Apple Confirms Unencrypted Kernel in iOS 10 Beta is Intentional

Yesterday it was discovered that iOS 10 does not feature an encrypted kernel, allowing users and researchers access to the core of the operating system and its inner workings. It was unclear at the time whether the lack of encryption was an accident or intentional, but today Apple confirmed to TechCrunch that the company did not encrypt the kernel for a reason.

ios10

“The kernel cache doesn’t contain any user info, and by unencrypting it we’re able to optimize the operating system’s performance without compromising security,” an Apple spokesperson told TechCrunch.

The kernel, which dictates how software can use hardware and keeps the device secure, is unencrypted so that developers and researchers can "poke around" and find potential security flaws. Because the kernel is easier to access and flaws may be easier to find, Apple can more easily and more quickly patch potential issues.

The move is a shift for Apple, who had encrypted the kernel in past versions of iOS, leaving developers and researchers out of the loop on the inner workings of the operating system. As noted by security expert Jonathan Zdziarski, it's likely that Apple has made this shift to prevent groups from "hoarding" vulnerabilities in Apple's software, like the vulnerability used by the FBI to break into the iPhone 5c of the San Bernardino shooter.

Top Rated Comments

(View all)
Avatar
57 months ago
I'd just like to point something out. Apple does not offer a bug bounty program. That is to say there is no bounty to be awarded if you report a bug to them no matter how serious it is.

By contrast Microsoft offers $100,000 for a unique kernel level exploit, $15,000 for a Edge browser exploit and $100,000 for a unique solution to a presented exploit that they have yet to come up with / implement.

So if you were to find an Edge browser exploit in Windows 10 and another exploit that allowed you to jump the sandbox and gain root access to the operating system and then figured out a solution to stop the attack that is safe and implementable you could earn yourself $215,000.

Find the same in iOS, macOS, watchOS or tvOS and earn $0. It's about time Apple got serious and offered their own bug bounty program. It's the most meaningful way to get serious vulnerabilities reported.

And remember the FBI and NSA are paying upwards of $1 Million dollars (as shown in congress reports) for root level attacks on iOS, macOS and Windows. That is the competition. If you're a security researcher who're you gonna tell? Apple and earn nothing or the NSA/FBI and change your entire life?
Score: 57 Votes (Like | Disagree)
Avatar
57 months ago

I see. So open-source now equals openly exposing vulnerabilities for the collective good so a select user group can not exponentially exploit said vulnerability.

Yeah, didn't work too well for Android, though.

You're very confused. Please research the difference between binaries and source code.
Score: 27 Votes (Like | Disagree)
Avatar
57 months ago

I see. So open-source now equals openly exposing vulnerabilities for the collective good so a select user group can not exponentially exploit said vulnerability.

Umm, unencrypted binary != open source...
Score: 26 Votes (Like | Disagree)
Avatar
57 months ago

I see. So open-source now equals openly exposing vulnerabilities for the collective good so a select user group can not exponentially exploit said vulnerability.

Yeah, didn't work too well for Android, though.

Where does open-source come from? :confused:
Score: 21 Votes (Like | Disagree)
Avatar
57 months ago

In Apple marketing terms, this is called innovation.

Apple marketing is not calling this anything.

You are calling it innovation, and then snickering at the "Apple marketing" in your mind for calling it innovation.

Well done.
Score: 9 Votes (Like | Disagree)
Avatar
57 months ago
So has anyone in the tech press asked them why only the 64-bit kernelcache was left unencrypted while the 32-bit kernelcache remains encrypted? What about the update and restore ramdisks, which also remain encrypted? The rest of the boot chain? Why not let us peek at those, too?

Apple PR's statement that "[t]he kernel cache doesn't contain any user info" is ridiculously obvious to anyone with technical knowledge in this area. That statement is clearly only intended to placate the non-technical masses who might hear "Apple" and "unencrypted" in the same sentence and get worried about the privacy battle.

Secondly, what sort of performance improvement can this possibly make? Even assuming the kernelcache has to be decrypted once per boot, that must take what, a couple hundred milliseconds for the hardware-accelerated AES engine to do its thing?

I am really baffled by Apple's response. If it was indeed intentional, it must have been for reasons other than what they are saying.
Score: 8 Votes (Like | Disagree)

Top Stories

'A New iOS Update is Now Available' Popping Up Repeatedly in iOS 14 Beta [Fixed: New Beta Available]

Thursday October 29, 2020 6:11 pm PDT by
Many users running iOS 14 beta are reporting that they are seeing a dialog box pop up repeatedly asking them to update from the latest iOS 14 beta. Threads in our forums, Reddit, and Twitter are reporting the issue. The dialog has been appearing for a few days now, but as of tonight has started appearing more frequently, every time an iPhone is unlocked. There's been further discussion in...

