Comment by p-e-w
3 years ago
> This is no ordinary vulnerability. Due to the closed nature of the iOS ecosystem, the discovery process was both challenging and time-consuming
Which, ironically, is evidence that "security through obscurity" does work, even though the authors implicitly criticize it in the same post.
Unfortunately, they only thing they obscured was the fix from the victim, it in no way obscured the attack from the attacker. So, yea, it "worked."
It's literally broken! It didn't work. The complaint is that the path from discovery of the hole to working exploit is longer. And... that's probably true. But that's optimizing the wrong side of the equation. An open system would have surfaced this bug long ago, possibly years ago (it's not clear how old this mistake is, but the claim seems to cover multiple Apple SOCs), and the vulnerable systems would have been limited to one version of the hardware that could feasibly have been replaced via warranty coverage or whatever. Now we're all stuck trying to patch around a fundamental hole in tens (hundreds?) of millions of phones.
> An open system would have surfaced this bug long ago, possibly years ago (it's not clear how old this mistake is, but the claim seems to cover multiple Apple SOCs), and the vulnerable systems would have been limited to one version of the hardware that could feasibly have been replaced via warranty coverage or whatever.
How long did it take for Spectre and Meltdown to be discovered? Some vulnerabilities are easy to spot in an open design, but the more novel the exploit, the longer the vulnerability can hide in plain sight.
This isn't that novel though. They have the GPU set up to do cache snooping from the CPU without a protection mechanism[1] to prevent the CPU from stuffing dirty writeback entries on top of it for the GPU to see. That's not subtle or weird, and it doesn't represent a new category of attack. It's just a routine security whopper.
[1] On Intel, the IOMMU provides this. But just a cache that was aware of range-level protections (i.e. only allowed you to cache CPU-visible RAM from the CPU, etc...) would have worked.
Once it's sufficiently obscure, we call it a "private key." They're like hipster prime numbers.
Obscurity can add some cost but has no real properties of strength.
I see this very often where encryption experts and FOSS advocates pooh-pooh obfuscation and opaqueness. "It's not REAL security", they say. And they are right.
This is like those Chinese outfits that laser off the part markings on ICs so others can't copy the design as easily. Eventually someone will find out what part number it is and the mitigation will be nullified. But it IS effective for a period.
In the same way obscurity provides a time bonus that must be worked through before exploitation can begin.
Hackers tend to complain very much about this obscurity stuff "all it does is waste people's time and it's not secure" which is exactly the point. Surely by now researchers must have realized that creating a 100 percent bulletproof security implementation is very unlikely when compared to how impenetrable any modern encryption system is, due to gotchas and flaws in the implementation details. And this is why obscurity slows down the discovery.
Denuvo DRM for new games is the same way. It is very hated but does work very well for the publisher at mitigating piracy for the initial 2-3weeks after a game launches where the bulk of sales happen.
DRM isn't a relevant comparison because there the explicit intention is to prevent users from accessing data they've already been given. Everyone knows this is not possible in a strong sense, time-wasting through obfuscation is the best DRM can hope for.
The other reason obfuscation makes sense for DRM is the threat actors are individual consumers, who have limited time and resources to devote to untangling the obfuscation, and limited reward for doing so.
Normally we might expect to see many such users combining their resources to fund a solution to their problem at scale (by founding a public business or foundation for de-obfuscating DRM), but the state has made doing this punishable by prison. So DRM is rendered effective not so much through good engineering but through the legal system. This is an adequate solution for companies when the threat actors are simple civilians who want to play video games.
except in this case, the attackers figured it out ages ago and everyone else was left in the dark.
The issue with obscurity is that attackers inherintly have a far higher incentive to try and understand obfuscated, undocumented messes than security researchers.
They're talking about the analysis and understanding of the malware