Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple confirms iOS kernel code left unencrypted intentionally

techcrunch.com

Post reply on HN
Print view View original

31–40 of 157 posts

Re: Apple confirms iOS kernel code left unencrypted intentionally

#31

Post by ghshephard »

culturestate wrote: post #17
jevinskie wrote: post #9

Earlier quoted context omitted.

The spokesperson is talking out of their ass regarding performance. The kernel is decrypted by iBoot once at boot, using the hardware AES engine. It remains decrypted until the device is shutdown/rebooted. Decompressing and decrypting the kernel takes less than a second at boot. Also, TechCrunch fails to note that the kernelcache keys for most 32-bit kernels (and all iOS versions) are publicly available. Private indi…

> The spokesperson is talking out of their ass regarding performance. I'm fairly certain that this statement was vetted by Craig Federighi himself or, at minimum, a high-level engineering manager.

Both statements could be true - I wouldn't be too surprised to see Apple stretch the truth; yes, it's true, performance on a 25 second boot (my iphone 6s) from cold was improved to 24 seconds. Doesn't really move the needle, but still true, to some degree. A second here, and a second there - starts to add up though, particularly on boot up, for those of us who end up doing that multiple times a day.

Also, in general, any time you can remove code from a system, that isn't contributing in any meaningful way, is just a good thing to do - both from reducing attack surfaces, as well as general reduction in code size, and the advantages that come along with that.

Re: Apple confirms iOS kernel code left unencrypted intentionally

#32

Post by StudyAnimal »

culturestate wrote: post #17
jevinskie wrote: post #9

Earlier quoted context omitted.

The spokesperson is talking out of their ass regarding performance. The kernel is decrypted by iBoot once at boot, using the hardware AES engine. It remains decrypted until the device is shutdown/rebooted. Decompressing and decrypting the kernel takes less than a second at boot. Also, TechCrunch fails to note that the kernelcache keys for most 32-bit kernels (and all iOS versions) are publicly available. Private indi…

> The spokesperson is talking out of their ass regarding performance. I'm fairly certain that this statement was vetted by Craig Federighi himself or, at minimum, a high-level engineering manager.

Or the guy in the marketing department that "knows about the techy stuff".

Re: Apple confirms iOS kernel code left unencrypted intentionally

#33

Post by hackuser »

headShrinker wrote: post #26

A move like this fits with a more general ideology Apple has been advocating for the last three years. Privacy, security, and ultruism. Tim Cook has put is mark on the company. One of the first things he did was apologize, (for maps) something unheard of in Apple's culture. I haven't drank the cool-aid and Apple has a lot of issues. I do see they however are making attempts at differentiating from the general corpora…

I don't know enough about their new ethical approach to say whether it's PR, whether it's just a few well-publicized decisions, or whether it's broad-based and substantial. I'm not saying either way; I just don't know. But it could make me a loyal customer much more than cool design and fashionable cache ever would.

Re: Apple confirms iOS kernel code left unencrypted intentionally

#34

Post by iheartmemcache »

School-Cotton wrote: post #30
samfisher83 wrote: post #18

Earlier quoted context omitted.

The OS X and iOS kernel are descendants of the nextStep kernel which is open source. http://en.wikipedia.org/wiki/XNU

I know that. But who knows how much secret sauce they have in the iOS build? Also, even on OS X, it takes a while after new versions of the OS are released for new kernel source bundles to drop. So sometimes poking around with IDA is your only recourse.

A non-trivial amount of the iOS platform has been rev-eng'd (incidentally, largely with IDA and those kernel sources to create binaries with intact symbols + binary comparison heuristics[1]). XNU is largely based on FreeBSD so I'd be surprised if that wasn't an additional vehicle people were using (In a similar vein, fail0verflow used the syscode table information from FreeBSD with WebKit and ROPgadgets to fully compromise the PS3.)

RE: this specific exploit, here's the POC making it around the security sphere (thanks @heisecode!) https://github.com/heisecode/Bug_POCs

[1] https://static.googleusercontent.com/media/www.zynamics.com/...

Re: Apple confirms iOS kernel code left unencrypted intentionally

#35

Post by jlgaddis »

samfisher83 wrote: post #25
School-Cotton wrote: post #16

Earlier quoted context omitted.

Nitpick: they are not open-sourcing it; they are just leaving the compiled binary unencrypted.

I get down voted for sharing some knowledge. What is the point of even posting?

It's definitely not -- or shouldn't be, at least -- fake Internet points.

Re: Apple confirms iOS kernel code left unencrypted intentionally

#36

Post by mtgx »

iofj wrote: post #27
matthewaveryusa wrote: post #21

Earlier quoted context omitted.

Also, all you need is one insider kernel developer to get all the source code anyways. I always find these kinds of initiatives silly -- A lot of companies think that an insider is a side-channel attack when really it's the main vector.

Also, given enough money available, why ask people to build vulnerabilities in ? Does anyone seriously think Apple's (or anyone's) kernel team doesn't have a single guy/girl that made at least one mistake ?

And Apple, as well as Microsoft, Intel, and other companies have already voluntarily agreed to give the NSA and other agencies "early notice" of a vulnerability which can be exploited by the time it's fixed anyway. CISA also pretty much mandated it into law as well.

Re: Apple confirms iOS kernel code left unencrypted intentionally

#37

Post by nostromo »

hackuser wrote: post #33
headShrinker wrote: post #26

A move like this fits with a more general ideology Apple has been advocating for the last three years. Privacy, security, and ultruism. Tim Cook has put is mark on the company. One of the first things he did was apologize, (for maps) something unheard of in Apple's culture. I haven't drank the cool-aid and Apple has a lot of issues. I do see they however are making attempts at differentiating from the general corpora…

I don't know enough about their new ethical approach to say whether it's PR, whether it's just a few well-publicized decisions, or whether it's broad-based and substantial. I'm not saying either way; I just don't know. But it could make me a loyal customer much more than cool design and fashionable cache ever would.

When they took on the FBI I decided that it was more than just vacuous PR.

A PR person would bristle at the idea of denying to unlock the phone of a terrorist. It took real cojones for Apple to stand up for privacy at such a time.

Re: Apple confirms iOS kernel code left unencrypted intentionally

#38

Post by uxp »

newhouseb wrote: post #24
dietrichepp wrote: post #19

Earlier quoted context omitted.

Right, but how much code does the last open-source xnu have in common with the latest?

Apple continues to open source their version of XNU, although there has been an increasing lag between the release of each OS version and the corresponding sources. The latest available sources are from 10.11.2, three minor versions behind. Apple has also shifted to pushing a lot of sensitive/proprietary code into kernel extensions (the new Apple File System being one example), for which they don't release source cod…

Filesystems, by and large, are supposed to be pushed into the kernel (via extension, or direct compilation). I'd hardly say that they've "shifted" into pushing code into their kernel, but that much of what differentiates Apple's XNU kernel vs FreeBSD's Kernel or Linux is what they choose the exclude.

Re: Apple confirms iOS kernel code left unencrypted intentionally

#39

Post by mei0Iesh »

headShrinker wrote: post #26

A move like this fits with a more general ideology Apple has been advocating for the last three years. Privacy, security, and ultruism. Tim Cook has put is mark on the company. One of the first things he did was apologize, (for maps) something unheard of in Apple's culture. I haven't drank the cool-aid and Apple has a lot of issues. I do see they however are making attempts at differentiating from the general corpora…

How does not encrypting the kernel translate into a narrative worthy of such admiration? I feel like Apple has spent a lot of money and research into how to do brand marketing so that you would write this comment. I don't see how technically this move means any such thing, and instead people are primed to fall into such a belief because they want that feel-good story about Apple being their privacy hero in scary times when big brother is prying more than ever. It's just an unencrypted kernel, which was decrypted in memory anyways. It isn't even source code.

Re: Apple confirms iOS kernel code left unencrypted intentionally

#40

Post by smnscu »

nostromo wrote: post #37
hackuser wrote: post #33

Earlier quoted context omitted.

I don't know enough about their new ethical approach to say whether it's PR, whether it's just a few well-publicized decisions, or whether it's broad-based and substantial. I'm not saying either way; I just don't know. But it could make me a loyal customer much more than cool design and fashionable cache ever would.

When they took on the FBI I decided that it was more than just vacuous PR. A PR person would bristle at the idea of denying to unlock the phone of a terrorist. It took real cojones for Apple to stand up for privacy at such a time.

Wow, how gullible you are. It's obviously Apple and FBI are actually best buddies and this was just a PR move to sell more iPhones. Wake up, sheeple. /s

Seriously, the cynicism in this thread is deplorable even for HN standards.

Post reply on HN