Changes in iOS 7 Security Make Kernel More Vulnerable to Attack

Discussion in 'iOS Blog Discussion' started by MacRumors, Mar 17, 2014.

  1. macrumors bot


    Apr 12, 2001

    A security researcher claims changes Apple made to tighten its kernel security system in iOS 7 instead weakened the system, making it less secure than its iOS 6 counterpart. (Via CNET and ThreatPost) Azimuth Security researcher Tarjei Mandt discovered the flaw and presented his findings last week at CanSecWest.

    The security flaw involves the random number generator Apple uses to secure its kernel. In iOS 6, the number generator that encrypted the kernel derived its values in part from the CPU clock counter. Because it was based on time, the encryption was only marginally secure as the output values were predictable, especially when examining successive numbers.

    Apple was aware of the limitations in iOS 6 and attempted to tighten security in iOS 7 by changing the random number generator to a linear congruential generator, which is more susceptible to brute force attacks.
    This flaw potentially allows a malicious hacker to gain kernel-level access to an iOS device via an unpatched vulnerability. The kernel is the base part of the iOS operating system and controls low-level functions such as security and resource allocation.

    Apple approached Mandt about his findings and asked for his CanSecWest slide presentation.

    Article Link: Changes in iOS 7 Security Make Kernel More Vulnerable to Attack
  2. macrumors 6502


    Oct 4, 2011
  3. macrumors 68020

    Jun 2, 2010
  4. macrumors 65816

    Aug 28, 2013
    No. Apple would never do this. They never compromise on customer security for anyone.
  5. macrumors newbie

    Mar 3, 2014
    Couldn't have been an accident that someone missed, could it? Nah....everyone get your tin foil hats out cause everyone's out to get us.

    In reality, props to white-hat hackers like Mandt
  6. macrumors 68000


    Nov 3, 2010
  7. macrumors 6502a

    Jun 20, 2012
    London, UK
    So they replaced one floored system where the code could be derived based on time to another that can only be cracked with bruit force guesses. So one is no more secure than the other. In other words its probably no more or less than it was before. Of course the tin foil hat brigade will have us all believe its a government conspiracy:rolleyes:
  8. macrumors 604


    Nov 26, 2007
    Modern Intel chips (made after 2008 I think) have ISK which produces actual random values rather than pseudo ones. I guess ARM lacks that right now.
  9. macrumors regular

    May 22, 2013
    where ever I am at.
    This doesn't seem like a hole the way some other vulnerabilities are. This seems more like a structural weakness in the architecture (like using a softer steel than something bulletproof in construction). I doubt there will be a 'fix' for this; more likely iOS 8 or 9 will simply use stronger steel.
  10. macrumors 68020

    Nov 4, 2008
    I fear you are right. I also fear that iOS8 will only be available to the iP5 and upward.
  11. macrumors 6502a


    Jun 25, 2011
  12. macrumors 6502a

    Feb 26, 2009
    7.1 has more bugs than 7 it seems with my iPad Air.
  13. macrumors 65832

    Mar 13, 2006
  14. macrumors 68030

    Analog Kid

    Mar 4, 2003
    What about the phrase "brute force attack" suggests "deliberate back door" to you?
  15. macrumors 65816

    Jun 18, 2010
    Random Number Generators are a tricky business. The company I work for has a whole slew of patents and protected IP just for the RNG we use.
  16. macrumors 6502

    Aug 21, 2008
    He'll need to stop watching The Black Knight Trilogy and get to his job.
  17. macrumors Pentium

    Jun 22, 2009
    The new iPhone. We made everything thinner. Including security and the randomness of numbers. :eek: :p
  18. macrumors member

    May 14, 2012
    Except that the Intel stuff isn't particularly trusted currently.

    And with the new "we will run certain people run below the microcode level so that we can stop unauthorized programs and viruses that the OS can't see"... do you really trust those things? :confused::confused:
  19. macrumors 6502a


    Aug 23, 2008
    Somewhere in Florida
    They have such great sources of entropy: signal strength, gyros, accelerometers, temperatures. I thought they employed some of these? At least arc4random()?
  20. macrumors 6502


    Oct 13, 2009
    Steve Gibson is that you?
  21. macrumors 65816

    Jul 6, 2007
    The article states this entropy pool is not available at boot time, when the number is generated.
  22. macrumors 6502a


    Aug 23, 2008
    Somewhere in Florida
    ah makes sense how this would have been introduced then.
  23. macrumors 604


    Nov 26, 2007
    I'm not familiar with the things you're alluding to.
  24. macrumors 6502a


    Feb 14, 2013
    Yikes! That makes for some pretty worrying reading.

    Apple can change the PRNG implementation without breaking things, and there are a number of good tips given in the slides. I'm sure we'll see a more robust generator in iOS8, but these fixes may be important enough to make it to iOS 7, too.


    I think he's talking about the NSA, and leaked reports where they claim to have inserted backdoors into hardware random number generators.
  25. macrumors G5


    Nov 25, 2005
    Uneducated knee-jerk reaction?

Share This Page