Changes in iOS 7 Security Make Kernel More Vulnerable to Attack

[MacRumors]

A security researcher claims changes Apple made to tighten its kernel security system in iOS 7 instead weakened the system, making it less secure than its iOS 6 counterpart. (Via CNET and ThreatPost) Azimuth Security researcher Tarjei Mandt discovered the flaw and presented his findings last week at CanSecWest.

The security flaw involves the random number generator Apple uses to secure its kernel. In iOS 6, the number generator that encrypted the kernel derived its values in part from the CPU clock counter. Because it was based on time, the encryption was only marginally secure as the output values were predictable, especially when examining successive numbers.

Apple was aware of the limitations in iOS 6 and attempted to tighten security in iOS 7 by changing the random number generator to a linear congruential generator, which is more susceptible to brute force attacks.

The problem with the new generator in iOS 7 is that it uses a linear recursion algorithm, Mandt said, which has "more correlation" between the values it generates. That makes them easier to extrapolate and guess, he said.

This flaw potentially allows a malicious hacker to gain kernel-level access to an iOS device via an unpatched vulnerability. The kernel is the base part of the iOS operating system and controls low-level functions such as security and resource allocation.

Apple approached Mandt about his findings and asked for his CanSecWest slide presentation.


Article Link: Changes in iOS 7 Security Make Kernel More Vulnerable to Attack

 

[Mums]

Deliberate back door?

 

[nebo1ss]

Perhaps It will facilitate a 7.1 Jailbreak.

 

[dumastudetto]

Deliberate back door?

No. Apple would never do this. They never compromise on customer security for anyone.

 

[Calexander3103]

Deliberate back door?

Couldn't have been an accident that someone missed, could it? Nah....everyone get your tin foil hats out cause everyone's out to get us.


In reality, props to white-hat hackers like Mandt

 

[Kariya]

iOS 7.2 here we come.

 

[everything-i]

So they replaced one floored system where the code could be derived based on time to another that can only be cracked with bruit force guesses. So one is no more secure than the other. In other words its probably no more or less than it was before. Of course the tin foil hat brigade will have us all believe its a government conspiracy

 

[ArtOfWarfare]

Modern Intel chips (made after 2008 I think) have ISK which produces actual random values rather than pseudo ones. I guess ARM lacks that right now.

 

[jfx94]

This doesn't seem like a hole the way some other vulnerabilities are. This seems more like a structural weakness in the architecture (like using a softer steel than something bulletproof in construction). I doubt there will be a 'fix' for this; more likely iOS 8 or 9 will simply use stronger steel.

 

[H2SO4]

This doesn't seem like a hole the way some other vulnerabilities are. This seems more like a structural weakness in the architecture (like using a softer steel than something bulletproof in construction). I doubt there will be a 'fix' for this; more likely iOS 8 or 9 will simply use stronger steel.

I fear you are right. I also fear that iOS8 will only be available to the iP5 and upward.

 

[ZacNicholson]

Perhaps It will facilitate a 7.1 Jailbreak.

hopefully

 

[bigchief]

7.1 has more bugs than 7 it seems with my iPad Air.

 

[numlock]

wonder if phil schiller knows

 

[Analog Kid]

Deliberate back door?

What about the phrase "brute force attack" suggests "deliberate back door" to you?

 

[Laird Knox]

Random Number Generators are a tricky business. The company I work for has a whole slew of patents and protected IP just for the RNG we use.

 

[SAIRUS]

wonder if phil schiller knows

He'll need to stop watching The Black Knight Trilogy and get to his job.

 

[samcraig]

The new iPhone. We made everything thinner. Including security and the randomness of numbers.

 

[b0fh]

Modern Intel chips (made after 2008 I think) have ISK which produces actual random values rather than pseudo ones. I guess ARM lacks that right now.

Except that the Intel stuff isn't particularly trusted currently.

And with the new "we will run certain people run below the microcode level so that we can stop unauthorized programs and viruses that the OS can't see"... do you really trust those things?

 

[dugbug]

They have such great sources of entropy: signal strength, gyros, accelerometers, temperatures. I thought they employed some of these? At least arc4random()?

 

[street.cory]

They have such great sources of entropy: signal strength, gyros, accelerometers, temperatures. I thought they employed some of these? At least arc4random()?

Steve Gibson is that you?

 

[PBG4 Dude]

They have such great sources of entropy: signal strength, gyros, accelerometers, temperatures. I thought they employed some of these? At least arc4random()?

The article states this entropy pool is not available at boot time, when the number is generated.

 

[dugbug]

The article states this entropy pool is not available at boot time, when the number is generated.

ah makes sense how this would have been introduced then.

 

[ArtOfWarfare]

Except that the Intel stuff isn't particularly trusted currently.

And with the new "we will run certain people run below the microcode level so that we can stop unauthorized programs and viruses that the OS can't see"... do you really trust those things?

I'm not familiar with the things you're alluding to.

 

[springsup]

Yikes! That makes for some pretty worrying reading.

Apple can change the PRNG implementation without breaking things, and there are a number of good tips given in the slides. I'm sure we'll see a more robust generator in iOS8, but these fixes may be important enough to make it to iOS 7, too.

----------

I'm not familiar with the things you're alluding to.

I think he's talking about the NSA, and leaked reports where they claim to have inserted backdoors into hardware random number generators.

 

[gnasher729]

Deliberate back door?

Uneducated knee-jerk reaction?