Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exploiting the Wi-Fi Stack on Apple Devices

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

61–70 of 85 posts

Re: Exploiting the Wi-Fi Stack on Apple Devices

#61

Post by mikeash »

KozmoNau7 wrote: post #51
mikeash wrote: post #21

Earlier quoted context omitted.

The problematic scenario goes like this: 1. You're in a coffee shop. The WiFi sucks today. You turn off WiFi so you can use your cellular connection instead. 2. Many hours later, you go home, having forgotten about #1. 3. You binge-watch the entirety of Doctor Who streaming on your phone, not realizing the phone is still using cellular. 4. Large bill from your provider.

5. Realize you should have gotten a subscription with an adequate data plan. 6. Get said subscription. 7. Stop worrying.

I'm not aware of any option in this country (edit: the US) that will handle massive use of streaming video. All of the plans without overage charges have a soft limit where they start throttling you.

In any case, I'm not going to pay a bunch of extra money every month just in case I forget about the WiFi.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#62

Post by rightos »

e12e wrote: post #55
Moter8 wrote: post #48

Earlier quoted context omitted.

Cellebrite got into that phone. A presenter from the firm told us so. Apparently 300 devs work fulltime on mobile devices in Isreal to develop iOS/Android exploits, mostly for Law Enforcement or despots. He talked quite a bit about what you can get off the devices, but not much on the how to get into there. Apparently Android-encrypted phones are the safest though. They didn't have an exploit for them 2 months ago.

> Apparently Android-encrypted phones are the safest though. That's odd. I guess the implication is that iPhone hsm is broken (or they can get past a short pin via an exploit that allows brute forcing - typically an hsm should (be possible to configure to) permanently destroy the keys after N attempts). I suppose it demonstrates that secure encryption requires the user to memorise something equivalent of 96-128 bits…

There's also a relatively low attack value and attack surface for encrypted Android phones vs encrypted iPhones. Everyone who runs an iPhone has it encrypted, while relatively few people running Android devices have them encrypted. In terms of attack surface, the SecureEnclave has many APIs, some of which have had vulnerabilities in the past and it's quite possible to envision a scenario in which others were found and they're able to dump keys from it. It's also quite common on iOS to have weak PINs and similar low security measures, even just bypassing the mitigations against bruteforce attacks could allow them in to a huge number of device. On the other hand, people turning on disk encryption on Android are likely paranoid people who'll set giant passwords. So in terms of a numbers game, even a more basic exploit against iOS would look much more valuable.

In the Android case, often times you need to power off the device to really be protected as the key is just sitting in RAM. But if you've got a powered off Android device that's been encrypted, chances are you have a good challenge on your hands - there's nothing but the encrypted data on disk to work with unless you were to go to an active attack.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#63

Post by bo1024 »

giovannibajo1 wrote: post #46
walterbell wrote: post #14

Why did Apple make it harder to turn off the WiFi radio in iOS11?

I think it’s safe to assume that most people turn off wifi when there is a wifi network that sucks and they want to switch to cellular. This is by far the most common reason, and it’s also what they think they accomplished. What they instead achieved up to iOS 10 was: * worse location data in maps * airdrop does not work * AirPlay might not work (doesn’t work across networks) * Handoff doesn’t work * phone call and s…

Wow, I think this is a really awful perspective to have.

Maybe the reason people have trouble connecting cause and effect (if that's even true) is that UI designers keep lying to them about what their system is doing.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#64

Post by mikeash »

rospaya wrote: post #57
TheSpiceIsLife wrote: post #34

Earlier quoted context omitted.

I'm not defending nor evangelising Apples current solution. I'm lead to believe it's not iPhone users specifically, but people in general. I've worked in IT, but qualified as a tradesmen nearly a decade before, and I occasionally forget to turn wifi back on when I get home. I currently work for a large steel fabrication company. One of the project managers here doesn't even use email . It's way too easy for the avera…

In 5 years we're gonna wonder how we got to the point where you can't easily turn off wifi, slowly dumbing down devices for all of us for the sake of your project manager and the like.

You can still easily turn off WiFi. It's two or three taps, depending on how you want to get to the setting and what you count as a "tap".

The problem isn't that Apple made it hard to turn off WiFi, it's that they changed one of the controls without making it clear that it had changed.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#65

Post by mikeash »

mercer wrote: post #44
mikeash wrote: post #16

Earlier quoted context omitted.

Because people would turn off WiFi from Control Center and then forget about it, resulting in expensive cellular overages. (This cost me about $30, for example.) I think the pertinent question is: why didn't they make the change more clear?

Isn't another reason that some of iOS features (hand-off? airdrop?) rely on WiFi or Bluetooth?

That seems likely. If you turn off WiFi or Bluetooth and forget to turn it back on, it can be quite confusing as to why some functions suddenly stopped working.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#66

Post by kop316 »

e12e wrote: post #55
Moter8 wrote: post #48

Earlier quoted context omitted.