Apple Seeds New iOS 14.2 Versions Which Stops 'New iOS Update Available' Alerts

Friday October 30, 2020 1:09 pm PDT by
Apple today seeded "Release Candidate" versions of upcoming iOS 14.2 and iPadOS 14.2 updates to developers and public beta testers, 10 days after seeding the fourth betas and a month and a half after releasing the iOS 14 and iPadOS 14 updates. iOS and iPadOS 14.2 can be downloaded by developers through the Apple Developer Center or over the air after the proper developer profile has been...

Apple One is Now Available: Save Money by Bundling Apple Music, iCloud Storage, Apple TV+, Apple Arcade, and More

Friday October 30, 2020 7:47 am PDT by
Apple One bundles are now available in the United States and over 100 other countries, allowing customers to subscribe to multiple Apple services through a single plan, including Apple Music, Apple TV+, Apple Arcade, iCloud, and more. To sign up for Apple One on an iPhone: Open Settings App Tap on Your Name at the top Tap on Subscriptions Tap on Apple One The prompt for Apple One...

Black Friday Spotlight: Best Buy Kicks Off a Month of Apple Deals and More

Friday October 30, 2020 10:02 am PDT by
We've begun tracking early Black Friday deals in our dedicated Black Friday Roundup, and in an effort to prepare our readers for the big shopping event we're highlighting sales store-by-store in the lead-up to November 27. Note: MacRumors is an affiliate partner with Best Buy. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running....

Apple Launches AirPods Pro Service Program for Crackling/Static Problems and ANC Issues

Friday October 30, 2020 3:03 pm PDT by
Apple today announced the launch of a new service program for AirPods Pro sound issues, which is designed to address AirPods Pro units experiencing static or crackling sounds or problems with Active Noise Cancellation. Faulty AirPods exhibit the following problems, according to Apple:Crackling or static sounds that increase in loud environments, with exercise or while talking on the phone ...

Apple CEO Tim Cook: 'More Exciting Things' in Store For This Year

Thursday October 29, 2020 2:20 pm PDT by
During today's earnings call for the fourth fiscal quarter of 2020 (third calendar quarter), Cook said that while he doesn't want to give too much away, "this year has a few more exciting things in store." Cook is likely speaking about the Apple Silicon Macs, as Apple has previously said the first Apple Silicon Mac will be coming before the end of 2020. There are rumors of a third fall event ...

Hands-On Comparison: iPhone 12 vs. iPhone 12 Pro

Friday October 30, 2020 2:29 pm PDT by
For those still trying to make a decision between an iPhone 12 or an iPhone 12 Pro, we picked up both models and in our latest YouTube video, did a hands-on comparison between them. Our video highlights the similarities and the differences so you can which one is the best fit for you and whether the iPhone 12 Pro is worth an extra $200. Subscribe to the MacRumors YouTube channel for more ...

Apple One Service Bundles Set to Launch Tomorrow, Fitness+ Coming This Quarter

Thursday October 29, 2020 1:39 pm PDT by
Apple in September announced Apple One, a new series of services bundles that will let Apple device customers purchase several services together in one package instead of separately, saving money for those who use multiple Apple service products. Ahead of Apple's earnings call, Apple CFO Luca Maestri told Bloomberg that Apple One is set to launch on Friday, October 30. Apple One Bundle...

PSA: Apple One Premier Bundle Only Available in US, UK, Canada, and Australia

Friday October 30, 2020 2:39 am PDT by
Apple's new Apple One series of services bundles launches on Friday in over 100 countries and regions, but the top Premier tier will be limited to the United States, the United Kingdom, Australia, and Canada. The limited rollout of the $29.95 Premier tier is down to the fact that Apple News+ is currently only available in the above countries. Apple News+ is exclusive to the Premier tier,...

Apple Says Record 2020 Mac Sales Attributed Primarily to MacBook Pro

Friday October 30, 2020 12:24 pm PDT by
Apple on Thursday reported its earnings for the fourth quarter of the 2020 fiscal year, including Mac revenue of $9 billion, a new quarterly record. Apple ended the year with annual Mac revenue of $28.6 billion, an all-time high. In its annual Form 10-K report [PDF], filed with the U.S. Securities and Exchange Commission today, Apple said increased Mac sales in fiscal 2020 compared to fiscal ...