Behind the Scenes of
iOS and Mac Security
Ivan Krstić
Head of Security Engineering and Architecture, Apple

Mac secure bootiOS code integrity protection
Find MyMac secure bootiOS code integrity protection
Find MyGatekeeper

User Privacy
Protection

Gatekeeper

macOS CatalinaFirst use, quarantinedFirst use, quarantined

Non-quarantined

Malicious content scan

No known malicious content

No known malicious content

No known malicious content

Signature checkNo tampering

No tampering−

Local policy check

All new software requires
notarization

All new software requires
notarization−

User must approve

Users must approve
software in bundles−

First launch prompt

User Data Protections

Data that requires user consent to access
Contacts
Calendars
Reminders
PhotosUser Data Protections

Data that requires user consent to access
Contacts
Calendars
Reminders
PhotosUser Data Protections

Data that requires user consent to access
Contacts

DesktopCalendars

Documents

RemindersDownloads

PhotosiCloud Drive
Third-party cloud storage
Removable volumes
Network volumes

What about secure boot?

Apple Requirement
Signature verification of complete boot chain
System Software Authorization (server-side downgrade protection)
Authorization “personalized” for the requesting device (not portable)
User authentication required to downgrade secure boot policy
Secure boot policy protected against physical tamper
System can always be restored to known-good state

UEFI

Mac Secure Boot

T2

Mac Secure Boot

T2

x86

Mac Secure Boot

T2

x86

Mac Secure Boot

T2
T2 ROMiBootbridgeOS kernel

x86
UEFI
firmwareMac Secure Boot

T2
T2 ROMiBootbridgeOS kernel

x86
UEFI
firmwaremacOS
bootermacOS
kernelTwo Critical Challenges
Thunderbolt and PCIe Direct Memory Access (DMA)• Accessories can read/write host memory without the involvement of the CPU

PCIe Option ROMs (OROMs)• Device-specific drivers for the early boot environmentRefresher — OS Page Tables
x86 CPU64 bit protected mode

“Read 4 bytes
from address
0x000003000000000”

UEFI

macOS

MMU hardware
Virtual memory enabled

x86 RAM

Page table hardware

Verified UEFI firmware
Data
0x1570000

Refresher — OS Page Tables
x86 CPU64 bit protected mode

“Read 4 bytes
from address
0x000003000000000”

UEFI

macOS

MMU hardware
Virtual memory enabled

x86 RAM

Page table hardware

Verified UEFI firmware

Consult page tables

Data
0x1570000

Refresher — OS Page Tables
x86 CPU64 bit protected mode

“Read 4 bytes
from address
0x000003000000000”

UEFI

macOS

MMU hardware
Virtual memory enabled

x86 RAM

Page table hardware

Verified UEFI firmware

Consult page tables

Data
0x1570000
Page tables:
virtual address
0x000003000000000
is actually in RAM at
physical address
0x1570000

Refresher — OS Page Tables
x86 CPU64 bit protected mode

“Read 4 bytes
from address
0x000003000000000”

UEFI

macOS

MMU hardware
Virtual memory enabled

x86 RAM

Page table hardware

Verified UEFI firmware
Data
0x1570000
Page tables:
virtual address
0x000003000000000
is actually in RAM at
physical address
0x1570000

Refresher — OS Page Tables
x86 CPU64 bit protected mode

“Read 4 bytes
from address
0x000003000000000”

UEFI

macOS

MMU hardware
Virtual memory enabled

x86 RAM

Page table hardware

Verified UEFI firmware

Fetch from
0x1570000
in RAM instead of
0x000003000000000

Data
0x1570000
Page tables:
virtual address
0x000003000000000
is actually in RAM at
physical address
0x1570000

Unrestricted Direct Memory Access
x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Fetch instructions

Page table hardware

UEFI

macOS

x86 RAMmacOS kernel
NIC kernel extension

Network Interface
Card (NIC)
Network packet

Kernel heap
Packet bufferUnrestricted Direct Memory Access
x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Fetch instructions

Page table hardware

UEFI

macOS

x86 RAMmacOS kernel
NIC kernel extension

Network Interface
Card (NIC)
Network packet

Kernel heap
Packet bufferUnrestricted Direct Memory Access
x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Fetch instructions

Page table hardware

UEFI

macOS

x86 RAMmacOS kernel
NIC kernel extension

Network Interface
Card (NIC)

Kernel heap
Network
Packet buffer
packetUnrestricted Direct Memory Access
x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Fetch instructions

