Everything has changed in iOS 14, but Jailbreak is eternal [pdf] (opens in new tab)

Here’s a thing about jailbreaking.

As a user I like my device being safe from outside attackers (NSO & co).

But I definitely do not want my device to be protected against me. It’s absurd that I have to use the methods of an attacker to gain modification privileges on a device I own.

Great write up and very well presented. All in all a bit disturbing but that's what you should get from Blackhat.

"Started macOS/iOS security from the second half of 2019"[!]

By the way, iOS devices also run a completely different OS on the secure enclave: https://sel4.systems/About/seL4-whitepaper.pdf

The SEL4 kernel is different because it has actually been "proved correct" and "proved secure" according to the authors.

How does this compare to security features of Android. Any good references.

for those looking for a TLDR:

- Result: run unauthorized code on iOS 14

- 14 is the most secure toy phone OS to date, with kernel heap hardening, data PAC, userspace PAC hardening, tfp0 hardening, ipc_kmsg hardening

- Exploit took advantage of multiple bugs, concentrating on PAC (Pointer Authentication Code, cryptographic signature on the pointer value, designed to resist memory disclosure attacks, for more context see [1])

- Multiple steps and dependencies, chaining vulnerabilities and exploits

- Code on https://github.com/pattern-f

I really commend Zuozhi Fan (@pattern_F_)for publishing the code with the report.

Additional resources:

[1] https://googleprojectzero.blogspot.com/2019/02/examining-poi...

The fact that Apple clearly cares a lot about software security from at least two angles--both securing the device for the user from external attackers (I know they truly care about this, even though they frankly seem to focus only on users in the west and have been known to throw people from the east under the bus without a fight: see their attempt to downplay Google Project Zero's critical discoveries a few years ago) as well as (sadly, but critically, as it establishes increased direct incentives) securing the software running on the device written by themselves and other content providers from the ostensible "owner" of the hardware (whether for digital rights management or anti-competitive purposes)--and has a centralized dedicated team that can learn from experience (to avoid making the same mistakes over and over across different releases, which was the norm at companies like Samsung for a long time) made up of incredibly smart people (including mercenary turncoats from the jailbreak community who either cared more about working on fun problems than fighting for the user or simply needed the cash so much the morals had to lose out) that has been staring at this problem now for well over a decade and who are on the cutting edge of deploying "mitigations" throughout both their software and hardware even if said mitigations cause multi-percent loss of performance for the user and even if it requires changes to some or all (omg) existing software AND YET--even if they have certainly made progress (the jailbreak ecosystem has been severely affected... I have given much longer talks on the status--such as the final segment of my "Hindsight can be 50/50" talk from 360|iDev a couple years ago, but the important thing to appreciate is that the time from having high-quality exploits for specifically-modern devices to when the vulnerabilities they rely on have been patched has gone from averaging months to averaging negative months as of a few years ago)--it SOMEHOW is STILL the case that people continue to find ways (even if they are highly costly to pull off and even if the resulting abilities are "limited": you really don't need much to do a denial of service or exfiltrate data... we focus a lot on what is required to build a high quality easy to use software modification stack, due to alternatives to the App Store like my Cydia, but that is "overkill" to someone merely trying to be malicious) to hack and slash through all of these defenses (even remotely!! the yearly iMessage exploit has almost become a trope) should be taken as a visceral demonstration that our industry simply seems incapable of developing secure software, and we either need an industry-wide "come to Jesus" moment whereby we reboot the entire thing with higher/safer abstractions written by fewer/smarter developers working in languages and with tools that allow us to prove the security of what we build (and no: Rust isn't enough... I give lectures at both college courses and hackathons on how real world jailbreak exploits have worked for both iOS and Android, and part of what makes it fun even for beginning developers is how many of the bugs are "conceptual"... it is absolutely true that memory safety helps, but we need to be striving for near-perfection here as the stakes are so high, and yet, somehow, we often manage to develop software that fails to provide safety for users without even a single incorrect use of memory storage primitives) which is going to require groundbreaking research that honestly might simply prove the impossibility of the task, or, maybe, we just need to give up and make sure that everyone everywhere lives in the same constant and healthy state of fear that every single computer we are surrounded by is a liability that could turn on us at any moment as those of us who "know better" do... and one day, it is going to happen: it isn't going to be a freedom fighter like Charlie Miller who figures out how to remotely disable the brakes on every Jeep Cherokee on the road simultaneously with a remote exploit--a true story that I believe every software developer should be taught in school in the same way that physicists are routinely taught about tragic historical mistakes in the handling of radioactive materials, to make sure no one casually deploys something that puts people's safety so directly tied to bugs in centralized servers--but it is going to be a "rogue nation state", "terrorist group", or, at this rate and with our luck the last few years, someone we might best describe as a "supervillain" (a movie where someone like George Hotz is the antagonist would be absolutely amazing: if anyone writes that script and needs a science advisor to help with making the technical details ridiculously accurate, hit me up) that gives civilization a serious and deadly lesson in cyber-security. :| :/ :(

When will start seeing laws making it illegal to disable the scanning for hashes?

I see many submissions from blackhat.com are direct PDF links, but that does not make me feel very comfortable.