Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Analysis of Obfuscation Techniques Found in Apple FairPlay

nicolo.dev

Post reply on HN
Print view View original

21–30 of 56 posts

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#21

Post by josephcsible »

> keeping the decryption key and the whole process secure to avoid the possibility of decrypting the contents of.ipa files to share the contents of an app (perhaps paid for) in the wrong hands

> Technically speaking, if there were no protection measures, a person could copy the app installer1 and pass it on to any other person. Result? Loss of revenue on the part of Apple and the developer who published the application since the archive copy is free.

> How can we protect the information contained within the archive? It is clear that we must somehow hide the contents of the archive; by doing so, even if they were to extract the IPA archive from the iPhone, attackers would not be able to access the contents.

I don't like how positive all of that makes DRM sound.

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#22

Post by nicolodev »

mike_hearn wrote: post #19
nicolodev wrote: post #14

Earlier quoted context omitted.

Thanks for your comment. This obfuscation scheme is used only to complicate any attempt to reverse engineering (disassembling, decompilation) of the two processes involved in FairPlay DRM (I'm mainly talking about CoreFP and Fairplayd). Attackers need to spend more time on retrieving the original business logic. For sure, it's not the most hyper-defense technology Apple has employed (think about Secure Enclave). > a…

RA tells Apple what software stack you're running and that it's not virtualized (genuine hardware device). Therefore, you no longer need software obfuscation because: 1. The software is now tamperproofed (server won't release content key unless the RA contains an expected hash) 2. The memory space is protected from being read from other processes, so there's no need to try and hide the processing of secrets in the co…

Thanks for the detailed explanation.

> The software and hardware stack does itself need to be secure of course

Oh this is what I'm missing. It's a huge assumption that I wish that can be true!

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#23

Post by [deleted] »

josephcsible wrote: post #21

> keeping the decryption key and the whole process secure to avoid the possibility of decrypting the contents of.ipa files to share the contents of an app (perhaps paid for) in the wrong hands > Technically speaking, if there were no protection measures, a person could copy the app installer1 and pass it on to any other person. Result? Loss of revenue on the part of Apple and the developer who published the applicati…

[deleted]

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#24

Post by mschuster91 »

mike_hearn wrote: post #19
nicolodev wrote: post #14

Earlier quoted context omitted.

Thanks for your comment. This obfuscation scheme is used only to complicate any attempt to reverse engineering (disassembling, decompilation) of the two processes involved in FairPlay DRM (I'm mainly talking about CoreFP and Fairplayd). Attackers need to spend more time on retrieving the original business logic. For sure, it's not the most hyper-defense technology Apple has employed (think about Secure Enclave). > a…

RA tells Apple what software stack you're running and that it's not virtualized (genuine hardware device). Therefore, you no longer need software obfuscation because: 1. The software is now tamperproofed (server won't release content key unless the RA contains an expected hash) 2. The memory space is protected from being read from other processes, so there's no need to try and hide the processing of secrets in the co…

RA doesn't protect you from kernel exploits.

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#25

Post by [deleted] »

mike_hearn wrote: post #13

I'm gonna go out on a limb and suggest that this obfuscation scheme is legacy, and they keep it merely as defense in depth and because it's tested so why not. Modern Macs can do remote attestations from a trusted boot chain all the way up to specific apps, which obviates the need for this sort of obfuscation. The memory spaces will be protected by the operating system as long as SIP is enabled, and if it's not enable…

[deleted]

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#26

Post by saagarjha »

mike_hearn wrote: post #19
nicolodev wrote: post #14

Earlier quoted context omitted.

Thanks for your comment. This obfuscation scheme is used only to complicate any attempt to reverse engineering (disassembling, decompilation) of the two processes involved in FairPlay DRM (I'm mainly talking about CoreFP and Fairplayd). Attackers need to spend more time on retrieving the original business logic. For sure, it's not the most hyper-defense technology Apple has employed (think about Secure Enclave). > a…

RA tells Apple what software stack you're running and that it's not virtualized (genuine hardware device). Therefore, you no longer need software obfuscation because: 1. The software is now tamperproofed (server won't release content key unless the RA contains an expected hash) 2. The memory space is protected from being read from other processes, so there's no need to try and hide the processing of secrets in the co…

> The software and hardware stack does itself need to be secure of course, but Apple has got pretty good at that.

lol

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#27

Post by nicolodev »

mschuster91 wrote: post #24
mike_hearn wrote: post #19

Earlier quoted context omitted.

RA tells Apple what software stack you're running and that it's not virtualized (genuine hardware device). Therefore, you no longer need software obfuscation because: 1. The software is now tamperproofed (server won't release content key unless the RA contains an expected hash) 2. The memory space is protected from being read from other processes, so there's no need to try and hide the processing of secrets in the co…

RA doesn't protect you from kernel exploits.

Exactly!

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#28

Post by mike_hearn »

mschuster91 wrote: post #24
mike_hearn wrote: post #19

Earlier quoted context omitted.

RA tells Apple what software stack you're running and that it's not virtualized (genuine hardware device). Therefore, you no longer need software obfuscation because: 1. The software is now tamperproofed (server won't release content key unless the RA contains an expected hash) 2. The memory space is protected from being read from other processes, so there's no need to try and hide the processing of secrets in the co…

RA doesn't protect you from kernel exploits.

It lets you detect if the user is running a vulnerable kernel.

Apple's stack is pretty secure. When was the last iPhone jailbreak? I don't follow it closely as I'm not an iPhone user, but it feels like a long time ago now. And if an exploit is found, they can just revoke that kernel version. Apps can then ask users to apply the update to regain access to their streams.

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#29

Post by lxgr »

mschuster91 wrote: post #24
mike_hearn wrote: post #19

Earlier quoted context omitted.

RA tells Apple what software stack you're running and that it's not virtualized (genuine hardware device). Therefore, you no longer need software obfuscation because: 1. The software is now tamperproofed (server won't release content key unless the RA contains an expected hash) 2. The memory space is protected from being read from other processes, so there's no need to try and hide the processing of secrets in the co…

RA doesn't protect you from kernel exploits.

In some DRM architectures, the key and data encrypted using it is never even exposed to the kernel.

That’s how many high resolution video DRM schemes work.

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#30

Post by skybrian »

mike_hearn wrote: post #19
nicolodev wrote: post #14

Earlier quoted context omitted.

Thanks for your comment. This obfuscation scheme is used only to complicate any attempt to reverse engineering (disassembling, decompilation) of the two processes involved in FairPlay DRM (I'm mainly talking about CoreFP and Fairplayd). Attackers need to spend more time on retrieving the original business logic. For sure, it's not the most hyper-defense technology Apple has employed (think about Secure Enclave). > a…

RA tells Apple what software stack you're running and that it's not virtualized (genuine hardware device). Therefore, you no longer need software obfuscation because: 1. The software is now tamperproofed (server won't release content key unless the RA contains an expected hash) 2. The memory space is protected from being read from other processes, so there's no need to try and hide the processing of secrets in the co…

This seems like an argument against defense in depth? I suppose encouraging security researchers to find vulnerabilities is a good thing and obfuscation hinders that.
Post reply on HN