Page table hardware

UEFI

macOS

x86 RAMmacOS kernel
NIC kernel extension

Network Interface
Card (NIC)! Network packet

Kernel heap
Packet bufferUnrestricted Direct Memory Access
x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Fetch instructions

Page table hardware

UEFI

macOS

x86 RAMmacOS kernel
NIC kernel extension

Network Interface
Card (NIC)! Network packet

Kernel heap
Packet bufferUnrestricted Direct Memory Access
x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Fetch instructions

Page table hardware

UEFI

macOS

x86 RAM

Network
packetkernel!macOS
NIC kernel extension

Network Interface
Card (NIC)

Kernel heap
Packet bufferVT-dIntel Virtualization Technology for Directed I/O (VT-d) is a mechanism by which
the host can place restrictions on DMA from peripherals
VT-d creates an I/O Memory Management Unit (IOMMU) to manage DMA
We’ve used VT-d to protect the kernel since OS X Mountain Lion in 2012

Direct Memory Access with VT-d
x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Fetch instructions

Page table hardware

UEFI

macOS

x86 RAMmacOS kernel
NIC kernel extension
Kernel heap

Network Interface
Card (NIC)! Network packet

VT-d IOMMU hardware
Page table hardware

Packet bufferDirect Memory Access with VT-d
x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Fetch instructions

Page table hardware

UEFI

macOS

x86 RAMmacOS kernel
NIC kernel extension
Kernel heap

Network Interface
Card (NIC)

VT-d IOMMU hardware! Network packet

Consult page tables

Page table hardware

Packet bufferDirect Memory Access with VT-d
x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Fetch instructions

Page table hardware

UEFI

macOS

x86 RAMmacOS kernel
NIC kernel extension
Kernel heap

Network Interface
Card (NIC)

VT-d IOMMU hardware! Network packet

Consult page tables

Page table hardware

Packet buffer
VT-d page tables:“Packet buffer R/W,
everything else
unmapped”

Direct Memory Access with VT-d
x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Fetch instructions

Page table hardware

UEFI

macOS

x86 RAMmacOS kernel
NIC kernel extension
Kernel heap

Network Interface
Card (NIC)

VT-d IOMMU hardware! Network packet

Consult page tables

Page table hardware

Packet buffer
VT-d page tables:“Packet buffer R/W,
everything else
unmapped”

DMA Protection for Thunderbolt

x86
T2

UEFI firmwaremacOS
kernelDMA Protection for Thunderbolt
Thunderbolt
malicious DMA

x86
T2

UEFI firmwaremacOS
kernelDMA Protection for Thunderbolt
Thunderbolt
malicious DMA

