Moral_19 hours ago
SEAR and the Apple team does an excellent job of security on iOS, and should be commended greatly on that.
Not only are they willing to develop hardware features and plumb that throughout the entire stack, they're willing to look at ITW exploits and work on ways to mitigate that. PPL was super interesting, they decided it wasn't 100% effective so they ditched it and came up with other thigs.
Apple's vertical makes it 'easy' to do this compared to Android where they have to convince the CPU guys at QC or Mediatek to build a feature, convince the linux kernel to take it, get it in AOSP, get it in upstream LLVM, etc etc.
Pointer authentication codes (PAC) is a good example, Apple said f-it we'll do it ourselves. They maintained a downstream fork of LLVM, and built full support, leveraged in the wild bypasses and fixed those up.
dagmx19 hours ago
One of the knock on benefits of this too is increased security across all platforms as long as someone exercises that code path on one of apples new processors with a hardened runtime.
In theory it makes it easier to catch stuff that you can’t simply catch with static analysis and it gives you some level of insight beyond simply crashing.
devttyeu8 hours ago
And after all that hardcore engineering work is done, iMessage still has code paths leading to dubious code running in the kernel, enabling 0-click exploits to still be a thing.
aprotyas7 hours ago
That's one way to look at it, but if perfection is the only goal post then no one would ever get anywhere.
[deleted]3 hours agocollapsed
walterbell3 hours ago
Disable iMessage via Apple Configurator MDM policy and enable Lockdown Mode.
Citizen83962 hours ago
I imagine the latter is sufficient.
PS: make sure you remove that pesky "USB accessories while locked allowed" profile that Configurator likes to sneak in.
wat100003 hours ago
What's the dubious code?
Running something in the kernel is unavoidable if you want to actually show stuff to the user.
michaeltan hour ago
In ~2020, it was:
Attacker sends an imessage containing a PDF
imessage, like most modern messaging apps, displays a preview - which means running the PDF loader.
The PDF loader has support for the obsolete-but-part-of-the-pdf-standard image codec 'JBIG2'
Apple's JBIG2 codec has an exploitable bug, giving the attacker remote code execution on the device.
This exploit was purchased by NSO, who sold it to a bunch of middle eastern dictatorships who promptly used it on journalists.
https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
mikevm7 hours ago
[dead]
pjmlp11 hours ago
Google could have added MTE for a couple of years now, but apparently don't want to force it on OEMs as part of their Android certification program, it is the same history as with OS updates.
palata8 hours ago
Don't the Pixels have MTE? Definitely GrapheneOS does, at least to some extent.
pjmlp8 hours ago
Kind of, you need to enable it on developer tools, also Pixels are Google's, not the other OEMs.
https://developer.android.com/ndk/guides/arm-mte
https://source.android.com/docs/security/test/memory-safety/...
kangs3 hours ago
to be fair, most of MTE's benefit is realized by having enough users running your apps with MRE enabled, rather than having it everywhere.
This is because MTE facilitate finding memory bugs and fixing them - but also consumes (physical!) space and power. If enough folks run it with, say Chrome, you get to find and fix most of its memory bugs and it benefits everyone else (minus the drawbacks, since everyone else has MTE off or not present).
trade offs, basically. At least on pixel you can decide on your own
alerighi7 hours ago
They do that now because they care about your security, but to make it difficult to modify (jailbreak) your own devices to run your own software that is not approved by Apple.
What they do is against your interests, for them to keep the monopoly on the App Store.
EasyMark6 hours ago
It can be both things, security and user lock in, those are orthogonal goals.
darkamaul6 hours ago
Loosely related, but they also announced an increase in their bug bounty program during Ivan Krstić's Keynote at Hexacon. [0]
[0] https://security.apple.com/blog/apple-security-bounty-evolve...
bfirsh3 hours ago
Whenever I read about it, I am surprised at the complexity of iOS security. At the hardware level, kernel level, all the various types of sandboxing.
Is this duct tape over historical architectural decisions that assumed trust? Could we design something with less complexity if we designed it from scratch? Are there any operating systems that are designed this way?
Citizen83962 hours ago
Vulnerabilities are inevitable, especially if you want to support broad use cases on a platform. Defense-in-depth is how you respond to this.
MBCook2 hours ago
iOS is based on MacOS is based on NeXT is a Unix.
It’s been designed with lower user trust since day one, unlike other OSes of the era (consumer Windows, Mac’s classic OS).
Just how much you can trust the user has changed overtime. And of course the device has picked up a lot of a lot of of capabilities and new threats such as always on networking in various forms and the fun of a post Spectre world.
KerrAvonan hour ago
>Is this duct tape over historical architectural decisions that assumed trust?
Yes, it's all making up for flaws in the original Unix security model and the hardware design that C-based system programming encourages.
> Could we design something with less complexity if we designed it from scratch? Are there any operating systems that are designed this way?
Yes, capability architecture, and yes, they exist, but only as academic/hobby exercises so far as I've seen. The big problem is that POSIX requires the Unix model, so if you want to have a fundamentally different model, you lose a lot of software immediately without a POSIX compatibility shim layer -- within which you would still have said problems. It's not that it can't be done, it's just really hard for everyone to walk away from pretty much every existing Unix program.
fragmede2 hours ago
> seL4 is a fast, secure and formally verified microkernel with fine-grained access control and support for virtual machines.
https://medium.com/@tunacici7/sel4-microkernel-architecture-...
It's missing "the rest of the owl", so to speak, so it's a bit of a stretch to call it an operating system for anything more than research.
kangs3 hours ago
why not do both :)
I think that there's also inherent trust in "hardware security" but as we all know its all just hardcoded software at the end of the day, and complexity will bring bugs more frequently.
encom3 hours ago
Security in this context means the intruder is you, and Apple is securing their device so you can't run code on it, without asking Apple for permission first.
thewebguyd2 hours ago
It can be both.
Any sufficiently secure system is, by design, also secure against it's primary user. In the business world this takes the form of protecting the business from its own employees in addition to outside threats.
fsflover2 hours ago
Have they fixed regular, unencrypted connections on updates and apps launch yet?
https://sneak.berlin/20231005/apple-operating-system-surveil...
[deleted]2 hours agocollapsed