The extra barriers Apple is throwing up in the way of security researchers make me much more nervous about using their stuff.
It’s not totally the case that security researchers are (today) locked out of iOS. But it’s definitely getting harder. The work that P0 had to do to RE iMessage is an example. googleprojectzero.blogspot.com/2021/01/a-look…
Does it make me nervous that Apple had to write a “firewall” to protect iMessage from malicious payloads (because they’re not confident it can be secured)? Hell yes it does. Would it be nice to have more people banging on this? Yes!
I’d like to believe that the (relatively small?) attack surface on my locked phone’s USB interface is now pretty hardened, but who knows. It was clearly full of crufty certificate parsing code back in 2016.
The barriers Apple has thrown up do not seem to slow down NSO, GrayShift and Azimuth that much. But they seem to be a real pain for anyone who isn’t a professional 0day seller.
Here’s an old BlackHat presentation by David Wang at Azimuth (and others) exploring Apple’s SEP processor. I wonder what they’ve learned (in secret) since then. blackhat.com/docs/us-16/mat…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
