Apple is using the same commodity DRAM chips as everyone else. I doubt they are immune.

No need to "doubt". Just try Rowhammer via GLitch on a test iOS device. It will either work, or it will not. We need more people trying this out, informing vendors, and reporting their results in a REPLICABLE fashion.

>Just try Rowhammer via GLitch on a test iOS device

from TFA:

>the PoC currently works only on a Nexus 5 phone

This makes me _more_ certain iOS will end up being _more_ vulnerable to this type of attack.

It's almost certainly quite hardware specific, and if you were weaponising this there's way more homogeneous hardware on iOS than Android. Get this working on iPhone 7/8/X and you've probably got 75% of the "high value" iOS device fleet covered.

They are probably immune to this specific implementation simply because the relevant bits are in different locations - but not to the attack in general.

Row hammer mitigations exist. Do you have some proof one way or the other?

Although not evidence either way - were apple to include mitigation for row hammer its most likely they would advertise it as they do their other security infrastructure. Its about on-par with the encryption processor in the imac pro in terms of technicality and that is public information.

They did increase their DRAM refresh rate and mentioned it in release notes. There is not much more you can do easily - and it comes at a real cost in power usage.

https://support.apple.com/en-us/HT204934

You can actually refresh specific rows adjacent to frequently accessed ones by issuing ACT->Precharge command combos. Timed right it only comes into play during attacks (whether intentional or by coincidence) and therefore has little additional power usage.

Also that release note was for the Mac not the iPhone. They are less likely to apply that mitigation to the iPhone precisely because it would result in increased power consumption. They could however integrate the more advanced fix in the memory controller since they control the SoC. I would expect them to brag about it if they had.

Exactly, that is a beautiful mitigation - as long as you can upgrade the memory controller. I really hope vendors are doing this on all new chips!

Buy a used iPhone? I am on a 6 and it works just fine. Goes for around 150$ to 200$ non negotiated.

Problem is the battery and storage degradation is very real. While a simple factory reset solves some of the storage fragmentation, you'll never get the original owner's same experience with the device (unless you won the used device lottery and received a barely used handset).

But something like an iPhone 6 definitely is a competitor against a brand new $200 Android device (and may receive security updates for longer).

Out of curiosity, when have you last used a 200$ Android phone?

The options available nowadays are pretty good with updates (from Android One initiative) and hardware similar to (in a few cases, significantly better than) last gen flagships.

Care to name a few?

I just bought a few for testing at work. There's the HTC EVO 10 for $185[1], the Huawei Honor 6X for $200[2], and the Motoroloa Moto E4 Plus for $130(!)[3]. I also got a Samsung S6 to test, but at $250 for a much older phone, I wouldn't recommend it (but it is a fine phone, it's what I've been using personally for a few years).

I just set them up today, but I have to say, the $130 price point of the Moto E4 is pretty enticing given it seems responsive and has a fairly large screen (and if you are fine with Verizon, you can get it for $70 no contract[4]). The H6 seems like the one aimed the most to be a flagship phone. Fairly polished, and with a rear fingerprint sensor (all or almost all the rest have a fingerprint sensor, it's just on the front).

Edit: Whoops, the Verizon link and price is for the Moto E4, while what I purchased was a Moto E4 Plus, which Verizon has for $110[5]).

1: https://www.amazon.com/HTC-32GB-UNLOCKED-Version-GunMetal/dp...

2: https://www.amazon.com/Honor-6X-Unlocked-Smartphone-Silver/d...

3: https://www.amazon.com/XT1771-Finger-International-Version-D...

4: https://www.verizonwireless.com/prepaid/smartphones/moto-e4-...

5: https://www.verizonwireless.com/prepaid/smartphones/moto-e4-...

Swap the battery. I did on my 6S and it's like a new phone, seriously.

This makes some sense. A few months back Apple was found to be limiting the performance of iPhones with degraded batteries. A fresh battery wouldn't have that issue.

It makes 100% sense, that's why I did it.

the battery could be replaced for 50 usd

You should look into the latest Nokia android phones, they are receiving updates rapidly, and they've promised to update them for quite a while

EDIT: best part they are really cheap but great build quality

Any Android One device is probably worth a look. Maybe used iPhones too - though given Apple's slowdown with old batteries and attitude towards right to repair I'd be quite hesitant to seriously suggest that these days.

I buy all of my Apple equipment used or refurbished. I only need it to build and test iOS apps, but it’s perfectly usable if you like Apple stuff.

> Android phones are a security mess since they never get updated.

Use Google Fi? Latest, regularly updated Android on nice hardware... cheap rates..

"Android on nice hardware..."

Tell that to the 5X users...

Don't forget the 6P users either!

The phone that got me to give up on Nexus. Worst phone I ever had.

Get a phone from someone who updates, like the Google Pixel.

Google may be marginally better at updating their own devices, but they regularly suggest Play Protect as how to stay safe from malware, a piece of software that ranks dead last (literally zero stars) for detection rate on AV-TEST[1]. It's the sort of "here's a green check mark, just trust us" security approach that has carried McAfee for decades.

I was hoping we'd hear some changes with the new security lead at Android, but so far its been more of the same.

[1] https://www.av-test.org/en/antivirus/mobile-devices/

How to stay safe from Android malware: buy a phone with regular security updates. Don't install random APK's from Russian boards. Simple.

Android AV is useless bloat. It runs in its own sandbox just like every other app. Play Protect is the only one with privileges to actually do something.

If Play Protect is the only one that can do something, we are in deep trouble, given its detection rate...

I'm a sucker who bought from nexus one to moto x dev edition (during google ownership of motorola), and all in between... all promised continuous android updates. all had a SINGLE major version update, just like any other flagship phone. don't buy google marketing.

btw, im running recent versions via community roms on all of them, even the nexus one! so not hardware limitation, but the same greed and planed obsolescence at play on other companies makes google abandon phones just the same.

stop spreading lies for them, please.

> stop spreading lies for them, please.

Ok, I was going to let this go as a difference of opinion, but now you've called me a liar. I've owned the following Android phones:

1. Nexus One 2. LG G2x 3. Samsung Galaxy S2 4. Samsung Galaxy S4 5. Motorola Moto X 6. Moto G2 7. Nexus 5x 8. Pixel (1st gen, non XL)

Of those, the best android phone I've ever had was the Nexus One. Amazing phone. I would LOVE a new version of that, same form factor (you can kill the ball), please make another dock, but modern innards and screen. It had THREE major versions of Android, it debuted with Eclair, saw Froyo, and then Gingerbread. 3 major versions.

The LG G2x was trash, so bad they lost a class action suit on the faulty hardware. I swore never another LG phone. I have no idea what OS updates it got, it was horrible.

The Galaxy S2 and 4 were ok, better with CyanogenMod. The S2 saw Gingerbread, ICS, and Jellybean from Samsung, an impressive array. The S4 got Jellybean, Kitkat, and Lollipop. Both got 3 major versions.

The Moto X was a close #2 to the Nexus One. Incredible phone that they screwed up with the X2. It saw Jelly Bean, Lollipop, and Kitkat. The G2 was great for a budget phone, saw Kitkat, Lollipop, and Marshmallow. 3 major versions.

My 5x was beautiful, but a bit disappointing at times. Again, LG, I thought the Nexus name would make it better, it was, but not by much. LG has a talent for making self destructing phones. It had Marshmallow, Nougat, and Oreo. 3 major versions.

My Pixel came with Nougat, and now has Oreo. 2 major versions.

All of these phones had 3 major OS updates, aside from the G2x and the Pixel, and the Pixel hasn't seen a third because it's on the latest Android available right now.

Looking at Wikipedia, only the Galaxy Nexus got two letter-revisions, but that takes it from 4.0 to 4.3, with Jelly Bean being 4.1, 4.2, and 4.3 (as well as 4.x.y releases), seeing THREE 6 month release cycles in July 2012, November 2012, and July 2013.

Every single Google Nexus phone has had years of new releases, with at least three major versions for every single Nexus phone, and the Pixels will see at least three major revisions as they've releaed the dev preview of Android P on the 1st gen Pixels.

Nexus and Pixels get the new releases first, very quickly, with monthly updates over the past several years. So, in summary, please do not call me a liar.