Conversation

I’ve been away from mobile security for a while so please educate me. I’d have guessed pure android (ie not android plus samsung apps) would have passed iOS in security by now…

Quote Tweet

Ryan Naraine

@ryanaraine

Jul 18, 2021

Reacting to iOS zero-days: Apple said: “Security researchers agree iPhone is the safest, most secure consumer mobile device on the market.”

David Weston (DWIZZZLE)

@dwizzzleMSFT

Jul 18, 2021

Replying to

@0xcharlie

I think they are comparable with pros and cons to both. The reality is if your adversary is that well funded and determined you are in trouble. Your best option at that point is to go custom with

@GrapheneOS

or turn on some exotic options like Asan/etc that would break stuff

Replying to

and

ASan is very weak as an exploit mitigation and requires losing github.com/GrapheneOS/har since they can't be used together. HWAsan is a lot more suitable to exploit mitigation but still not designed for it. MTE will provide everything it does and a lot more in hardened_malloc.

github.com

GitHub - GrapheneOS/hardened_malloc: Hardened allocator designed for modern systems. It has...

Hardened allocator designed for modern systems. It has integration into Android's Bionic libc and can be used externally with musl and glibc as a dynamic library for use on other Linux-base...

Replying to

We're still looking for a developer interested in integrating MTE into hardened_malloc via the existing QEMU support so that we have it ready when it launches in hardware. It's becoming a more pressing issue. It could launch for Pixels this year if they use their own SoC.

Replying to

We have funding for it available and the hard part of finding someone to work on it. I could do it, but there are too many higher priorities, at least until it's available in hardware and we need it before being able to officially support those newly launched devices.

9:48 PM · Jul 18, 2021Twitter Web App