A new report published today in the MIT Technology Review delves into Apple’s continued work on device and software security and the possible unintended consequences. While almost all experts agree that the walled garden approach to the iPhone has solved the main security problems, some share the concern that it is also giving the world’s top hackers a better place to hide.
“It’s a double-edged sword,” says Bill Marczak, senior researcher at the Citizen Lab for cybersecurity surveillance. “You will avoid a lot of confusion by making it more difficult to break iPhones. But 1% of the top hackers will find a way to get in, and once inside, the impenetrable fortress of the iPhone protects them. “
Marczak was the lead author behind “The Great iPwn”, which investigated deeply how iMessage’s zero click failure worked on this saw Al Jazeera hacked journalists’ devices.
His main concern with the direction of increasingly blocked Apple devices is that it is becoming increasingly difficult for security researchers to discover malicious activity.
He argues that while iPhone security is getting more rigid as Apple invests millions to raise the barrier, the best hackers have their own millions to buy or develop zero-click exploits that allow them to take control of iPhones in a way invisible. This allows attackers to infiltrate the restricted parts of the phone, without ever giving the target any indication that it has been compromised. And, since they are so involved, security becomes a barrier that prevents investigators from detecting or understanding nefarious behavior – to the point where Marczak suspects they are missing out on everything except a small fraction of the attacks because they cannot see through. behind the curtain.
While Apple updates fix security flaws and bugs, they can also break the tools used by researchers.
Sometimes, the blocked system can backfire even more directly. When Apple released a new version of iOS last summer in the middle of Marczak’s investigation, the phone’s new security features eliminated an unauthorized jailbreak tool that Citizen Lab used to open the iPhone. The update blocked him from the phone’s private areas, including a folder for new updates – which ended up being exactly where the hackers were hiding.
In the face of these blocks, “we kind of throw our hands up,” says Marczak. “We can’t take any of this – it just can’t be helped.”
MIT also spoke with a security researcher who has much rarer access to an Apple-approved research application called iVerify:
Ryan Stortz is a security engineer at Trail of Bits. He leads the development of iVerify, a rare Apple-approved security application that does its best to spy inside iPhones while following the rules set out in Cupertino. IVerify looks for security anomalies on the iPhone, such as unexplained file modifications – the kind of indirect clues that can point to a deeper problem. Installing the application is a bit like setting up the shooting cables in the castle that is the iPhone: if something is not as you expected, you know there is a problem.
But, like the systems used by Marczak and others, the application cannot directly observe unknown malware that breaks the rules and is prevented from reading the iPhone’s memory in the same way that security applications on other devices do. The wire is useful, but it is not the same as a guard who can walk around every room in search of invaders.
Although Stortz admits the challenges of discovering vulnerabilities in Apple devices, he thinks the blocked approach is the right one. “As we block these things, you reduce the damage from malware and spying,” he says.
And, as we saw last fall, with the arrival of the first Apple Silicon M1 Macs, the company’s notebooks and desktops have increased security.
“IOS is incredibly secure. Apple saw the benefits and has been transferring them to the Mac for a long time, and the M1 chip is a big step in that direction, ”said security researcher Patrick Wardle.
Macs were moving in that direction years before the new hardware, adds Wardle. For example, Apple does not allow Mac security tools to analyze the memory of other processes – preventing applications from checking any room in the castle other than yours.
Wardle added that “security tools are completely blind and opponents know it”, which means that the game of hide-and-seek between Apple and hackers evolves and continues.
Others expect Android and Windows to follow Apple’s blocked devices security approach.
It’s just not Apple, says Aaron Cockerill, chief strategy officer at the mobile security firm Lookout: “Android is getting more and more blocked. We expect Macs and, ultimately, Windows to look more and more like the opaque model of the iPhone. “
Finally, the report talks about an approach in which Apple could theoretically give researchers limited rights to give them more access to discover hidden flaws or malicious exploits. But the problem there is the same that Apple has been talking about since the San Bernardino case: if this creates an exception or back door for researchers, it will end up being exploited by nefarious hackers.
Apple and independent security experts agree here: there is no simple solution. Apple strongly believes it is making the right changes, a spokesman said in a telephone interview recently. Cupertino argues that no one has convincingly demonstrated that loosening security enforcement or making exceptions will ultimately serve a greater good.
As for the future, Ryan Stortz, from Trail of Bits, believes that we are moving to ordinary users who choose mobile devices:
“We are going to a place where only outliers will have computers – people who need them, as developers. The general population will have mobile devices that are already in the paradigm of the walled garden. This will expand. You will be a stranger if you are not in the walled garden. “
Related:
FTC: We use affiliate links for cars that generate revenue. Most.
Check out 9to5Mac on YouTube for more news from Apple: