Conversation

I can confirm. Someone who works at a premiere shop that sells 0days to governments told me persistence is the hardest thing on iOS.

Quote Tweet

nex

@botherder

Feb 18, 2020

With increasing reports on the difficulty for attackers to maintain persistence over some mobile devices, I find myself thrilled to for once actually seriously recommending “turning your device off and on again”.

GIF

134

457

Replying to

With upcoming iphone release with CPU supporting memory tagging, say bye bye to RCE forever

Replying to

and

Is that coming?

Replying to

and

Because I don't see it yet.

Replying to

and

CHERIE has been around for a while… it is being seen as something worth sticking in hardware via MT. We'll see how the implementation holds up against reality.

Replying to

The tags are only 16-bit. At best it can provide a 14/15 chance of catching generic memory corruption bugs. Can do better and provide deterministic protection against a subset of bugs such as all sequential overflows and with some effort use-after-free within N allocations.

Replying to

Which implementation are you talking about here?

Replying to

ARMv8.5 MTE (Memory Tagging Extension), which should be available on real hardware within the next couple years. It will very likely be shipped in production by Android and iOS as soon as the hardware makes it available. MTE is very similar to how ADI works on SPARC though.

Replying to

I did a write-up at github.com/GrapheneOS/har on a high-level approach to making the most of it in a dynamic memory allocator. You can see the instructions that are used for MTE in github.com/llvm/llvm-proj. I don't plan to add the code to hardened_malloc until I can test it though.

github.com

scudo: Add initial memory tagging support. · llvm/llvm-project@c299d19

When the hardware and operating system support the ARM Memory Tagging Extension, tag primary allocation granules with a random tag. The granules either side of the allocation are tagged with tag 0,...

9:01 PM · Feb 18, 2020Twitter Web App