x86
T2

macOS
kernelUEFI firmware

VT-d
setup

DMA Protection for Thunderbolt
Thunderbolt
malicious DMA

x86
T2

macOS
kernelUEFI firmware

VT-d
setup

DMA Protection for Thunderbolt
Thunderbolt
malicious DMA

x86
T2

macOS
kernelUEFI firmware

VT-d
setup

DMA Protection for Thunderbolt
Thunderbolt
malicious DMA

x86
T2

macOS
kernelUEFI firmware

VT-d
setup

DMA Protection for Thunderbolt
Thunderbolt
malicious DMA

x86
T2

macOS
kernelUEFI firmware

VT-d
setup

DMA Protection for Thunderbolt
Thunderbolt
malicious DMA

x86
T2

macOS
kernelUEFI firmware

VT-d
setup

DMA Protection for PCIeThunderbolt
malicious DMA

x86
T2

macOS
kernelUEFI firmware

VT-d
setup

DMA Protection for PCIe
PCIemalicious DMA

Thunderbolt
malicious DMA

x86
T2

macOS
kernelUEFI firmware

VT-d
setup

DMA Protection for PCIe
PCIemalicious DMA

Thunderbolt
malicious DMA

x86
T2

UEFI firmware

VT-d
setup

macOS
kernelDMA Protection for PCIe
PCIemalicious DMA

Thunderbolt
malicious DMA

x86
T2

UEFI firmware

VT-d
setup

macOS
kernelDMA Protection for PCIe Bus 0
PCIemalicious DMA

Thunderbolt
malicious DMA

x86
T2

UEFI firmware

VT-d
setup

macOS
kernelDMA Protection for PCIe Bus 0
PCIemalicious DMA

Thunderbolt
malicious DMA

x86
T2

Pre-RAM firmware

Post-RAM firmware

VT-d
setup

macOS
kernelDMA Protection for PCIe Bus 0
PCIe Bus 0
malicious DMA

PCIe
malicious DMA

Thunderbolt
malicious DMA

x86
T2

Pre-RAM firmware

Post-RAM firmware

VT-d
setup

macOS
kernelUEFI

x86 CPU32 bit protected mode

MMU hardware
Pass-through

macOS

T2

Page table hardware

Cache

Fetch instructions

Verified, read-only
UEFI firmware

Stack

VT-d IOMMU hardware
Page table hardware

RAMx86
not initializedRAMPre-RAM

x86 CPU32 bit protected mode

MMU hardware
Pass-through

UEFI

macOS

T2

Page table hardware

Cache

Fetch instructions

Verified, read-only
UEFI firmware

Stack

VT-d IOMMU hardware
Page table hardware

RAMx86
not initializedRAMPre-RAM

x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Page table hardware

UEFI

macOS

T2

Verified,
Verifiedread-only
UEFI firmware

RAMx86
not initializedRAM

Fetch instructions

VT-d IOMMU hardware
Page table hardware

Pre-RAM

x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Page table hardware

UEFI

macOS

T2

Verified, read-only
UEFI firmware

RAMx86
not initializedRAM

Fetch instructions

Verified,read-only
Verified
UEFI firmware

VT-d IOMMU hardware
Page table hardware

Pre-RAM

x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Page table hardware

Page table hardware! Malicious data

Verified, read-only
UEFI firmware

Verified
UEFI firmware
VT-d IOMMU hardware

macOS

T2

x86 RAM

Fetch instructions

PCIe Bus 0 device

UEFIPre-RAM

x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Page table hardware

Page table hardware! Malicious data

Verified, read-only
UEFI firmware

Verified
UEFI firmware
VT-d IOMMU hardware

macOS

T2

x86 RAM

Fetch instructions

PCIe Bus 0 device

UEFIPre-RAM

x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Page table hardware

macOS

T2

Verified, read-only
UEFI firmware

x86 RAM

Fetch instructions

PCIe Bus 0 device

UEFI

Verified
UEFI firmware!
VT-d IOMMU hardware
Page table hardware

Malicious data

// This array contains the root and interrupt remapping tables. Each table is// 4kB, and must be 4kB aligned as well. We can only guarantee the alignment by// manually mapping our 2 4kB tables into this 12kB array. By initializing the// array to all zeros, every bus is marked as not present, and no interrupts// are allowed.
STATIC UINT8 mTables[TABLE_SIZE * 3] = {0};STATICEFI_STATUS
EFIAPI
VTdBlockDMAForUnit(UINTN VTdBar){
EFI_STATUS Status;
VTD_ECAP_REG ExtCapabilities;
UINT64 RootTable;
UINT64 InterruptTable;
CHECKED_VTD_CALL(CheckCapabilities(VTdBar));// ExtCap needed for IOTLB register offset

// This array contains the root and interrupt remapping tables. Each table is// 4kB, and must be 4kB aligned as well. We can only guarantee the alignment by// manually mapping our 2 4kB tables into this 12kB array. By initializing the// array to all zeros, every bus is marked as not present, and no interrupts// are allowed.
STATIC UINT8 mTables[TABLE_SIZE * 3] = {0};STATICEFI_STATUS
EFIAPI
VTdBlockDMAForUnit(UINTN VTdBar){
EFI_STATUS Status;
VTD_ECAP_REG ExtCapabilities;
UINT64 RootTable;
UINT64 InterruptTable;
CHECKED_VTD_CALL(CheckCapabilities(VTdBar));// ExtCap needed for IOTLB register offset

UINT64 InterruptTable;
CHECKED_VTD_CALL(CheckCapabilities(VTdBar));// ExtCap needed for IOTLB register offset
ExtCapabilities.Uint64 = MmioRead64(VTdBar + R_ECAP_REG);
RootTable = (UINT64)mTables;
Use mTable
as RootTable// Align the root table to a 4kB boundary within the table buffer.
RootTable = (RootTable + TABLE_SIZE - 1) & ~(TABLE_SIZE - 1);// Set deny-all root table
SetRootTable(VTdBar, RootTable);// Put the interrupt remapping table right after the root table
InterruptTable = RootTable + TABLE_SIZE;// Set deny-all interrupt table
SetInterruptRemapTable(VTdBar, InterruptTable);RootTable = (UINT64)mTables;// Align the root table to a 4kB boundary within the table buffer.
RootTable = (RootTable + TABLE_SIZE - 1) & ~(TABLE_SIZE - 1);// Set deny-all root table
SetRootTable(VTdBar, RootTable);
Use RootTable
for DMA VT-d// Put the interrupt remapping table right after the root table
InterruptTable = RootTable + TABLE_SIZE;// Set deny-all interrupt table
SetInterruptRemapTable(VTdBar, InterruptTable);// Set deny-all root table
SetRootTable(VTdBar, RootTable);// Put the interrupt remapping table right after the root table
InterruptTable = RootTable + TABLE_SIZE;// Set deny-all interrupt table
SetInterruptRemapTable(VTdBar, InterruptTable);
Same for MSI VT-dinterrupts

