Conversation

I can confirm. Someone who works at a premiere shop that sells 0days to governments told me persistence is the hardest thing on iOS.

Quote Tweet

nex

@botherder

Feb 18, 2020

With increasing reports on the difficulty for attackers to maintain persistence over some mobile devices, I find myself thrilled to for once actually seriously recommending “turning your device off and on again”.

GIF

134

457

Replying to

With upcoming iphone release with CPU supporting memory tagging, say bye bye to RCE forever

Replying to

and

Is that coming?

Replying to

and

Because I don't see it yet.

Replying to

and

CHERIE has been around for a while… it is being seen as something worth sticking in hardware via MT. We'll see how the implementation holds up against reality.

Replying to

The tags are only 16-bit. At best it can provide a 14/15 chance of catching generic memory corruption bugs. Can do better and provide deterministic protection against a subset of bugs such as all sequential overflows and with some effort use-after-free within N allocations.

8:11 PM · Feb 18, 2020Twitter Web App

Replying to

MTE relies on the same spare bits as PAC, so using it will weaken PAC even further too. There are not many spare bits in 64-bit pointers so these secret-based mitigations are quite weak. It's not like deploying tagging with 128-bit pointers containing 80-bit tags, or even larger.

Replying to

It's only inter-object safety (16 byte granularity), and each allocator needs to implement it. Also not yet clear how expensive compiler features like llvm.org/docs/MemTagSan will be for covering stack variables in addition to the heap. May only get deployed for heap in practice.

Replying to

Which implementation are you talking about here?

Replying to

ARMv8.5 MTE (Memory Tagging Extension), which should be available on real hardware within the next couple years. It will very likely be shipped in production by Android and iOS as soon as the hardware makes it available. MTE is very similar to how ADI works on SPARC though.

Show replies