Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Analysis of Obfuscation Techniques Found in Apple FairPlay

nicolo.dev

Post reply on HN
Print view View original

41–50 of 56 posts

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#41

Post by ballenf »

no_time wrote: post #15
7e wrote: post #6

Why doesn't Apple build a custom TEE to do DRM playback, and authenticate the display as well? That seems like a better solution.

Only an Apple engineer could answer this fully but here are some of my ideas as to why this hasn't been done yet: -They still support playback on devices with no TEE. Kinda defeats the point of implementing it until this is the case. - They are wary of moving more functionality into their TEE as it increases the attack surface. - If the platform is already "attested" and locked down as it is the case today, moving th…

What prevents a virus maker from using Realm Management against virus/security scans?

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#42

Post by nicolodev »

drdrey wrote: post #40
nicolodev wrote: post #2

Thanks for submitting the article! Let me know if anyone has any questions. If you are wondering how Apple obfuscate its software, the answer is simple: they built some extensions for LLVM that applies code transformation directly to LLVM IR. LLVM IR is an intermediate language to represent the code that will be copied in binary.

Great write-up! I was one of the Apple engineers who implemented some of these obfuscations. Fun to see an outside perspective on your work.

Thanks a lot!!! I can't believe I meet you on HN, great work so far

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#43

Post by EMIRELADERO »

mike_hearn wrote: post #38
drvdevd wrote: post #36

Earlier quoted context omitted.

So from an attackers perspective nowadays it sounds like focusing on encryption weaknesses and/or hardware issues (e.g. glitching) or firmware vulnerabilities is the right place to look?

I don't know much about Apple's hardware but at least consoles are secured against both those things. They have anti-glitch circuitry. The boot ROM doesn't even do comparisons against computed hashes, it just extends PCRs with them so it's glitch-proof by design even if the core stability monitoring fails. The Xbox One doesn't even expose most of the keys to software at any point. The keys flow from the hardware part…

God, all this sounds like a nightmare. I can't wait for laws that prohibit platforms/software from refusing service/content to users on the basis of the level of control they have over devices used to interact with it.

Dark times.

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#44

Post by mike_hearn »

EMIRELADERO wrote: post #43
mike_hearn wrote: post #38

Earlier quoted context omitted.

I don't know much about Apple's hardware but at least consoles are secured against both those things. They have anti-glitch circuitry. The boot ROM doesn't even do comparisons against computed hashes, it just extends PCRs with them so it's glitch-proof by design even if the core stability monitoring fails. The Xbox One doesn't even expose most of the keys to software at any point. The keys flow from the hardware part…

God, all this sounds like a nightmare. I can't wait for laws that prohibit platforms/software from refusing service/content to users on the basis of the level of control they have over devices used to interact with it. Dark times.

Users love this stuff. It lets them buy cheap consoles that are sold below cost and subsidised by game royalties. Heavy gamers subsidise light gamers, and both can effectively "pay off" the true cost of the hardware over time as they buy titles. So it's a bit like zero-interest credit.

Also it eliminates cheating in multiplayer games, and users love that too.

And finally it stops gamers who play by the rules and buy games from feeling like mugs when their mates are playing for free, because there's no piracy.

You think users are going to vote to end all that? They already voted with their feet and embraced consoles on a massive scale. Both console and mobile gaming dwarfs PC gaming.

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#45

Post by no_time »

ballenf wrote: post #41
no_time wrote: post #15

Earlier quoted context omitted.

Only an Apple engineer could answer this fully but here are some of my ideas as to why this hasn't been done yet: -They still support playback on devices with no TEE. Kinda defeats the point of implementing it until this is the case. - They are wary of moving more functionality into their TEE as it increases the attack surface. - If the platform is already "attested" and locked down as it is the case today, moving th…

What prevents a virus maker from using Realm Management against virus/security scans?

There isn't enough known about the whole thing to answer this. But for what it's worth, Intel's version of this tech has a wiki paragraph dedicated to this concern.

https://en.wikipedia.org/wiki/Software_Guard_Extensions#SGX_...

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#46

Post by EMIRELADERO »

mike_hearn wrote: post #44
EMIRELADERO wrote: post #43

Earlier quoted context omitted.

God, all this sounds like a nightmare. I can't wait for laws that prohibit platforms/software from refusing service/content to users on the basis of the level of control they have over devices used to interact with it. Dark times.