Pre-RAM

x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Page table hardware

UEFI

T2

Verified,
Verifiedread-only
UEFI firmware

x86 RAM

Fetch instructions

VT-d IOMMU hardware
Page table hardware

macOSPre-RAM

x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Page table hardware

UEFI

T2

Verified,
Verifiedread-only
UEFI firmware

Bus0 VT-d page tables“deny all”
x86 RAM

Fetch instructions

VT-d IOMMU hardware
Page table hardware

macOSPre-RAM

x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Page table hardware

UEFI

T2

Verified, read-only
UEFI firmware

Bus0 VT-d page tables“deny all”
x86 RAM

Fetch instructions

macOS

Verified,read-only
Verified
UEFI firmware
VT-d IOMMU hardware
Page table hardware

Pre-RAM

x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Page table hardware

Page table hardware! Malicious data

Verified, read-only
UEFI firmware

Bus0 VT-d page tables“deny all”

Verified
UEFI firmware
VT-d IOMMU hardware

macOS

T2

x86 RAM

Fetch instructions

PCIe Bus 0 device

UEFIPre-RAM

x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Page table hardware

Page table hardware! Malicious data

Verified, read-only
UEFI firmware

Bus0 VT-d page tables“deny all”

Verified
UEFI firmware
VT-d IOMMU hardware

Consult page tables

macOS

T2

x86 RAM

Fetch instructions

PCIe Bus 0 device

UEFIPre-RAM

x86 CPU64 bit protected mode

MMU hardware
Virtual memory enabled
Page table hardware

Page table hardware! Malicious data

Verified, read-only
UEFI firmware

Bus0 VT-d page tables“deny all”

Verified
UEFI firmware
VT-d IOMMU hardware

Consult page tables

macOS

T2

x86 RAM

Fetch instructions

PCIe Bus 0 device

UEFI

DMA Protection for PCIe Bus 0
PCIe Bus 0
malicious DMA

PCIe
malicious DMA

Thunderbolt
malicious DMA

x86
T2

Pre-RAM firmware

Post-RAM firmware

VT-d
setup

macOS
kernelDMA Protection for PCIe Bus 0
PCIe Bus 0
malicious DMA

PCIe
malicious DMA

Thunderbolt
malicious DMA

x86
T2

Pre-RAM firmware

VT-d
setup

Post-RAM firmwaremacOS
kernelDMA Protection for PCIe Bus 0
PCIe Bus 0
malicious DMA

PCIe
malicious DMA

Thunderbolt
malicious DMA

x86
T2

Pre-RAM firmware

VT-d
setup

Post-RAM firmwaremacOS
kernelPCIe Option ROMs

PCIe Option ROMs
Device drivers which PCIe devices supply to UEFI
UEFI firmware, including OROMs, mostly all run at the same x86
privilege level: Ring 0
All code loaded after OROMs, including the booter and kernel, isvulnerable to overwrite

Virtual Memory SpaceOROM 3
OROM 2

Ring 0(More privileged)

OROM 1Other UEFI drivers (storage, network, etc)
Core UEFI firmware

Hardwarex86 CPU(More privileged)
PCIe card 1

PCIe card 2

PCIe card 3

Virtual Memory SpaceOROM 3
OROM 2

Ring 0(More privileged)

OROM 1Other UEFI drivers (storage, network, etc)
Core UEFI firmware

Hardwarex86 CPU(More privileged)
PCIe card 1

PCIe card 2

PCIe card 3

Virtual Memory SpaceOROM 3
OROM 2

Ring 0(More privileged)

OROM 1Other UEFI drivers (storage, network, etc)
Core UEFI firmware

Hardwarex86 CPU(More privileged)
PCIe card 1

PCIe card 2

PCIe card 3

Virtual Memory SpaceOROM 3

Ring 3(Less privileged)

OROM 2OROM 1Other UEFI drivers (storage, network, etc)

