Hacker News Reader

Comment by Analemma_ | Hacker News Reader

> It is worth noting that none of the exploits bypassed the new, PAC-based JIT hardenings that are enabled on A12 devices.

I'm surprised Apple doesn't talk more about how they're continuously upgrading the security of iPhones with new chip generations. I remember the BlackHat presentation on iPhone security from a few years ago [0] also found that there were attacks on older iPhones which didn't work on the (then-)newer ones. Is Apple afraid it will give the impression that existing phones are not secure?

[0]: https://news.ycombinator.com/item?id=12231758

View on HN

It is also worth noting that PAC is not a panacea. It's just one more thing to break before an attacker takes control. Given that one of the keys used in PAC is shared across all user-space processes including highly privileged unsandboxed processes (it must, as it's used by shared dynamic libraries), it's just a matter of finding one more user-space bug to leak the key and break PAC.

Even if the same key is shared by all processes, keys are stored in registers that are meant to be not accessible to userspace, so a disclosure vulnerability would not help here anyways.

You don't need to get the key per se, depending on your exploit. You just need a single valid signed pointer that's involved in your ROP gadget.

Apple gave a talk this year at BlackHat that talked about some of the new security mechanisms.

Link?

No slides, unfortunately: https://blackhat.com/us-19/briefings/schedule/#behind-the-sc...

And researchers gave a talk this year at DEF CON that talked about defeating this exact security mechanism.

You don’t need PAC if you disable scripts in Safari. Besides, baseband/browser/iMessage vulnerabilities are in the same price range. [i]

It also isn’t difficult to infer what a “code signing bypass” is, so I guess being arrested is a good excuse to buy a new phone? (Assuming we’re talking about a state based actor, in control of the territory you live in)

i. https://zerodium.com/program.html

> You don’t need PAC if you disable scripts in Safari.

Safari has multiple JITs. For example, aside from the JavaScriptCore compiler, there’s also a CSS selector JIT.

Talking about security inevitably triggers fear. That’s fine for some products, but absolutely unacceptable for large consumer brands with positive reputations.

Perhaps it would behoove security-sensitive users to use such devices, but they make up a tiny fraction of all iOS devices in the field. 90% of deployed iOS devices in the USA lack the A12 CPU and the number is higher abroad. Obsolete 32-bit CPUs are more common than CPUs with PAC.

> Obsolete 32-bit CPUs are more common than CPUs with PAC.

According to this (taken soon after iPhone XS/XR went on sale) this is not true: https://www.statista.com/statistics/755593/iphone-model-devi...

That apparently costs $50/mo to read. But it seems to discuss iPhone only. The universe of iOS devices is not limited to iPhones.

Reply on news.ycombinator.com