IOS security

iOS security

iOS security refers to the security implementations and policies in iOS. Broadly, these include protections against zero-day vulnerabilities that are typically implemented during code execution in real-time and update policies for software to protect against known vulnerabilities.

Memory safety

Memory safety issues are the most common cause of discovered vulnerabilities in computer software. They are typically caused by the common use of languages such as C and C++ in combination with improper memory management, leading to potential memory errors such as a buffer overflow.

These vulnerabilities are extremely dangerous, as they can lead to arbitrary code execution and privilege escalation. Vulnerabilities such as Heartbleed or Pegasus were known to be caused by these issues. In response, iOS features complex mitigations.

Hardened memory allocation

iOS features kalloc_type, which is a hardened memory allocator. It is designed to enforce temporal safety, spatial safety, type safety, definite initialization, and thread safety in computer memory.

Swift memory safety and usage

Swift is a programming language that features built-in memory safety. Although Swift is not used extensively in the XNU kernel, it is commonly used in user space. This reduces the chances of privilege escalation.

Pointer authentication codes

Pointer authentication codes are a security feature that is present in the ARM64 specification, specifically ARMv8.3-A. It is specifically designed to mitigate memory safety vulnerabilities. In iOS, pointer authentication codes have been utilized since the iPhone X to secure system files and user space applications. Five secret 128-bit cryptographic values are used to sign kernel instructions and values, while a B key is generated for each user space process.

Address space layout randomization

Like many other operating systems, iOS makes extensive use of Address Space Layout Randomization to mitigate memory safety issues.

Integrity

Page Protection Layer

Page Protection Layer is an Apple-developed process that verifies the integrity of user space applications following code verification. The largest advantage of this feature is attack surface reduction, as application integrity is enforced systemwide. Even if the XNU is compromised, each application process cannot be modified.

Confidentiality

Data Protection

Data Protection is an Apple-designed real-time or on-the-fly encryption process for iOS, iPadOS, and watchOS. This technology is also present on any other devices that have an Apple silicon SoC. This implementation allows for secure encryption of user files, even while the device is being used. Data Protection leverages the hardware security mechanisms that are present in Apple silicon, as well as certain features in the proprietary Apple File System (APFS).

Data Protection functions by generating and managing a hierarchy of keys, such that each key corresponds to a file that is present in the file system. APFS can further divide this concept to include portions of files. Each cryptographic key is required to decrypt the file, view or change its contents, and then encrypt it. Data Protection is hardware accelerated on Apple silicon, and it uses the Advanced Encryption Standard protocol with a 256-bit key size in XTS mode (AES-256-XTS).

Data Protection is not a form of full-disk encryption.

In comparison to macOS

Apple's Senior Vice President of Software Engineering, Craig Federighi, has publicly stated that the current state of macOS security is "unacceptable." Although macOS largely retains the verified boot chain that is present in iOS and its derivatives, it is inherently a more vulnerable platform due to the presence of side loading and a lack of common mobile security policies, such as strong sandboxing.

macOS provides Gatekeeper, which is a security program that uses signature-based detection to eliminate malware before it is ever installed. However, macOS has often been criticized for a lack of anti-malware solutions beyond installation. Exploit mitigations that are present in the modern Windows NT kernel are nonexistent.

References

This article "IOS security" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:IOS security. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.

---