Ring 0(More privileged)Core UEFI firmware

Hardwarex86 CPU(More privileged)
PCIe card 1

PCIe card 2

PCIe card 3

Virtual Memory SpaceOROM 3

Ring 3(Less privileged)

OROM 2OROM 1Other UEFI drivers (storage, network, etc)

Ring 0(More privileged)Core UEFI firmware

Hardwarex86 CPU(More privileged)
PCIe card 1

PCIe card 2

PCIe card 3

Ring 3

OROM 1OROM 2OROM 3(Less privileged)

Ring 0

Other UEFI drivers (storage, network, etc)

(More privileged)Core UEFI firmware

Hardwarex86 CPU(More privileged)
PCIe card 1

PCIe card 2

PCIe card 3

Ring 3

Virtual Memory Space 1

Virtual Memory Space 2

Virtual Memory Space 3

OROM 1OROM 2OROM 3(Less privileged)

Ring 0Non-sandboxed
UEFI drivers
Other UEFI
drivers (storage,
network, etc)

(More privileged)Core UEFI firmware

Hardwarex86 CPU(More privileged)
PCIe card 1

PCIe card 2

PCIe card 3

Ring 3

Virtual Memory Space 1

Virtual Memory Space 2

Virtual Memory Space 3

OROM 1OROM 2OROM 3(Less privileged)

OROM sandbox driver

Ring 0Non-sandboxed
UEFI drivers
Other UEFI
drivers (storage,
network, etc)

(More privileged)Core UEFI firmware

Hardwarex86 CPU(More privileged)
PCIe card 1

PCIe card 2

PCIe card 3

Ring 3

Virtual Memory Space 1

Virtual Memory Space 2

Virtual Memory Space 3

OROM 1OROM 2OROM 3(Less privileged)

OROM sandbox driver

Ring 0Non-sandboxed
UEFI drivers
Other UEFI
drivers (storage,
network, etc)

(More privileged)Core UEFI firmware

Hardwarex86 CPU(More privileged)
PCIe card 1

PCIe card 2

PCIe card 3

OROM Sandbox
OROMs can only call a limited subset of expected UEFI interfaces• Similar to system call filtering

OROMs can only install a limited subset of expected UEFI interfaces• E.g. read and write to disk blocks, or draw to graphics

Ring 3

Virtual Memory Space 1

Virtual Memory Space 2

Virtual Memory Space 3

OROM 1OROM 2OROM 3(Less privileged)

OROM sandbox driver

Ring 0Non-sandboxed UEFI drivers(More privileged)Core UEFI firmware

Hardwarex86 CPU(More privileged)
PCIe card 1

PCIe card 2

PCIe card 3

Ring 3

Virtual Memory Space 1

Virtual Memory Space 2

Virtual Memory Space 3

OROM 1OROM 2OROM 3
Call “Write NVRAM”
interface(Less privileged)

OROM sandbox driver

Ring 0Non-sandboxed UEFI drivers(More privileged)Core UEFI firmware

Hardwarex86 CPU(More privileged)
PCIe card 1

PCIe card 2

PCIe card 3

Ring 3

Virtual Memory Space 1

Virtual Memory Space 2

Virtual Memory Space 3

OROM 1OROM 2OROM 3(Less privileged)

OROM sandbox driver

Ring 0Non-sandboxed UEFI drivers(More privileged)Core UEFI firmware

Hardwarex86 CPU(More privileged)
PCIe card 1

PCIe card 2

PCIe card 3

Ring 3

(Less privileged)

Virtual Memory Space 1

Virtual Memory Space 2

Virtual Memory Space 3

OROM 1OROM 2OROM 3“I’m a storage
driver (for Card 1)”“I’m a network
driver (for Card 2)”“I’m a SecureBoot
driver”

OROM sandbox driver

Ring 0Non-sandboxed UEFI drivers(More privileged)Core UEFI firmware

Hardwarex86 CPU(More privileged)
PCIe card 1

PCIe card 2

PCIe card 3

OROM Sandbox
OROM can only talk to the assigned device in its sandbox• This is the device it was embedded on

The VT-d policy allows a device to DMA to any memory allocated within its
OROM’s sandbox• Preserve high-throughput DMA but with strong VT-d protection• OROM doesn’t even have to be VT-d aware!

