Behind the scenes of iOS and Mac Security

on YouTube ↗44m

" summary

Apple describes a Mac secure boot built on the T2 security chip that initializes before x86, adds the first industry PCIe bus 0 DMA protections, and runs an option ROM sandbox that demotes and isolates ROMs; a live demo shows firmware patch attempts succeed without the sandbox and fail with it. iOS gets kernel integrity (KIP v1→v2), PPL, APR, and PAC protections. Find My uses P-224 public keys, 15-minute time periods, ANSI X9.63 KDF and ECIES so owners (not Apple) can decrypt location reports. Bounty payouts expand up to $1,000,000 and a researcher device with root shell is announced.

AI-written summary · about

" chapters (31)

1. 0:00Intro
2. 1:26Gatekeeper macOS Catalina
3. 1:39User Data Protections Data that requires user consent to access
4. 3:21Two Critical Challenges
5. 4:17Unrestricted Direct Memory Access
6. 5:07Direct Memory Access with VT-d
7. 5:27DMA Protection for Thunderbolt
8. 7:03DMA Protection for PCle Bus 0
9. 10:16PCle Option ROMS
10. 11:32OROM Sandbox
11. 16:08EFI Exploit Mitigations
12. 16:26Mac Secure Boot Summary
13. 17:02Software Enforced Code Integrity Before iOS 9
14. 17:22Kernel Integrity Protection vo
15. 18:44Lessons Learned
16. 19:54Kernel Integrity Protection v1: Read-Only Data
17. 20:31Kernel Integrity Protection v2
18. 22:11Fast Permission Restrictions (APRR) iPhone X
19. 22:48Pre-APRR VM Permissions
20. 23:00APRR: JavaScriptCore Execution Threads
21. 23:14APRR: JavaScriptCore JIT Compiler Thread
22. 23:26Protecting Userland Integrity
23. 23:45Page Protection Layer (PPL) iPhone XS
24. 25:15Page Protection Layer Summary
25. 25:57Pointer Authentication
26. 31:39Helping users find lost devices, even when offline
27. 32:39Security and Privacy Goals Protect owners, finders, and devices
28. 38:12Introduced in 2016
29. 42:27Making It Easier to Get Started with iOS Research
30. 43:03iOS Security Research Device program
31. 43:40Apple Security Bounty Summary

" related talks

• 52mBehind the Scenes of iOS SecurityIvan Krstić · Black Hat USA 2016
• 49mThe ARMs race for kernel protectionJonathanLevin · CODE BLUE 2016
• 01h 13mIs there an EFI monster inside your apple?Pedro Vilaça · CODE BLUE 2015
• 43miOS Application Defense - iMASGregg Ganley · AppSecUSA 2013
• 50mRo(o)tten Apples: Vulnerability Heaven in the iOS SandboxAdam Donenfeld · Black Hat Europe 2017
• 47mSecurity Threats & Mitigations for iOS DevelopersEmil Kvarnhammar · GOTO Copenhagen 2015
• 24mKeynote: The Evolution of Apple Private Cloud ComputeIvan Krstić · Confidential Computing Summit 2026
• 40mReverse Engineering the Customized Pointer Authentication Hardware Implementation on Apple M1Yu Wang, Zechao Cai, Wenbo Shen, Yutian Yang watchd0g, Jiaxun Zhu Sean · Black Hat USA 2023