Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Examining Pointer Authentication on the iPhone XS

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

11–18 of 18 posts

Re: Examining Pointer Authentication on the iPhone XS

#11

Post by stefan_ »

profquail wrote: post #3
stefan_ wrote: post #2

So Apple publishes some kernel source code under a license that basically only permits you to look at it, presumably for security researchers. Apple then also redacts security related code from the published code, going so far as to partially redact functions, only making them appear complete. Weaknesses are then found, of course, in code they redacted. Feeling a bit schizophrenic here.

I didn’t see the article say anything about redacting code? The XNU kernel (used in macOS and iOS) is open-source and has been for some time: https://github.com/apple/darwin-xnu My reading of the article was that Apple has some custom logic in the A12 (for the implementation of the pointer authentication extensions) and have made some (unreleased) modifications to the XNU code to utilize that custom logic. The articl…

The code obviously had enum values for pointer authentication in it. So why was the other code for it missing?

Re: Examining Pointer Authentication on the iPhone XS

#12

Post by csande17 »

profquail wrote: post #3
stefan_ wrote: post #2

So Apple publishes some kernel source code under a license that basically only permits you to look at it, presumably for security researchers. Apple then also redacts security related code from the published code, going so far as to partially redact functions, only making them appear complete. Weaknesses are then found, of course, in code they redacted. Feeling a bit schizophrenic here.

I didn’t see the article say anything about redacting code? The XNU kernel (used in macOS and iOS) is open-source and has been for some time: https://github.com/apple/darwin-xnu My reading of the article was that Apple has some custom logic in the A12 (for the implementation of the pointer authentication extensions) and have made some (unreleased) modifications to the XNU code to utilize that custom logic. The articl…

From the article:

> The part [of the comments in the released source] about the "pointer" containing authenticated, hasBKey, and hasDKey bits suggests that this code is dealing with authenticated pointers, although all the code that actually performs PAC operations has been removed from the public sources.

The researcher suspects Apple started with a version of the XNU code that supported the A12 logic, then removed the lines of code that actually performed the operations before publicly releasing it. In other words, Apple redacted security-related parts of the XNU source.

To me, at least, that's different from Apple creating a new XNU version that supports pointer authentication and not releasing it at all.

Re: Examining Pointer Authentication on the iPhone XS

#13

Post by mehrdada »

bepvte wrote: post #5

I love project zeros write-ups, but I wish they published more about Android.

Haha, there has to be a proper security system/ecosystem on Android to be interesting to break, not one that effectively needs giving every app you want to share a single photo with the entire filesystem access, for example.

Re: Examining Pointer Authentication on the iPhone XS

#14

Post by pjmlp »

mehrdada wrote: post #13
bepvte wrote: post #5

I love project zeros write-ups, but I wish they published more about Android.

Haha, there has to be a proper security system/ecosystem on Android to be interesting to break, not one that effectively needs giving every app you want to share a single photo with the entire filesystem access, for example.

That depends pretty much on which version one is talking about.

Re: Examining Pointer Authentication on the iPhone XS

#15

Post by mehrdada »

pjmlp wrote: post #14
mehrdada wrote: post #13

Earlier quoted context omitted.

Haha, there has to be a proper security system/ecosystem on Android to be interesting to break, not one that effectively needs giving every app you want to share a single photo with the entire filesystem access, for example.

That depends pretty much on which version one is talking about.

I recently tried Android again on Pixel 3 and effectively I have to find a way to send a file to an app without the storage permission. Is that an app-specific thing? I have yet to find an app that doesn’t do that. I understand the issues with the older versions that required install-time permission grant and this is not that issue.

Re: Examining Pointer Authentication on the iPhone XS

#16

Post by londons_explore »

close04 wrote: post #6
bepvte wrote: post #5

I love project zeros write-ups, but I wish they published more about Android.

I remember seeing more Google product related articles on their blog up until a couple of years ago. Then they stopped or slowed down, or at least they seem to concentrate a lot more on Apple and Microsoft. I guess some bugs are disclosed internally and fixed before they go public and some may not warrant blog posts. I am sure they're working on finding bugs in Google code but just like any other company they're not…

Most security researchers are specialized in just a few pieces of software.

If their Android expert leaves the team, there could be a gap in android exploits till a new one is hired.

Re: Examining Pointer Authentication on the iPhone XS

#17

Post by pjmlp »

mehrdada wrote: post #15
pjmlp wrote: post #14

Earlier quoted context omitted.

That depends pretty much on which version one is talking about.

I recently tried Android again on Pixel 3 and effectively I have to find a way to send a file to an app without the storage permission. Is that an app-specific thing? I have yet to find an app that doesn’t do that. I understand the issues with the older versions that required install-time permission grant and this is not that issue.

Android still allowed an workaround for older apps, as the old OS behavior will be done for apps that still target older versions.

This is no longer allowed for new apps since January, as the minimum allowed version to be targeted is Oreo (8.1).

Regarding the storage, with Oreo as minimum version, the changes introduced in Nougat will be enforced, just like with UWP and iOS, only indirect access is allowed (SAF).

https://developer.android.com/about/versions/nougat/android-...

https://developer.android.com/guide/topics/providers/documen...

Re: Examining Pointer Authentication on the iPhone XS

#18

Post by mehrdada »

pjmlp wrote: post #17
mehrdada wrote: post #15

Earlier quoted context omitted.

I recently tried Android again on Pixel 3 and effectively I have to find a way to send a file to an app without the storage permission. Is that an app-specific thing? I have yet to find an app that doesn’t do that. I understand the issues with the older versions that required install-time permission grant and this is not that issue.

Android still allowed an workaround for older apps, as the old OS behavior will be done for apps that still target older versions. This is no longer allowed for new apps since January, as the minimum allowed version to be targeted is Oreo (8.1). Regarding the storage, with Oreo as minimum version, the changes introduced in Nougat will be enforced, just like with UWP and iOS, only indirect access is allowed (SAF). htt…

Thanks for the clarification, good to know!
Post reply on HN