolves.)
- Gigachad 7mo agoFor entering the US you want to fully wipe your phone first. Lockdown mode is useless since they will just hold you in a basement until you unlock the phone for them to clone.
- JumpCrisscross 7mo ago> Lockdown mode is useless since they will just hold you in a basement until you unlock the phone for them to clone If this is a risk for you, sure. Wipe it. For most people they may ask to fiddle around with it before giving it back.
- no-reply 7mo agohttps://xkcd.com/538/ https://xkcd.com/538/
- snazz 7mo agoAs I understood it, Memory Integrity Enforcement adds an additional check on heap dereferences (and it doesn’t apply to every process for performance reasons). Why does it crush hacking rather than just adding another incremental roadblock like many other mitigations before?
- Gigachad 7mo agoI'm not certain there is a performance hit since there is dedicated silicon on the chip for it. I believe the checks can also be done async which reduces the performance issues. It also doesn't matter that it isn't running by default in apps since the processes you really care about are the OS ones. If someone finds an exploit in tiktok, it doesn't matter all that much unless they find a way to elevate to an exploit on an OS process with higher permissions. MTE (Memory Tagging Extension) is also has a double purpose, it blocks memory exploits as they happen, but it also detects and reports them back to Apple. So even if you have a phone before the 17 series, if any phone with MTE hardware gets hit, the bug is immediately made known to Apple and fixed in code.
- saagarjha 7mo agoAn exploit in TikTok is bad if your goal is to gain access to a TikTok account. And there is a performance hit it’s just largely mitigated through selective application
- 3pt14159 7mo agoIf what you are saying is true, then you would see exploit marketplaces list iOS exploits at hundreds of millions of dollars. Right now a cursory glance sets the price for zero click persistent exploit at $2m behind Android at $2.5m. Still high, and yes, higher than five years ago when it was around $1m for both, but still not "largely crushed". It is still easy to get into a phone if you are a state actor.
- lmf4lol 7mo agoHi, would you mind explaining how this works? Something is finding an exploit in Android/iOS and then he sells it for 2.5m/2m on some dark market?
- saagarjha 7mo agoIt’s somewhat more complicated than this but vaguely yes
- lmf4lol 7mo agointeresting. and how do they find a buyer? is there a marketplace for this? sorry for the dumb questions. I know nothing about this field :-)
- saagarjha 7mo agoYes, that’s the complicated part. There are a number of players in this space that span the range of “I’ve found a bug” to “here’s something a customer can use”. Each gets progressively more money for the value add. You can capture more for yourself if you do more of the steps. Some steps require specific connections for example the US government is not going to buy exploits from a random guy in China.
- squeaky-clean 7mo agoThose are for devices not in lockdown mode.
- saagarjha 7mo agoMemory tagging has not “crushed hacking” it’s just changed the kinds of exploits that work