Cellebrite got into that phone. A presenter from the firm told us so. Apparently 300 devs work fulltime on mobile devices in Isreal to develop iOS/Android exploits, mostly for Law Enforcement or despots. He talked quite a bit about what you can get off the devices, but not much on the how to get into there. Apparently Android-encrypted phones are the safest though. They didn't have an exploit for them 2 months ago.

> Apparently Android-encrypted phones are the safest though. That's odd. I guess the implication is that iPhone hsm is broken (or they can get past a short pin via an exploit that allows brute forcing - typically an hsm should (be possible to configure to) permanently destroy the keys after N attempts). I suppose it demonstrates that secure encryption requires the user to memorise something equivalent of 96-128 bits…

Your intuition is correct on that.

The iPhone encryption from San Bernardino had a 4-digit pin + a long salt, and the long salt is in the iPhones secure enclave. However, the phone would erase itself (don't know if it's the salt or erase everything) after 10 tries. If they were able to image the phone and get the long salt, the keyspace is only 10000, which is trivla to do on a cheap computer today. I believe you can input a long passphrase for iPhone security, and them you'd be back to the problem of a complex passphrase.

Android gives you the option to input a secure passphrase for key derivation, but you can also use a 4 digit PIN/similar non-secure passphrase, and be just as vulnerable. I am not as familiar with additional security measures Android has (I think it does have a similar measure where too many incorrect passphrases will cause it to erase itself).

Re: Exploiting the Wi-Fi Stack on Apple Devices

#67

Post by Tepix »

rospaya wrote: post #57
TheSpiceIsLife wrote: post #34

Earlier quoted context omitted.

I'm not defending nor evangelising Apples current solution. I'm lead to believe it's not iPhone users specifically, but people in general. I've worked in IT, but qualified as a tradesmen nearly a decade before, and I occasionally forget to turn wifi back on when I get home. I currently work for a large steel fabrication company. One of the project managers here doesn't even use email . It's way too easy for the avera…

In 5 years we're gonna wonder how we got to the point where you can't easily turn off wifi, slowly dumbing down devices for all of us for the sake of your project manager and the like.

@mikeash it takes a minimum of 4 or 5 taps and button presses.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#68

Post by Tepix »

KozmoNau7 wrote: post #51
mikeash wrote: post #21

Earlier quoted context omitted.

The problematic scenario goes like this: 1. You're in a coffee shop. The WiFi sucks today. You turn off WiFi so you can use your cellular connection instead. 2. Many hours later, you go home, having forgotten about #1. 3. You binge-watch the entirety of Doctor Who streaming on your phone, not realizing the phone is still using cellular. 4. Large bill from your provider.

5. Realize you should have gotten a subscription with an adequate data plan. 6. Get said subscription. 7. Stop worrying.

Most people don't live in countries such as Kuwait where it is normal (and affordable) to watch 4k netflix streams via LTE.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#69

Post by 2close4comfort »

rightos wrote: post #62
e12e wrote: post #55

Earlier quoted context omitted.

> Apparently Android-encrypted phones are the safest though. That's odd. I guess the implication is that iPhone hsm is broken (or they can get past a short pin via an exploit that allows brute forcing - typically an hsm should (be possible to configure to) permanently destroy the keys after N attempts). I suppose it demonstrates that secure encryption requires the user to memorise something equivalent of 96-128 bits…

There's also a relatively low attack value and attack surface for encrypted Android phones vs encrypted iPhones. Everyone who runs an iPhone has it encrypted, while relatively few people running Android devices have them encrypted. In terms of attack surface, the SecureEnclave has many APIs, some of which have had vulnerabilities in the past and it's quite possible to envision a scenario in which others were found an…

Also encryption by default and much larger user base mean there is more focus on iOS than Android (like the old windows versus mac virus argument) the difference I see is that you are much more likely to get compromised by an application on Android than iOS. And since Google has been very friendly with the USG I would find it much more likely that Enclave or not that it will be NSA weakened crypto that will be the demise of your Android rather than exotic exploits of your wifi. And if your paranoid you carry a Nokia 7715 and extra SIMs or you back something Debian based like Purism.

Re: Exploiting the Wi-Fi Stack on Apple Devices

#70

Post by mikeash »

Cyph0n wrote: post #27
nardi wrote: post #26

Earlier quoted context omitted.

It would have taken you 10 seconds to Google and find out that iOS also has an icon in the status bar that shows you whether you’re on Wi-Fi or cellular.

Why thank you! I would truly be lost without your wisdom. Unfortunately, that still doesn't explain Apple's decision to make it harder to switch off WiFi. Do iPhone users simply not notice the status bar?

Most users notice very little, ever.
Post reply on HN