New in OS X: Get MacRumors Push Notifications on your Mac

Resubscribe Now Close

Full Video of Apple Engineer's Black Hat Security Talk Now Available

Tuesday August 16, 2016 5:06 pm PDT by Juli Clover
Earlier this month, Apple's head of security engineering Ivan Krstic gave a talk at the Black Hat Conference, an annual event designed for the global InfoSec community. During the event, Krstic spoke about Apple security and unveiled the company's new bug bounty program.

Krstic's briefing is now available in full on YouTube, shared this morning on the Black Hat YouTube channel in a video entitled "Behind the Scenes of iOS Security."


In the talk, Krstic covers three major iOS security mechanisms -- HomeKit, Auto Unlock, and iCloud Keychain -- in "unprecedented technical detail," along with other iOS security measures.
HomeKit, Auto Unlock and iCloud Keychain are three Apple technologies that handle exceptionally sensitive user data - controlling devices (including locks) in the user's home, the ability to unlock a user's Mac from an Apple Watch, and the user's passwords and credit card information, respectively. We will discuss the cryptographic design and implementation of our novel secure synchronization fabric which moves confidential data between devices without exposing it to Apple, while affording the user the ability to recover data in case of device loss.

Data Protection is the cryptographic system protecting user data on all iOS devices. We will discuss the Secure Enclave Processor present in iPhone 5S and later devices and explain how it enabled a new approach to Data Protection key derivation and brute force rate limiting within a small TCB, making no intermediate or derived keys available to the normal Application Processor.

Traditional browser-based vulnerabilities are becoming harder to exploit due to increasingly sophisticated mitigation techniques. We will discuss a unique JIT hardening mechanism in iOS 10 that makes the iOS Safari JIT a more difficult target.
The most notable moment of Krstic's briefing features the unveiling of Apple's first ever bug bounty program, which will see the company paying out up to $200,000 to researchers who discover vulnerabilities in Apple software. Apple's bug bounty program, initially limited to a few dozen researchers, launches this September.

[ 40 comments ]


Top Rated Comments

(View all)

Avatar
iTom17
33 months ago
I don't understand most of it either, but it's pretty fun to see how serious Apple is about system security.

I'm currently doing network administration, where network security is one of the topics we learn about. May not be on a big scale, but I actually like this whole subject. And I'm planning on doing something with security engineering after this.

So I may not understand 99% of this, it's just fun to watch. :p


By the way, here are the presentation slide: https://www.blackhat.com/docs/us-16/materials/us-16-Krstic.pdf
Rating: 6 Votes
Avatar
69Mustang
33 months ago

Sure, compared to whom?

And who takes security+privacy as seriously?

Who has an executive team that can axe marketable features for privacy reasons, that not even 1% of people gives a damn?

Calm down dude. It was just a sarcastic joke in response to another quote.
Rating: 5 Votes
Avatar
akfgpuppet
33 months ago
....and I understood like 5% of what he was talking about.
Rating: 5 Votes
Avatar
CarlJ
33 months ago

Apple's password to unlock everything is 12345. Try it out!

I've got that same combination on my luggage!
[doublepost=1471416518][/doublepost]

RIP Jailbreak.

If the choice is between security that vexes even governments, and wacky add-ons, I'll take the security every day and twice on Sunday.
Rating: 4 Votes
Avatar
yaxomoxay
33 months ago

but ios requires 6 numbers by default.


That's the trick that Cue designed. Everyone's is going for the six digits!
Rating: 4 Votes
Avatar
SomeSecurityGuy
33 months ago
"But but Apple doesn't take security seriously" - h8rs.
Rating: 3 Votes
Avatar
QuarterSwede
33 months ago
I've gotta say I'm more impressed with how they engineered this than I thought I'd be. The Safari bit at the beginning is genius. They basically rewrite how permissions are used by the system. It's also interesting to see how they keep the encryption keys private and how the secure enclave and other secure systems work to keep hackers out. It's only more impressive in iOS 10. Great post!
Rating: 3 Votes
Avatar
pat500000
33 months ago
The only thing I understood is "Thanks for coming" part.
Rating: 3 Votes
Avatar
citysnaps
33 months ago

Apple doesn't take security seriously enough.

:mad::mad::eek::eek: ;)


What specific technical guidance and advice would you pass on to Dr. Krstić addressing how Apple is not taking security seriously enough?
Rating: 2 Votes
Avatar
Pike R. Alpha
33 months ago

1) agreed, 2) they seem to consider it a much bigger target, and 3) actually, they've said that if you show up at the door with a sufficiently good case, you 'll get an instant invite to the party.

I don't expect the decision on whether or not to share source is based on what they think can be broken or what matters, but rather on what is or is not proprietary. All the GUI frameworks are their self-written code, and quite valuable to them (I totally get this - I use OS X because it's a UNIX workstation with a seriously good GUI, something that Linux has been trying and failing to deliver for many years). If they released all of OS X / macOS as open source, other companies would be slapping it on cheap PC hardware and competing against them on price. I'd love to have more (qualified) eyes on that code, but I can understand their position.
[doublepost=1471455354][/doublepost]It appears I'm in a minority position here - I watched the first part of it (got interrupted), and I don't feel lost, I feel giddy - love seeing other developers doing cool things, everything they said made delicious sense.

3.) maybe I wasn't clear enough. I mean. Bug bounties should not be invite only. Even if they would accept good POC's from anyone.

Also. I was only talking about the kernel. Not the GUI frameworks. The problem is that the XNU kernel itself isn't 100% open source.
Rating: 2 Votes

[ Read All Comments ]