A survey of recent iOS kernel exploits

https://googleprojectzero.blogspot.com/2020/06/a-survey-of-recent-ios-kernel-exploits.html

by edmorley • 6 years ago

120 69 6 years ago

googleprojectzero.blogspot.com

robocat• 6 years ago

Great summary list near end of article of the various mitigations used by iOS - there is quite a few hardware protections implemented within the processors themselves.

Android is less of a monoculture, but also has less opportunity to tune the processor to include strong hardware mitigations against whole classes of vulnerabilities.

stefan_2• 6 years ago

While iOS seems to pioneer every mitigation technique ever described in the literature, they also shipped ancient versions of C image parsing libs (OpenEXR), have an endless stream of remote code execution vulnerabilities from their peculiar serialization schemes and all the other issues you would expect from the use of native ObjC.

Their commitment is squarely to mitigating issues that threaten the walled garden (and therefore the kernel), not so much userspace.

RL_Quine2• 6 years ago

I don't think that's really fair, those classes of exploits (ie, libtiff / jailbreak.me) were around a decade ago now.

pjmlp8• 6 years ago

Solaris on SPARC did hardware memory tagging much earlier than iOS.

amluto• 6 years ago

The issue doesn’t seem to be ObjC per se. It’s the use of a facility that tries to transparently serialize an object in any rich language. Python pickle has the same issue, although it’s arguably worse in Python.

The solution is to abandon the whole approach — these systems should not be used across trust boundaries. Apple should create iMessage v2 using a real serialization system (protobuf, JSON, XML, ASN.1, etc) and deprecate the old scheme. It’s surely possibly to write a safe but non-extensible deserializer for the old protocol if compatibility is needed.

saagarjha11• 6 years ago

iOS also sometimes creates their own mitigation techniques. Sometimes these are quite strong but often they are…not really mitigating anything; in rare cases they make the situation worse. Shipping every mitigation under the sun is not necessary a good idea.

dontbenebby3• 6 years ago

Their commitment is squarely to mitigating issues that threaten the walled garden (and therefore the kernel), not so much userspace.

As a practical matter, doesn't this mean if I'm confident in my ability to avoid phishing messages, iOS is better?

Anything that "roots" a phone can also run roughshod, turn on my mic, grab signal messages stored locally, etc, correct?

What I'm getting at is a phone in a walled garden + a laptop that's open source might be the best way to get the security of the walled garden and the utility of open source.

pjmlp8• 6 years ago

That is changing with Android 11, which will require hardware memory tagging on ARM based devices.

Non-ARM devices will make use of a kernel fuzzer that chooses OS processes as victims to test.

Also Google keeps reducing the areas you are supposed to reach out to the NDK anyway.

panpanna3• 6 years ago

Looking the bottom part, is APRR the only mitigation exclusive to Apples own CPUs?

Also, is trustzone not available on these?

RL_Quine2• 6 years ago

There's no trustzone, no, but boot is completely verified in much stronger ways. Software updates are uniquely signed per device, per execution to prevent downgrade attacks.

q3k• 6 years ago

TrustZone is orthogonal to secure boot. It's close to functionality to SGX, trying to allow for some SecureElement-like functionality on the main SoC (in which you can do crypto, DRM, etc).

panpanna3• 6 years ago

This confused me.

How does these unique signatures work and how does it improve boot security?

saagarjha11• 6 years ago

I think KTRR is also something they’ve designed themselves. Or at least, I don’t think anyone is shipping anything comparable at the moment.

cancerSpreads• 6 years ago

Bookmarked for anytime someone tells me Apple products are secure.

Marketing doesn't line up with reality.

Not that those who parrot the marketing would be convinced with evidence.

pjmlp8• 6 years ago

No need, the security updates list already provides plenty of CVEs examples caused by memory corruption issues.

hn_check• 6 years ago

No software is completely secure, and even the most junior developer operates under that assumption. Therefore everything is relative.

Do you really think the Android list would be shorter, or less consequential?

AnonC2• 6 years ago

Hope you also tell people who use Android about the dismal state of updates (actually the lack of it) from most manufacturers and how most new phones come with older versions with security vulnerabilities not patched on that device (and probably will never be patched).

simonh• 6 years ago

So according to this article those of us on iOS 13.x (93% of the installed base) used to have one vulnerability, which we got patched through auto-updates 8 months ago. I'm quaking in my boots.

