This is bizarre. Apple appears to be misunderstanding their own security features. http://www.apple.com/customer-letter/ …
-
@JohnHedge Can you explain in more detail what exactly you don't think is right in that article?
@AriX I have no clue where they got the idea that changing SPE firmware will destroy keys. SPE FW is just a signed blob on iOS System Part
-
-
@JohnHedge Oh wow. That changes things a lot. -
@AriX The only immutable thing in any system is the hardware. (barring@azonenberg or Chris Tarnovsky getting at it) -
@JohnHedge Totally - I just assumed that the enclave keys being erased on update was hardware enforced, like@trailofbits said. -
@AriX@JohnHedge@trailofbits seems would be easy+obvious to build automatic erase on SE firmware change into hw. Are you sure they didn't? -
@ialexryan@AriX@trailofbits Am I sure? No. Do I think it's likely they want a way to update SPE FW? Absolutely, all SW has bugs -
@JohnHedge@ialexryan@AriX@trailofbits A lot of smartcard-like cpu designs out there still uses ROM masks for code. -
@Serianox_@ialexryan@AriX@trailofbits Right, and Apple has mask ROMs in all of its processors too, but you want to keep them simple
End of conversation
New conversation -
-
-
@JohnHedge@AriX why wouldn't apple require that the secure enclave be unlocked before it allows reflashing; otherwise secrets are destroyed -
@ejc3@JohnHedge Yeah there's an interesting possible middle ground here where upgrading the enclave would itself require user auth! -
@ejc3@JohnHedge In fact, that seems like such a great solution that I'm surprised they wouldn't have done it already? -
-
@JohnHedge@ejc3 Ahh thanks for the clarification. Does that mean SPE firmware is loaded completely in userland?
End of conversation
New conversation -
-
-
@JohnHedge@tiraniddo@AriX wouldn't that be the expected behavior? -
@osxreverser The problem is, as@JohnHedge shows, if updating the FW wiped the keys, such software updates would wipe all of the user's data -
@AriX@osxreverser@JohnHedge But has the SE FW already been updated? -
@_refocus@osxreverser@JohnHedge Someone should go IPSW spelunking and find out :) -
@AriX@osxreverser@JohnHedge Who's ready for some archeology? -
@_refocus@AriX@osxreverser Encrypted SPE FW is in /usr/standalone/firmware Data blob in im4p changes from iOS 7-9 but could be timestamp..
End of conversation
New conversation -
-
-
@JohnHedge@AriX Also remember this is a 5c. No touch ID. No secure enclaveThanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
@JohnHedge@AriX Could the SE have a bit of code in ROM that verifies a stored hash of the blob, and only update the hash upon PIN entry?Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.