Users love this stuff. It lets them buy cheap consoles that are sold below cost and subsidised by game royalties. Heavy gamers subsidise light gamers, and both can effectively "pay off" the true cost of the hardware over time as they buy titles. So it's a bit like zero-interest credit. Also it eliminates cheating in multiplayer games, and users love that too. And finally it stops gamers who play by the rules and buy…

Consider privacy. One might say "Users love this stuff. They get complex and effective services for free, all in exchange for contributing their data towards ads. Purchasers and advertisers subsidize light users who just consume the content."

And yet, we got laws like GDPR on the ideological basis that personal data is above the concept of "market" and about the individual, period. Your business model be damned.

The same thing should happen here. Both the complete control over all parts/SoCs of a device, and the right to the lack of negative consequences for choosing to exercise that control (such as being second-class citizens on the platform that runs on that device in terms of content/service availability) are paramount to a digital free society, and should be regulated as such, putting them above the concept of "market", just as privacy was.

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#47

Post by holopic »

mike_hearn wrote: post #28
mschuster91 wrote: post #24

Earlier quoted context omitted.

RA doesn't protect you from kernel exploits.

It lets you detect if the user is running a vulnerable kernel. Apple's stack is pretty secure. When was the last iPhone jailbreak? I don't follow it closely as I'm not an iPhone user, but it feels like a long time ago now. And if an exploit is found, they can just revoke that kernel version. Apps can then ask users to apply the update to regain access to their streams.

It gets harder and takes longer to jailbreak the iPhone. iOS 15.0 – 15.4.1 was jailbroken - it has been 2 years - I would expect an exploit on 16 already existing and under embargo.

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#48

Post by motrm »

nicolodev wrote: post #2

Thanks for submitting the article! Let me know if anyone has any questions. If you are wondering how Apple obfuscate its software, the answer is simple: they built some extensions for LLVM that applies code transformation directly to LLVM IR. LLVM IR is an intermediate language to represent the code that will be copied in binary.

> We use IDA for convenience in this article, although we must be especially careful when importing the binary into other tools (we will explain why at the end of the article)

Forgive me if I missed this being explained - I was curious what the reasoning for this was and I didn't see it! Could you elaborate? :)

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#49

Post by nicolodev »

motrm wrote: post #48
nicolodev wrote: post #2

Thanks for submitting the article! Let me know if anyone has any questions. If you are wondering how Apple obfuscate its software, the answer is simple: they built some extensions for LLVM that applies code transformation directly to LLVM IR. LLVM IR is an intermediate language to represent the code that will be copied in binary.

> We use IDA for convenience in this article, although we must be especially careful when importing the binary into other tools (we will explain why at the end of the article) Forgive me if I missed this being explained - I was curious what the reasoning for this was and I didn't see it! Could you elaborate? :)

Ops! Forgot to write about it (otherwise it would be so long). I did not mention the tools, but I was mainly referring to Hopper Decompiler/Disassembler (definitely no no for me). Altough it seemed the natural choice for reverse engineering macOS applications and daemons, it failed disastrousely on reverse engineering fairplayd. This is where obfuscation is really good at: feeling pain. Hopper tried to disassemblate the binary but still no luck (there was an error due to some bogus instructions referred by a dead branch). I'm seeing improvements for Hopper release by release, but there were some regressions that I noticed..

I tried to import it into Ghidra and it missed some informations during the pass of stack analysis. At the end it was a mess result to read, so I ended it up with IDA (free because I'm a student). Binary ninja also needs some license, I'm trying to afford it.

Re: Analysis of Obfuscation Techniques Found in Apple FairPlay

#50

Post by realusername »

mike_hearn wrote: post #28
mschuster91 wrote: post #24

Earlier quoted context omitted.

RA doesn't protect you from kernel exploits.

It lets you detect if the user is running a vulnerable kernel. Apple's stack is pretty secure. When was the last iPhone jailbreak? I don't follow it closely as I'm not an iPhone user, but it feels like a long time ago now. And if an exploit is found, they can just revoke that kernel version. Apps can then ask users to apply the update to regain access to their streams.

exploits are just kept private by bad actors nowadays.

Apple now gets the worst of both worlds, the harmless jailbreaking scene is dying but the bad actors are still in full force.

Post reply on HN