Previewed at WWDC, launching in the fall.
Full Video of Apple Engineer's Black Hat Security Talk Now Available
Earlier this month, Apple's head of security engineering Ivan Krstic gave a talk at the Black Hat Conference, an annual event designed for the global InfoSec community. During the event, Krstic spoke about Apple security and unveiled the company's new bug bounty program.
Krstic's briefing is now available in full on YouTube, shared this morning on the Black Hat YouTube channel in a video entitled "Behind the Scenes of iOS Security."
In the talk, Krstic covers three major iOS security mechanisms -- HomeKit, Auto Unlock, and iCloud Keychain -- in "unprecedented technical detail," along with other iOS security measures.
Krstic's briefing is now available in full on YouTube, shared this morning on the Black Hat YouTube channel in a video entitled "Behind the Scenes of iOS Security."
In the talk, Krstic covers three major iOS security mechanisms -- HomeKit, Auto Unlock, and iCloud Keychain -- in "unprecedented technical detail," along with other iOS security measures.
HomeKit, Auto Unlock and iCloud Keychain are three Apple technologies that handle exceptionally sensitive user data - controlling devices (including locks) in the user's home, the ability to unlock a user's Mac from an Apple Watch, and the user's passwords and credit card information, respectively. We will discuss the cryptographic design and implementation of our novel secure synchronization fabric which moves confidential data between devices without exposing it to Apple, while affording the user the ability to recover data in case of device loss.The most notable moment of Krstic's briefing features the unveiling of Apple's first ever bug bounty program, which will see the company paying out up to $200,000 to researchers who discover vulnerabilities in Apple software. Apple's bug bounty program, initially limited to a few dozen researchers, launches this September.
Data Protection is the cryptographic system protecting user data on all iOS devices. We will discuss the Secure Enclave Processor present in iPhone 5S and later devices and explain how it enabled a new approach to Data Protection key derivation and brute force rate limiting within a small TCB, making no intermediate or derived keys available to the normal Application Processor.
Traditional browser-based vulnerabilities are becoming harder to exploit due to increasingly sophisticated mitigation techniques. We will discuss a unique JIT hardening mechanism in iOS 10 that makes the iOS Safari JIT a more difficult target.
[ 40 comments ]
Top Rated Comments
(View all)
25 months ago
I don't understand most of it either, but it's pretty fun to see how serious Apple is about system security.
I'm currently doing network administration, where network security is one of the topics we learn about. May not be on a big scale, but I actually like this whole subject. And I'm planning on doing something with security engineering after this.
So I may not understand 99% of this, it's just fun to watch. :p
By the way, here are the presentation slide: https://www.blackhat.com/docs/us-16/materials/us-16-Krstic.pdf
I'm currently doing network administration, where network security is one of the topics we learn about. May not be on a big scale, but I actually like this whole subject. And I'm planning on doing something with security engineering after this.
So I may not understand 99% of this, it's just fun to watch. :p
By the way, here are the presentation slide: https://www.blackhat.com/docs/us-16/materials/us-16-Krstic.pdf
25 months ago
Sure, compared to whom?
And who takes security+privacy as seriously?
Who has an executive team that can axe marketable features for privacy reasons, that not even 1% of people gives a damn?
25 months ago
Apple's password to unlock everything is 12345. Try it out!
I've got that same combination on my luggage![doublepost=1471416518][/doublepost]
RIP Jailbreak.
If the choice is between security that vexes even governments, and wacky add-ons, I'll take the security every day and twice on Sunday.
25 months ago
but ios requires 6 numbers by default.
That's the trick that Cue designed. Everyone's is going for the six digits!
25 months ago
I've gotta say I'm more impressed with how they engineered this than I thought I'd be. The Safari bit at the beginning is genius. They basically rewrite how permissions are used by the system. It's also interesting to see how they keep the encryption keys private and how the secure enclave and other secure systems work to keep hackers out. It's only more impressive in iOS 10. Great post!
25 months ago
Apple doesn't take security seriously enough.
:mad::mad::eek::eek: ;)
What specific technical guidance and advice would you pass on to Dr. Krstić addressing how Apple is not taking security seriously enough?
25 months ago
1) agreed, 2) they seem to consider it a much bigger target, and 3) actually, they've said that if you show up at the door with a sufficiently good case, you 'll get an instant invite to the party.
I don't expect the decision on whether or not to share source is based on what they think can be broken or what matters, but rather on what is or is not proprietary. All the GUI frameworks are their self-written code, and quite valuable to them (I totally get this - I use OS X because it's a UNIX workstation with a seriously good GUI, something that Linux has been trying and failing to deliver for many years). If they released all of OS X / macOS as open source, other companies would be slapping it on cheap PC hardware and competing against them on price. I'd love to have more (qualified) eyes on that code, but I can understand their position.
[doublepost=1471455354][/doublepost]It appears I'm in a minority position here - I watched the first part of it (got interrupted), and I don't feel lost, I feel giddy - love seeing other developers doing cool things, everything they said made delicious sense.
Also. I was only talking about the kernel. Not the GUI frameworks. The problem is that the XNU kernel itself isn't 100% open source.
[ Read All Comments ]
In iOS 12, Apple has given users the tools to cut down on disturbances to get more time away from their devices if desired, and one of these new tools is an expanded set of Do Not Disturb options.
...
When Apple launched the iPhone X, a whole new set of gestures were introduced, changing the way that we were used to interacting with our iPhones.
One of these changes involved the App Switcher...
For this week's giveaway, we've teamed up with Choetech to offer MacRumors readers a chance to win an 18W USB-C Power Delivery Wall Charger.
This giveaway product is a little simpler...
The very first Apple Store opened its doors on May 19, 2001, at the Tysons Corner Center shopping mall in McLean, Virginia, near Washington D.C. Now, just over 17 years later, those doors may soon...
Uber this week announced a partnership with startup "Cargo," which aims to increase the wages of rideshare drivers by providing them with small containers filled with goods that riders can...
In iOS 12, Apple's digital health push includes a couple of special new features for iPhone and iPad users who want to cut down on their app usage: App Limits and Downtime. In this article,...
The latest proposed U.S. tariffs on $200 billion of Chinese goods name Apple Watch and other activity trackers assembled in China, according to government rulings. Reuters reports the latest...
WhatsApp says it is limiting the ability to forward messages to multiple chats at once in an attempt to reduce the spread of spam and misinformation.
The news follows WhatsApp's recent...