EFI Exploit Mitigations
OROM Sandbox will drive attackers to privilege escalation and sandbox escapes
We added a strong set of exploit mitigations to EFI on T2 systems• Stack Cookies• All EFI memory W^X with read-only page tables• SMAP: Ring 0 can’t directly read/write Ring 3 data
• SMEP: Ring 0 can’t execute Ring 3 code
• Some Spectre/Meltdown mitigations

Mac Secure Boot
Summary
The T2 Security Chip brings key secure boot properties from iOS to the Mac, faroutclassing UEFI SecureBoot-based systems
Our DMA protection for PCIe Bus 0 provides state-of-the-art protection against
DMA attacks targeting firmware
The Mac OROM Sandbox provides unprecedented defense against malicious
PCIe Option ROMs compromising the secure boot process

Mac secure bootiOS code integrity protection
Find MySoftware Enforced Code Integrity
Before iOS 9

Kernelcache signature verified by iBoot at load time
Userland __TEXT pages code signed• CodeDirectory checked at load time (or static)• Pages checked at fault timeCompromised kernel could change its own __TEXT
Compromised kernel could disable codesigning altogether,or alter userland pages

Kernel Integrity Protection
Goal• Maintain integrity of kernel code and read-only data after secure bootThreat model• Kernel arbitrary read/write• Arbitrary kernel instruction pointer control• Arbitrary read/write by DMA agents and system coprocessors

Out of scope• Secure boot bypass

Kernel Integrity Protection v0
iOS 9

At system initialization, EL3 monitor creates array of kernel page table and text
hashes in TZ1Monitor periodically verifies hashes, panics on mismatch
Effective against long-lived patches, inherently vulnerable to racesKernel Integrity Protection v0
Monitor code
Page hashes

CPU

Address,TZ1(TZ1 can only be set byAccesses from EL3)

Data
EL3, EL1, EL0

Memorycontroller
TZ1 base
TZ1 end

Kernel code
Kernel data
Kernel code
Kernel data
Kernel code
DRAM

TZ1

Access requires
TZ1 bitBootstrap KIP

Attempt FP

Disable FPU

Return to
EL1/EL0

Bootstrap XNU
Save system
registers

Trap to KIP

Hash all regions

Disable FPU
Trap to EL3

Trap to XNU

IRQ

Trap to EL3

Return to
EL1/EL0

Route IRQs
to EL3Check hashes
Reenable FPU

Lessons Learned
Must protect critical data in addition to code
• Page tables• Global offset table entries• Sandbox configuration

Integrity verification after boot is vulnerable to race conditions
Easier to adapt hardware architecture to fit security requirements

Kernel Integrity Protection v1
iPhone 7

New hardware design tailored to our goals
Our threat model had three hardware requirements• CPU prevents modification of kernel memory• CPU also prevents EL1 execution of non-kernel memory• Memory controller prevents DMA writes to protected physical range

Kernel Integrity Protection v1
Kernel andkext code

VA

MMU
Kernel baseKernel end

CPU

PA,
XN,
RO

Memorycontroller

ROR base

X, RO

Init code
Kernel pagetablesROR end

XN, ROXN, RW

DRAM

Read Only
Region(ROR)Kernel Integrity Protection v1: Read-Only Data
We have a strong design for code, but protecting data requires additionalfinesseNeither KIP v0 nor KIP v1 prevent modification of TTBR1, which tells CPU whereto find the kernel’s page tables
By using a very careful initialization sequence, we make sure no instructions areavailable to modify TTBR1 after CPU finishes initializing

Kernel Integrity Protection v1
Required significant rework of kernelcache layout
Build time checks that no TTBR1 write gadget exists
Very effective at protecting kernel code integrity
Only public bypass was off-by-one error in our protection range calculation

Kernel Integrity Protection v2
iPhone Xs

Applied lessons learned from KIP v1
Control bits prevent changes to TTBR1, MMU enable, and exception vector
addresses• Guarantees in hardware that MMU configuration cannot be modified• Replaces init-only instructions from KIP v1

Configuration is retained when CPU goes into idle power-off• Less complexity in power management transitions

Kernel Integrity Protection
Summary

Robust enforcement of kernel code and read-only data integrity
Hardware implementation tailored to software security requirements
Essential foundation for next-generation security features

Fast Permission Restrictions (APRR)
iPhone X

Builds upon software-only Hardened WebKit JIT Mapping in iOS 10
CPU register to quickly restrict permissions on RWX memory, per thread
Removes overhead of a syscall and walking page tables to change permissions

Pre-APRR VM Permissions

Process code

Heap

Framework code

JIT memory

R-X

RW-

R-X

RWX

APRR: JavaScriptCore Execution Threads

Process code

Heap

Framework code

JIT memory

R-X

RW-

R-X

RWX
APRR = ~W
Effective = R-XAPRR: JavaScriptCore JIT Compiler Thread

Process code

Heap

Framework code

JIT memory

R-X

RW-

R-X

RWX
APRR = ~X
Effective = RW-What about userland?