I hope you remember to point out the historical nature of this when you pass on the link.

yjftsjthsd-h• 6 years ago

In fairness, the question is less "how many vulns does this exact device have so far" and more "how many vulns are likely to occur for this device total", in which case this article could be evidence that the last few versions of iOS have each had their share, and therefore it is reasonable to extrapolate that to expect a handful of issues on this version. Now the first obvious catch is that you can't necessarily accurately project the past into the future; if most of these are the result of some underlying design strategy that Apple has stopped doing, then the exploits would dry up. On the other hand, of course, they could start shipping some new technology that turns out to introduce more vulns (not likely, but it could happen).

Of course, I'm pretty sure the same list of exploits per-version of Android would be much longer, so if anything this list, if complete, really does paint iOS in a very good light.

fsociety• 6 years ago

At least you are guaranteed security patches in a timely manner.

f00_• 6 years ago

I want to run open source software, but this is the show stopper

I wonder what the difference is in pricing on the 0 day market. I think iOS was always more expensive until last year

syspec• 6 years ago

Which is likely the hidden purpose of projectzero

zepto3• 6 years ago

It seems like marketing exactly lines up with reality. Security is relative, and compared to the alternatives, iOS is indeed secure.

slowmotiony• 6 years ago

When I had my Samsung Galaxy device it used to get a security update like once or twice a year, and usually it was not even available for my phone until my carrier allowed it a couple weeks later. That was a 800€ device too. It's absurd

AnonC2• 6 years ago

Hoping to see such a list for Android too. I don’t see one right now. [1] Some kind of comparison between iOS and Android on the kinds of issues and underlying causes would also be interesting.

[1] https://duckduckgo.com/?q=site%3Agoogleprojectzero.blogspot....

numbsafari• 6 years ago

I really appreciate and enjoy the work done by Project Zero.

But, it often does feel like it could be retitled Project Schadenfreude. This particular post almost feels timed specifically for release right before WWDC.

brian_herman__• 6 years ago

It agree wholeheartedly I was just going to post the same comment!

snazz2• 6 years ago

They're doing Apple a huge favor by discovering these bugs. They're doing the security community a huge favor by publishing blog posts about them for others to learn from. They also do plenty of Android research, although iOS is a higher priority since most security-conscious people use iOS (including the researchers themselves). This is not a hit piece on Apple.

bla3• 6 years ago

I'd guess they have better things to do than to align their work with the schedule of wwdc. Their job is to find security issues; they probably don't care much about wwdc one way or another.

gok• 6 years ago

It's kind of hard to search for an exploits for the Android kernel per se, since a lot of things in the Linux kernel also apply to Android.

snazz2• 6 years ago

While this is usually true, individual vendors do add their own kernel modifications: https://googleprojectzero.blogspot.com/2017/02/lifting-hyper...

LucidLynx3• 6 years ago

For people who think that there is far more CVE on iOS than Android (based on this article): https://www.cvedetails.com/top-50-products.php?year=2019

And it's for 2019 only

saagarjha11• 6 years ago

Number of CVEs in general is a fairly poor way to evaluate the security of a platform.

LucidLynx3• 6 years ago

Hum...

In this sentence: "For people who think that there is far more CVE on iOS than Android", when did I speaked about evaluating a security of a platform based on CVE? When?

I was only discussing about the fact that iOS does not have more CVE than Android, based on other discussions on this thread...

I am sorry if this message is mean but... did you read my comment at least?

albntomat07• 6 years ago

Agreed. In other comments here however, there are folks arguing that this shows iOS both is/isn't secure and that Project Zero has a hidden goal of making Apple look bad. I think the poster above is trying to respond/provide context to that.

izacus• 6 years ago

Why did you have to bring Android into this comment thread though?

albntomat07• 6 years ago

The parent comment didn't bring it up themselves. I believe it was in response to the Android comments all over the rest of the thread.

fortran77• 6 years ago

Amazing how something marketed as "secure by design" is, in fact, designed with the same issues as other competitive operating systems.

https://www.apple.com/business/docs/site/AAW_Platform_Securi...

saagarjha11• 6 years ago

Rather than responding to this again, I'll let the responses you got the other times you asked this do the talking: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

A survey of recent iOS kernel exploits

Related Stories