9

I'm interested in how the RAM can be exploited in iPhone 5+, iOS 8+.

I've previously discussed general iPhone encryption and from the response it reads:

There are many exploits over the years that can give kernel-level code execution on an iOS device, but almost all of them require either unlocked physical access to the device or rebooting, which would clear the AfterFirstUnlock key from memory. The key is not encrypted in RAM, so opening the phone and accessing the RAM chip directly might work, except for the fact that the iPhone uses a package-on-package construction, and the RAM chip would have to be separated physically from the processor first--without destroying the data, so the chip would need power and/or to be frozen the whole time.

The physical security of iPhone RAM seems good, but how about software level exploits of RAM on (a locked) iPhone? What can be found, or why is it unrealistic? Is iPhone RAM well protected?

EDIT: to be specific, the scenario is re-locked iPhone (unlocked once since power up)

Improve this question
3
  • Do you mean in terms of buffer overflow?
    – Purefan
    Dec 1, 2015 at 9:40
  • Knew this was a shot in the dark, but had to ask. I mean any known memory-related exploit that isn't patched.
    – Manumit
    Dec 1, 2015 at 20:53
  • I doubt you will get any answers on this but good luck :]
    – Purefan
    Dec 2, 2015 at 8:53

1 Answer 1

Reset to default
1

The short answer is that it is not easy to exploit iOS RAM via software.

iOS has two memory related security features: (1) Address space layout randomization (ASLR) for protection against memory exploits, and (2) ARM processor's Execute Never (XN) feature, which marks memory pages as non-executable. With ASLR the data won't always be in the same place in the memory - this makes it tough for buffer overflows and its ilk to work reliably.

Also the response you quoted isn't accurate for newer devices. For iPhone 5s and up or any device uses the A7 or above processor has a hardware component called the Secure Enclave that more securely handles keychain operations with features like memory encryption.

Another factor to consider is depending on your application and information sensitivity, there are several other options in addition to AfterFirstUnlock. In theory, you may be able to glean information from the device for apps that store information at the AfterFirstUnlock level. But not from any apps that utilize the WhenUnlock level.

Apple makes a judgement call balancing convenience and security by storing VPN & WiFi passwords with AfterFirstUnlock, but more personal Safari passwords at WhenUnlocked. These seem to be reasonably good guidelines to abide by. In other words even if an exploit were possible on a locked phone the information exposed is still limited.

Having said that the bigger concern these days may be application developers who do not fully understand the implications of different accessibility levels when storing data in the keychain or when utilizing file data protection. If storing something important - make sure to use WhenUnlocked, which requires the phone to be unlocked to access. Some apps even add their own app level passcode to encrypt what they consider critical information as well.

There's a lot more detail in Apple's iOS Security Guide on these items.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .