Everything has changed in iOS 14, but Jailbreak is eternal [pdf] • Hacker News Board

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#11

Post by NotPavlovsDog » Sat, Aug 07, 2021, 5:57 PM UTC

for those looking for a TLDR:

- Result: run unauthorized code on iOS 14

- 14 is the most secure toy phone OS to date, with kernel heap hardening, data PAC, userspace PAC hardening, tfp0 hardening, ipc_kmsg hardening

- Exploit took advantage of multiple bugs, concentrating on PAC (Pointer Authentication Code, cryptographic signature on the pointer value, designed to resist memory disclosure attacks, for more context see [1])

- Multiple steps and dependencies, chaining vulnerabilities and exploits

- Code on https://github.com/pattern-f

I really commend Zuozhi Fan (@pattern_F_)for publishing the code with the report.

Additional resources:

[1] https://googleprojectzero.blogspot.com/2019/02/examining-poi...

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#12

Post by etaioinshrdlu » Sat, Aug 07, 2021, 6:09 PM UTC

By the way, iOS devices also run a completely different OS on the secure enclave: https://sel4.systems/About/seL4-whitepaper.pdf

The SEL4 kernel is different because it has actually been "proved correct" and "proved secure" according to the authors.

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#13

Post by saagarjha » Sat, Aug 07, 2021, 6:12 PM UTC

etaioinshrdlu wrote: post #12

By the way, iOS devices also run a completely different OS on the secure enclave: https://sel4.systems/About/seL4-whitepaper.pdf The SEL4 kernel is different because it has actually been "proved correct" and "proved secure" according to the authors.

The Secure Enclave runs a custom L4 derivative, rather than seL4.

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#14

Post by fsflover » Sat, Aug 07, 2021, 6:27 PM UTC

haswell wrote: post #5

quenix wrote: post #3

Earlier quoted context omitted.

Why?

I suspect they're concerned about the PDF format, which has been used in the past to deliver malicious payloads.

If you are concerned about harmful files from the Internet, consider using Qubes OS.

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#15

Post by iJohnDoe » Sat, Aug 07, 2021, 6:30 PM UTC

hr2016 wrote: post #2

I see many submissions from blackhat.com are direct PDF links, but that does not make me feel very comfortable.

Agreed. PDFs are still considered very unsafe from unknown sources. Always be cautious. They are constantly used in phishing attacks.

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#16

Post by iJohnDoe » Sat, Aug 07, 2021, 6:31 PM UTC

NotPavlovsDog wrote: post #11

for those looking for a TLDR: - Result: run unauthorized code on iOS 14 - 14 is the most secure toy phone OS to date, with kernel heap hardening, data PAC, userspace PAC hardening, tfp0 hardening, ipc_kmsg hardening - Exploit took advantage of multiple bugs, concentrating on PAC (Pointer Authentication Code, cryptographic signature on the pointer value, designed to resist memory disclosure attacks, for more context s…

Sounds like a lot of work and effort involved.

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#17

Post by mapgrep » Sat, Aug 07, 2021, 6:32 PM UTC

fsflover wrote: post #14

haswell wrote: post #5

Earlier quoted context omitted.

I suspect they're concerned about the PDF format, which has been used in the past to deliver malicious payloads.

If you are concerned about harmful files from the Internet, consider using Qubes OS.

Qubes is wonderful. I read HN and surf the web/social in a dvm - disposable vm, so if you are exploited, not only is it contained to the vm, it’s contained to the vm until you close it, at which point all changes are discarded.

(Modulo any Xen exploits that make it through and affect Qubes. no security is perfect.)

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#18

Post by fsflover » Sat, Aug 07, 2021, 6:36 PM UTC

mapgrep wrote: post #17

fsflover wrote: post #14

Earlier quoted context omitted.

If you are concerned about harmful files from the Internet, consider using Qubes OS.

Qubes is wonderful. I read HN and surf the web/social in a dvm - disposable vm, so if you are exploited, not only is it contained to the vm, it’s contained to the vm until you close it, at which point all changes are discarded. (Modulo any Xen exploits that make it through and affect Qubes. no security is perfect.)

> Modulo any Xen exploits that make it through and affect Qubes

By the way, thanks to the clever Qubes design, quite few Xen exploits affect Qubes OS [0]. Especially after 4.0 with VT-d hardware virtualization [1].

[0] https://www.qubes-os.org/security/xsa/

[1] https://www.qubes-os.org/news/2017/07/31/qubes-40-rc1/#fully...

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#19

Post by newbamboo » Sat, Aug 07, 2021, 6:37 PM UTC

Quarrel wrote: post #4

hr2016 wrote: post #2

I see many submissions from blackhat.com are direct PDF links, but that does not make me feel very comfortable.

It's a conference. The presentations get published. Isn't this totally normal? I mean, sure it'd be totally blackhat to publish a brand new pdf exploit this way, but blackhat as a conference went way beyond those roots a long time ago.

Thanks. I was like, “I ain’t clickin that.” But since you vouched for it…

Re: Everything has changed in iOS 14, but Jailbreak is eternal [pdf]

#20

Post by NotPavlovsDog » Sat, Aug 07, 2021, 6:42 PM UTC

iJohnDoe wrote: post #16

NotPavlovsDog wrote: post #11

for those looking for a TLDR: - Result: run unauthorized code on iOS 14 - 14 is the most secure toy phone OS to date, with kernel heap hardening, data PAC, userspace PAC hardening, tfp0 hardening, ipc_kmsg hardening - Exploit took advantage of multiple bugs, concentrating on PAC (Pointer Authentication Code, cryptographic signature on the pointer value, designed to resist memory disclosure attacks, for more context s…

Sounds like a lot of work and effort involved.

Yes. There are graphics in the presentation towards the end giving an overview. I'm impressed with how much knowledge the researcher acquired in a relatively short time.