Apple Confirms Unencrypted Kernel in iOS 10 Beta is Intentional
Yesterday it was discovered that iOS 10 does not feature an encrypted kernel, allowing users and researchers access to the core of the operating system and its inner workings. It was unclear at the time whether the lack of encryption was an accident or intentional, but today Apple confirmed to TechCrunch that the company did not encrypt the kernel for a reason.
“The kernel cache doesn’t contain any user info, and by unencrypting it we’re able to optimize the operating system’s performance without compromising security,” an Apple spokesperson told TechCrunch.
The kernel, which dictates how software can use hardware and keeps the device secure, is unencrypted so that developers and researchers can "poke around" and find potential security flaws. Because the kernel is easier to access and flaws may be easier to find, Apple can more easily and more quickly patch potential issues.
The move is a shift for Apple, who had encrypted the kernel in past versions of iOS, leaving developers and researchers out of the loop on the inner workings of the operating system. As noted by security expert Jonathan Zdziarski, it's likely that Apple has made this shift to prevent groups from "hoarding" vulnerabilities in Apple's software, like the vulnerability used by the FBI to break into the iPhone 5c of the San Bernardino shooter.
Popular Stories
The first iOS 17.3 beta rolling out to developers today includes a new "Stolen Device Protection" feature that is designed to add an additional layer of security in the event someone has stolen your iPhone and also obtained the device's passcode. Earlier this year, The Wall Street Journal's Joanna Stern and Nicole Nguyen reported about instances of thieves spying on a victim's iPhone...
Apple has made available for download its major end-of-year iPhone software update, iOS 17.2, featuring a large number of features and changes that users have been anticipating for quite a while. Below, we've listed 33 new things that your iPhone can do once you've installed the update. Check Settings ➝ General ➝ Software Update on your device to get downloading. 1. Help You Keep a Daily ...
With the launch of the iPhone 15, Apple introduced design changes like a curved frame and a frosted glass back. Information acquired by MacRumors suggests that Apple's next-generation iPhone 16 will build on these updates with modifications to the buttons and the camera layout. We have details on early pre-production designs for the iPhone 16, including a look at the variants and hardware...
Earlier this year, General Motors (GM) announced plans to phase out Apple's CarPlay and Android Auto in its future electric vehicles, with the company instead relying on an infotainment system co-developed with Google. This has not been a popular decision with iPhone users, and today, GM provided some additional insight into the decision in a discussion with MotorTrend. According to Tim...
While the iPhone 16 Pro and iPhone 16 Pro Max are still over nine months away from launching, there are already several rumors about the devices. Below, we have recapped new features and changes expected for the devices so far. These are some of the key changes rumored for the iPhone 16 Pro models as of December 2023:Larger displays: The iPhone 16 Pro and iPhone 16 Pro Max will be equipped...
Apple today released tvOS 17.2, the second major update to the tvOS 17 operating system that came out in September 2023. tvOS 17.2 comes more than a month after tvOS 17.1, an update that expanded the availability of the Enhanced Dialogue feature. tvOS 17.2 can be downloaded using the Settings app on the Apple TV. Go to System > Software Update to get the new software. Apple TV...
When Apple releases new software, iOS updates tend to get most of the attention, and there are sometimes useful new features in Mac updates that go under the radar. That's the case with macOS Sonoma 14.2. It doesn't have flashy features like the Journal app that came in iOS 17.2, but there are a number of useful improvements that make it worth installing. Subscribe to the MacRumors YouTube ...
Top Rated Comments
By contrast Microsoft offers $100,000 for a unique kernel level exploit, $15,000 for a Edge browser exploit and $100,000 for a unique solution to a presented exploit that they have yet to come up with / implement.
So if you were to find an Edge browser exploit in Windows 10 and another exploit that allowed you to jump the sandbox and gain root access to the operating system and then figured out a solution to stop the attack that is safe and implementable you could earn yourself $215,000.
Find the same in iOS, macOS, watchOS or tvOS and earn $0. It's about time Apple got serious and offered their own bug bounty program. It's the most meaningful way to get serious vulnerabilities reported.
And remember the FBI and NSA are paying upwards of $1 Million dollars (as shown in congress reports) for root level attacks on iOS, macOS and Windows. That is the competition. If you're a security researcher who're you gonna tell? Apple and earn nothing or the NSA/FBI and change your entire life?
You are calling it innovation, and then snickering at the "Apple marketing" in your mind for calling it innovation.
Well done.
Apple PR's statement that "[t]he kernel cache doesn't contain any user info" is ridiculously obvious to anyone with technical knowledge in this area. That statement is clearly only intended to placate the non-technical masses who might hear "Apple" and "unencrypted" in the same sentence and get worried about the privacy battle.
Secondly, what sort of performance improvement can this possibly make? Even assuming the kernelcache has to be decrypted once per boot, that must take what, a couple hundred milliseconds for the hardware-accelerated AES engine to do its thing?
I am really baffled by Apple's response. If it was indeed intentional, it must have been for reasons other than what they are saying.