Your Phone Is Your Castle

Re:Your Phone Is Your Castle by thatfrenchguy on Sunday September 13, 2020 @06:41PM (#24464537)

> There is custom silicon in every recent iPhone that does nothing but stop modification of kernel code, even in the face of code execution and arbitrary read/write in EL1: interesting from an academic standpoint, but if you stop and think about it for more than a second it's entirely useless for actually protecting users.

Every single malware (or jailbreak) wants to modify EL1 code, it's not just interesting from an academic standpoint.

[ Parent | on HN ]

Re:Your Phone Is Your Castle by saagarjha on Sunday September 13, 2020 @06:52PM (#24464603)

Malware has no need to modify EL1 code if it can grab your iMessages without doing so; exploit chains found in the wild grab the kernel task port (or equivalent) instead. Jailbreaks do want to modify EL1 code, but this comes back to the point I was making about this protecting Apple's software and not their users.

[ Parent | on HN ]

Re:Your Phone Is Your Castle by judge2020 on Sunday September 13, 2020 @07:11PM (#24464715)

To be fair, malware could also modify the kernel and achieve the same effect, so it does provide one step towards security and protecting the user.

[ Parent | on HN ]

Re:Your Phone Is Your Castle by saagarjha on Sunday September 13, 2020 @08:20PM (#24465210)

There's no reason for malware to do this, though. It's like putting reinforcing your back door so people can't kick it in while leaving the front door with a pickable lock.

[ Parent | on HN ]

Re:Your Phone Is Your Castle by stouset on Sunday September 13, 2020 @09:07PM (#24465565)

Except the front door doesn’t have a pickable lock, and this is just one of many overlapping security mechanisms. It’s like installing a metal back door and front door, bolting them, and also locking your windows.

Just because the windows can be broken more easily by an invader doesn’t mean there isn’t also value in the other steps you took.

[ Parent | on HN ]

Re:Your Phone Is Your Castle by saagarjha on Sunday September 13, 2020 @09:40PM (#24465829)

> It’s like installing a metal back door and front door, bolting them, and also locking your windows.

Except Apple hasn't done that, they have just reinforced the back door and left the front door (which has periodically been picked) open. As it stands now it mostly just exists to annoy jailbreakers.

[ Parent | on HN ]

Re:Your Phone Is Your Castle by stouset on Monday September 14, 2020 @12:24AM (#24466731)

iOS has probably the best security record of any widespread consumer operating system in history. Certainly better than Windows and Android.

[ Parent | on HN ]

Re:Your Phone Is Your Castle by shi314 on Monday September 14, 2020 @03:46AM (#24467805)

Apple Software is not secure either. Apple has just marketed themselves as being more secure.

https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...

[ Parent | on HN ]

Re:Your Phone Is Your Castle by nodamage on Monday September 14, 2020 @05:12AM (#24468222)

No platform is perfectly secure and every single piece of software is potentially vulnerable to zero-day exploits. The important question, as the previous commenter said, is what is the security record of each platform? And iOS is miles ahead of everyone else:

Among smartphones, Android™ devices are the most commonly targeted by malware. In mobile networks, Android devices were responsible for 47.15% of the observed malware infections, Windows©/ PCs for 35.82%, IoT for 16.17% and iPhones© for less than 1%.

Source: Nokia's latest threat intelligence whitepaper (https://onestore.nokia.com/asset/205835)

Apple also has a much better track record when it comes to providing long term security updates for the devices it sells.

[ Parent | on HN ]

Re:Your Phone Is Your Castle by pjmlp on Monday September 14, 2020 @05:20AM (#24468254)

While I agree that iPhones are more secure, one should also take into account that they represent around 20% of deployed phone devices across the world.

[ Parent | on HN ]

Re:Your Phone Is Your Castle by nodamage on Monday September 14, 2020 @05:40AM (#24468353)

Fair enough, but that doesn't really explain the difference. (5x as many devices but 47x as many malware incidents.)

[ Parent | on HN ]

Re:Your Phone Is Your Castle by brnt on Monday September 14, 2020 @10:28AM (#24470537)

I wouldnt assume install base is linear to malware incidence. I'd expect something supralinear as you observe here, after all, this type of dev in particular is after cost vs benefit ratio, so to first order only the largest ecosystem is worth your effort.

[ Parent | on HN ]