Protecting Userland Integrity
KIP gives us strong integrity protection for kernel text
Page table overrides with KIP rely on kernel code being static
Userland code is dynamically loaded, so we would need dynamic overrides

Page Protection Layer (PPL)
iPhone Xs

Ensures userland code can’t be modified after code signature checks complete
Built upon KIP and APRRManages page tables, code signing validation
Small TCB
Guarantees only code inside PPL can alter protected pages

Default

Kernel heap

Kernel code

RW-

R-X

RW-

R-X

Page
tables

R-X

R-X

RW-

RW-

~X

~X

~W

~W

R--

R--

R--

R--

Trampolines

R-X

APRR
Effective

PPL code

PPL
heap

R-X

Default

Trampolines

PPL code

PPL
heap

Page
tables

Kernel heap

Kernel code

RW-

R-X

R-X

R-X

R-X

RW-

RW-

RW-

R-X

R-X

R-X

R-X

RW-

RW-

APRR
Effective

Page Protection Layer
Summary

System-wide dynamic code integrity enforcement• Even with a compromised kernel!

Massive attack surface reduction
Low overhead• No hypervisor traps• No nested page tables

With code integrity protected, how do
we protect control flow?

Pointer Authentication
New instructions in ARMv8.3
Uses spare bits in pointers to store a cryptographic hash
Designed to be robust in the presence of arbitrary read/write primitives

Pointer Authentication
Instructions

pacKK

Xd, XnExtra data

IA keyIB keyDA keyDB keyPointerKey

Encrypt

Signed PointerXd

Pointer Authentication
Sign

0000000100a41238
PointerPointer Authentication
Sign

0000000100a41238
Padding

Address

Pointer Authentication
Sign

7b9352e100a41238
Signature

Address

Pointer Authentication
Authenticate

7b9352e100a41238
Signature

Address

Pointer Authentication
Authenticate

0000000100a41238
Padding

Address

Pointer Authentication
Auth failure

7b9352f100a41238
Signature

Address

Pointer Authentication
Auth failure

2000000100a41238
Padding

Address

Pointer AuthenticationKeys

5 secret 128-bit values• IA, IB, DA, DB, and GA keys

• I keys for instructions, D keys for data
• GA key for data MAC

Randomly generated• At boot (A keys)• At process creation (B keys)

Can’t be read by attacker

Pointer Authentication
Pointers to code

1010
1110
1001

+

Function Return Address

I

B

Storage Address

Function Pointers

I

A

0

Block Invocation Function

I

A

Storage Address

Objective-C Method Cache

I

B

Storage Address + Class + Selector

C++ V-Table Entries

I

A

Storage Address + Hash(mangled method name)Computed Goto LabelI

A

Hash(function name)Pointer Authentication

Function return address before PAC_func:
stp x29, x30, [sp, #-16]!
...
ldp x29, x30, [sp], #16
retPointer Authentication

Function return address after PAC_func:
pacibsp
stp x29, x30, [sp, #-16]!
...
ldp x29, x30, [sp], #16
retab

1010
1110
1001

IB

Code
Process+

Storage
Address

Pointer Authentication

Pointers to data, code via data
1010
1110
1001

+

Kernel Thread State

G

A

*

User Thread State Registers

I

A

Storage Address

C++ V-Table Pointers

D

A

0

Pointer Authentication
Improvements in iOS 13

Abort on all authentication failuresin kernel
Adoption across all Apple kexts
Hardened jump tables

Pointer Authentication
Improvements in iOS 13

ObjC method dispatch hardening• Sign and authenticate IMP pointers inmethod cache tables

Hardened exception handling• Hash and verify sensitive register state

JavaScriptCore JIT and extra data
hardening

Pointer Authentication
Coming soon

Authenticated members of high value
data structures• Processes, tasks• Codesigning• Virtual Memory subsystem• IPC structures

Mac secure bootiOS code integrity protection
Find MyHelping users find lost devices, even when offline
Any device in proximity can help, even if stranger to the owner
Offline device communicates via Bluetooth with participating strangers (finders)
Finders report their location and a timestamp
Owner uses a second device to find the lost device

Challenges
A static device identifier makes the device trackable
Even with a rotated identifier, finder can’t encrypt location end-to-end• Server would have access to the location information

