Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple confirms iOS kernel code left unencrypted intentionally

techcrunch.com

Post reply on HN
Print view View original

1–10 of 157 posts

Re: Apple confirms iOS kernel code left unencrypted intentionally

#3

Post by justinsaccount »

"The kernel cache doesn’t contain any user info, and by unencrypting it we’re able to optimize the operating system’s performance without compromising security," an Apple spokesperson told TechCrunch.

"Apple confirms iOS kernel code left unencrypted intentionally"

Which is it, cache (of what?) or code?

Re: Apple confirms iOS kernel code left unencrypted intentionally

#4

Post by JonathonW »

justinsaccount wrote: post #3

"The kernel cache doesn’t contain any user info, and by unencrypting it we’re able to optimize the operating system’s performance without compromising security," an Apple spokesperson told TechCrunch. "Apple confirms iOS kernel code left unencrypted intentionally" Which is it, cache (of what?) or code?

Cache of code. OS X and iOS maintain a cache containing the kernel and prelinked kernel extensions as a performance optimization-- this allows the system to avoid scanning the actual directory containing kernel extensions at boot.

See: http://osxbook.com/book/bonus/misc/optimizations/#TWO and https://developer.apple.com/library/mac/documentation/Darwin...

Re: Apple confirms iOS kernel code left unencrypted intentionally

#7

Post by krastanov »

peterkelly wrote: post #5

In other news: Google admits source code used in Android kernel can be accessed by hackers

I do not think they are talking about source code, rather about some compiled code cache. I am not completely certain that the author of the article knows what they are talking about (but I am quite confused myself and I will appreciate an explanation).

Also, I thought a lot of the Darwin MacOS kernel had already publicly available source code.

Re: Apple confirms iOS kernel code left unencrypted intentionally

#8

Post by gcr »

Is there any modern kernel in widespread use that runs while encrypted in RAM?

What kind of attacks would encrypting a running kernel prevent? The kernel and hardware work together to enforce memory safety, so it can't be to prevent a rogue process from reading kernel memory...

Edit: Is this talking about encrypting the kernel image in permanent storage, or encrypting a running kernel in RAM? When booting Linux for example, the boot loader will load the Linux kernel image into memory as a gzip-compressed blob. The kernel's first instructions are a small decompressor program that unpack the rest of the kernel image into memory and then jumps into the uncompressed kernel. Did previous iOS versions do something similar to their saved kernel image?

Re: Apple confirms iOS kernel code left unencrypted intentionally

#9

Post by jevinskie »

justinsaccount wrote: post #3

"The kernel cache doesn’t contain any user info, and by unencrypting it we’re able to optimize the operating system’s performance without compromising security," an Apple spokesperson told TechCrunch. "Apple confirms iOS kernel code left unencrypted intentionally" Which is it, cache (of what?) or code?

The spokesperson is talking out of their ass regarding performance. The kernel is decrypted by iBoot once at boot, using the hardware AES engine. It remains decrypted until the device is shutdown/rebooted. Decompressing and decrypting the kernel takes less than a second at boot.

Also, TechCrunch fails to note that the kernelcache keys for most 32-bit kernels (and all iOS versions) are publicly available. Private individuals have dumped the keys for 64-bit kernels but they are not available publicly. Even without the keys, any jailbreak allows for dumping of the kernel. However, a kernel dump is missing very helpful MachO headers (handy for kloading) and, for 64-bit kernels, the EL3 TrustZone Watchtower module aka Kernel Patch Protection.

Post reply on HN