Hacker News Reader

Comment by MuffinFlavored | Hacker News Reader

> The exploit allows only tethered jailbreaks, meaning it lacks persistence. The exploit must be run each time an iDevice boots.

Could it be made to persist?

> Checkm8 doesn't bypass the protections offered by the Secure Enclave and Touch ID.

Could it be made to bypass the Secure Enclave?

View on HN

> Could it be made to persist?

Unlikely and that'd be something Apple can patch at their leisure.

> Could it be made to bypass the Secure Enclave?

That's not how this works. The Secure Enclave generates and stores asymmetric encryption keys and exposes an interface to perform various operations with these keys. Retrieving the keys is not possible. You'd need a separate vulnerability in Secure Enclave. Once you found a Secure Enclave exploit you need to run it, yes and iOS does not want you to run it yes, but let's face it: anyone having the mastery to break the Secure Enclave is more than likely to have an entire stash of iOS zerodays...

> Could it be made to persist?

I don't think persistence is necessary. How often do people actually power off their smartphone? What most people think of as the "power button" only locks the screen (and puts the CPU into a "suspend" state to save power). Most people would have an "uptime" of months on their smartphone.

If you’re in the Beta program, you might get a new OS point-release installed (thus restarting your phone) every few days at some points (such as at new-major-release RC time.)

How often do people actually power off their smartphone?

If you have iOS with auto-updates on, then it can reboot several times a year when Apple releases point updates. Or at least once a year when the new big version of iOS comes out.

(Unless I'm mistaken and iPhones no longer reboot on point updates anymore, but I'm pretty sure they still do.)

Not an issue because the attacker can disable these updates.

I know, N=1 but I turn off my phone completely every night.

Out of curiosity, why?

  - Part out of habit (since way before 'Do not disturb' mode), I want no disturbances when I sleep.
  - Because it saves battery/energy
  - No connected device in the bedroom (OK, I got a Kindle)
  - I (honestly) don't see any sense in having my phone run for ~7 hours while I'm asleep

Why do you not turn off yours?

the obvious reasons would be, to be reachable in case of emergency and as an alarm clock.

Sure, that makes sense. I hope my peers don’t call me, but emergency services if something bad happens. And my immediate family is at home with me. And I have an alarm clock on the bedside table ;)

On new devices it hardly saves any battery because iOS (or maybe just the latest iPhones) have become wickedly good about preserving battery when idle.

Sure, but I’m a) still really happy with my iPhone SE and b) think it’s unnecessary to leave it in while sleeping.

With further exploits, possibly, but not with Checkm8 alone.

The lack of persistence could be worked around by a small enough device disguised as a phone charger. A sufficiently motivated actor could use a human asset to plant/replace such chargers at a target’s home/work.

It’d surprise me if you couldn’t embed the necessary hardware required to run this inside a USB cable.

The exploit requires the device to be put into DFU mode first and can’t be triggered by connecting a cable alone.

From the article:

You have to have a cable connected to your device and put your device into DFU mode, and that requires you to hold buttons for a couple seconds in a correct way

The exploit doesn’t work just by powering on with a hacked USB device, you have to boot in DFU mode, which requires holding a specific combination of buttons as it’s powered on. The article covers this.

You have to put the phone into DFU mode. Yes, this is a serious flaw, but in the last 24h the overreactions have already become the stuff of legends.

> Could it be made to bypass the Secure Enclave?

Well, drilling each individual chip is not economical, but doable. Usually it only meant to get something out, not in.

Reply on news.ycombinator.com