Security and Privacy Goals

Protect owners, finders, and devices• Location reports are not accessible to Apple servers– Cannot read, modify, or even add bogus reports• Finder identities and location not revealed to Apple servers– No finder identifier recorded– Reported location is encrypted• Information broadcasted by the lost device cannot be used to track it, except by theownerFind My
Setup

Encrypted {d, P, SK0}in iCloud Keychain

Generate EC P-224 key pair {d, P = d # G}
Generate symmetric key SK0Store {d, P, SK0} in iCloud Keychain

Find My

Device broadcasting its location
A Find My time period, i, is 15 minutes long
Derive symmetric key SKi• SKi = KDF(SKi-1, “update”)

Derive anti-tracking secret pair (ui, vi)• (ui, vi) = KDF(SKi, “diversify”)

Unlinkably diversify public key P• Pi = ui # P + vi # G

Broadcast Pi to nearby finders

Find My

Reporting location of a broadcasting device
Finder ECIES-encrypts its location to public key Pi
Computes lookup indexi = SHA256(Pi)Uploads encrypted report with indexi to Apple servers

Find My

Owner locating their device

Query DB for location reports at indexi
DB responds with [rec0, rec1, …]

Retrieve di from iCloud Keychain

Compute Pi = di # G for lookup period i
Compute lookup indexi = Hash(Pi)ECIES decrypt (posi,0, timei,0) = D(di, rec0)

Find My

Summary
Novel design to enable users to enlist the help of strangers to locate lost devices
Highly rigorous privacy properties to protect participating device owners andfinders

Mac secure bootiOS code integrity protection
Find MyMac secure bootiOS code integrity protection
Find MyApple Security Bounty

Introduced in 2016

Platforms

iOS, iCloud

Categories

5

Participation

Very small invitedresearcher audience

Maximum payout$200,000

50 High-Value Reports

What’s next?

Apple Security Bounty will be open to
all researchers

Revised and expanded categories

Maximum Payout
Unauthorized access to iCloud account data on
Apple servers

Attack via physical access

Attack via user-installed app

Network attack requiring user interaction

Network attack with no user interaction$100,000
Lock screen bypass$100,000

User data extraction$250,000

Unauthorized access to high-value user data

$100,000

Kernel code execution$150,000

CPU side channel attack on high-value user data

$250,000

One-click unauthorized access to high-value user data

$150,000

One-click kernel code execution$250,000

Zero-click radio to kernel with physical proximity$250,000

Zero-click access to high-value user data

$500,000Vulnerabilities in designated prerelease builds

50%
bonus

What about getting started?

Making It Easier to Get Started with iOS Research
We want to attract exceptional researchers who have been focused on otherplatforms
New researchers shouldn’t have to find a full chain to bootstrap research
Existing iOS researchers shouldn’t have to hold back chains for research

iOS Security Research Device ProgramiOS Security Research Device program
Unprecedented, Apple-supported iOS security research platform
Comes with ssh, a root shell, and advanced debug capabilities
New research fusing, neither production nor development

iOS Security Research Device program
Unprecedented, Apple-supported iOS security research platform
Comes with ssh, a root shell, and advanced debug capabilities
New research fusing, neither production nor development
Program applications open to everyone with a track record of high-quality
systems security research on any platform

iOS Security Research Device program
Unprecedented, Apple-supported iOS security research platform
Comes with ssh, a root shell, and advanced debug capabilities
New research fusing, neither production nor development
Program applications open to everyone with a track record of high-quality
systems security research on any platform
Coming next year

Apple Security Bounty
Summary
Participation open to all researchers in the Fall
Expanded and revised categories
Highest maximum payouts in the industry
iOS Security Research Device Program for exceptional researchers new to ourplatform

What about a zero-click iOS full chain
with kernel code execution andpersistence?

!!!!
!!!!
!!!!
!!!!
!!!!
!!!!
!!!!
!!!

!
$1,000,000!
!
!

Maximum Payout
Unauthorized access to iCloud account data on
Apple servers
Attack via physical access

Attack via user-installed app

Network attack requiring user interaction

Network attack with no user interaction$100,000
Lock screen bypass$100,000

User data extraction$250,000

Unauthorized access to high-value user data

$100,000

CPU side channel attack on high-value user data

$250,000

One-click unauthorized access to high-value user data

$150,000

One-click kernel code execution$250,000

Zero-click radio to kernel with physical proximity$250,000

Zero-click access to high-value user data

$500,000

Zero-click kernel code execution with persistence$1,000,000

Kernel code execution$150,000

We’re excited to work with you!

TM and © 2019 Apple Inc. All rights reserved.