Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple confirms iOS kernel code left unencrypted intentionally

techcrunch.com

Post reply on HN
Print view View original

11–20 of 157 posts

Re: Apple confirms iOS kernel code left unencrypted intentionally

#11

Post by jevinskie »

krastanov wrote: post #7
peterkelly wrote: post #5

In other news: Google admits source code used in Android kernel can be accessed by hackers

I do not think they are talking about source code, rather about some compiled code cache. I am not completely certain that the author of the article knows what they are talking about (but I am quite confused myself and I will appreciate an explanation). Also, I thought a lot of the Darwin MacOS kernel had already publicly available source code.

Some of the kernel is released months/years later as open source. You are correct about the releases being macOS only, iOS xnu has never been open sourced but it is, for the most part, identical. Apple has also been moving code out of the open source kernel releases and into private, closed source kexts. Kernel extensions like Sandbox have never been released.

Re: Apple confirms iOS kernel code left unencrypted intentionally

#12

Post by jevinskie »

gcr wrote: post #8

Is there any modern kernel in widespread use that runs while encrypted in RAM? What kind of attacks would encrypting a running kernel prevent? The kernel and hardware work together to enforce memory safety, so it can't be to prevent a rogue process from reading kernel memory... Edit: Is this talking about encrypting the kernel image in permanent storage, or encrypting a running kernel in RAM? When booting Linux for e…

Permanent storage. The kernelcache is lzss compressed and encrypted with AES. I forget the details of signature verification at the moment, but that is done using RSA. The iBoot bootloader handles all of the decompression, decryption, and signature verification.

Re: Apple confirms iOS kernel code left unencrypted intentionally

#14

Post by alexandercrohde »

AdmiralAsshat wrote: post #2

I suppose this is the only way to definitively stop any three-letter agencies from asking you to backdoor your kernel.

Or perhaps the three-letter-agencies demanded they do such a backdoor (i.e. a deliberate but obscure security hole), so they are open-sourcing it so hackers can find it.

Re: Apple confirms iOS kernel code left unencrypted intentionally

#15

Post by manicdee »

ericmsimons wrote: post #10

Could this be an invitation for researchers to find a backdoor the NSA required Apple to put in there? Or are they just utilizing the crowd to help secure against NSA attacks?

Is there any way to use this information to confirm that the current kernel on a phone is legit?

Re: Apple confirms iOS kernel code left unencrypted intentionally

#16

Post by School-Cotton »

alexandercrohde wrote: post #14
AdmiralAsshat wrote: post #2

I suppose this is the only way to definitively stop any three-letter agencies from asking you to backdoor your kernel.

Or perhaps the three-letter-agencies demanded they do such a backdoor (i.e. a deliberate but obscure security hole), so they are open-sourcing it so hackers can find it.

Nitpick: they are not open-sourcing it; they are just leaving the compiled binary unencrypted.

Re: Apple confirms iOS kernel code left unencrypted intentionally

#17

Post by culturestate »

jevinskie wrote: post #9
justinsaccount wrote: post #3

"The kernel cache doesn’t contain any user info, and by unencrypting it we’re able to optimize the operating system’s performance without compromising security," an Apple spokesperson told TechCrunch. "Apple confirms iOS kernel code left unencrypted intentionally" Which is it, cache (of what?) or code?

The spokesperson is talking out of their ass regarding performance. The kernel is decrypted by iBoot once at boot, using the hardware AES engine. It remains decrypted until the device is shutdown/rebooted. Decompressing and decrypting the kernel takes less than a second at boot. Also, TechCrunch fails to note that the kernelcache keys for most 32-bit kernels (and all iOS versions) are publicly available. Private indi…

> The spokesperson is talking out of their ass regarding performance.

I'm fairly certain that this statement was vetted by Craig Federighi himself or, at minimum, a high-level engineering manager.

Re: Apple confirms iOS kernel code left unencrypted intentionally

#18

Post by samfisher83 »

School-Cotton wrote: post #16
alexandercrohde wrote: post #14

Earlier quoted context omitted.

Or perhaps the three-letter-agencies demanded they do such a backdoor (i.e. a deliberate but obscure security hole), so they are open-sourcing it so hackers can find it.

Nitpick: they are not open-sourcing it; they are just leaving the compiled binary unencrypted.

The OS X and iOS kernel are descendants of the nextStep kernel which is open source.

http://en.wikipedia.org/wiki/XNU

Re: Apple confirms iOS kernel code left unencrypted intentionally

#19

Post by dietrichepp »

samfisher83 wrote: post #18
School-Cotton wrote: post #16

Earlier quoted context omitted.

Nitpick: they are not open-sourcing it; they are just leaving the compiled binary unencrypted.

The OS X and iOS kernel are descendants of the nextStep kernel which is open source. http://en.wikipedia.org/wiki/XNU

Right, but how much code does the last open-source xnu have in common with the latest?

Re: Apple confirms iOS kernel code left unencrypted intentionally

#20

Post by colechristensen »

samfisher83 wrote: post #18
School-Cotton wrote: post #16

Earlier quoted context omitted.

Nitpick: they are not open-sourcing it; they are just leaving the compiled binary unencrypted.

The OS X and iOS kernel are descendants of the nextStep kernel which is open source. http://en.wikipedia.org/wiki/XNU

And there are non-trivial bits of OS X which are open sourced http://opensource.apple.com/release/os-x-10112/
Post reply on HN