Panel: iOS / OS X Security

Panel: iOS / OS X Security

Speakers: Tarjei Mandt (Trenchant); Nikias Bassen (Zimperium); David Wang (Quantum Metric); Joshua Hill (Pseudosecurity Labs); Dhillon Kannabhiran (Hack In The Box)

Conference: HITB Amsterdam

YouTube: https://www.youtube.com/watch?v=tnV3q78CyBQ

Overview

This panel discussion, featuring a reunion of prominent figures from the iOS jailbreaking community, delved into the evolving landscape of iOS and macOS security. Moderated by Dhillon Kannabhiran of Hack In The Box, the discussion brought together Tarjei Mandt, Nikias Bassen, David Wang, and Joshua Hill – collectively known for their groundbreaking work on early iOS jailbreaks like Evasion, GreenPois0n, and Absinthe. The talk provided a retrospective on the "golden age" of jailbreaking, contrasting it with the significantly more challenging environment faced by security researchers today, while also exploring future implications of regulatory changes and advanced exploitation techniques.

The panel explored critical questions surrounding the relevance of jailbreaking in a world where Apple has integrated many community-requested features, the escalating difficulty of bypassing Apple's robust security mitigations, and the trade-offs between security and user control. They discussed the technical advancements that have transformed exploit development from single-bug exploits to complex chains, and the broader implications for end-user security, government surveillance, and the future of independent security research on Apple platforms. The collective experience of the panelists offered a unique and authoritative perspective on the past, present, and future trajectory of iOS security.

The discussion is particularly relevant given the increasing sophistication of mobile threats, including nation-state-sponsored spyware utilizing zero-click exploits. Understanding the historical context of iOS security, the cat-and-mouse game between Apple and researchers, and the current state of exploit development is crucial for both defenders and those interested in the fundamental principles of device security and user autonomy. The insights shared highlight the continuous innovation required to secure modern mobile ecosystems against persistent and advanced adversaries.

Background

▶ Watch: Panelist introductions and jailbreak history (0:00)

The journey of iOS security, as recounted by the panelists, began in an era vastly different from today. In the early days of the iPhone OS (later iOS) around versions 1.1.2, achieving root access often required exploiting just a single vulnerability. David Wang (Planetbeing) recalled a TIFF graphics processing library bug in Safari that, due to Safari running as root, granted complete system access. This simplicity fostered a vibrant jailbreaking community, driven by a desire for greater device functionality and control that Apple initially did not provide.

Over time, Apple's commitment to security dramatically increased, leading to a relentless cycle of mitigation development. The panel noted that today, a successful jailbreak typically requires chaining together at least five separate vulnerabilities. These exploit chains often involve bypassing multiple layers of defense, including mandatory code signing, Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP), and later, more sophisticated hardware-backed security features like the Secure Enclave Processor (SEP), which Tarjei Mandt and David Wang were among the first to publicly research.

The motivation for jailbreaking also evolved. Initially, it was driven by the need for basic features like quick replies to iMessages, customizability, and even carrier unlocking (as Nikias Bassen mentioned for his first device). However, as Apple progressively integrated many popular jailbreak tweaks and functionalities directly into iOS, the appeal for the average user diminished. David Wang, referencing his work on Messages Plus, highlighted how features once exclusive to jailbroken devices are now standard. This shift transformed jailbreaking from a mass-market phenomenon to a pursuit primarily driven by technical challenge, a desire for ultimate device control, or specific research and forensic needs. The panel emphasized that while Apple's security has indeed improved, the continuous discovery of new bugs, even in the latest iOS versions, underscores the inherent fallibility of complex software and the ongoing "cat-and-mouse" game between developers and security researchers.

Key Findings

▶ Watch: How to detect zero-click exploits on iOS (13:50)

The panel discussion brought forth several key findings regarding the current state and future trajectory of iOS security:

1. Escalating Difficulty of Jailbreaking: Jailbreaking has become significantly harder and less prevalent. What once required a single vulnerability now demands chaining multiple exploits (at least five, according to David Wang) to overcome Apple's layered mitigations. This increased complexity translates to slower development cycles, with usable jailbreaks for new iOS versions sometimes taking a year or more to emerge, forcing users to remain on older, potentially less secure software.
2. Reduced User Visibility: Apple's security enhancements, while making devices more robust, have inadvertently reduced user visibility into potential compromises. Simple actions like listing installed processes or apps from the device itself are no longer possible via accessible APIs. This lack of introspection makes it extremely challenging for an average user to detect sophisticated attacks, especially zero-click exploits that operate silently in the background, like the iMessage exploit discussed (likely referring to the Project Zero findings).
3. App Side-Loading Implications: The upcoming EU regulations mandating app side-loading on iOS devices are anticipated to have a limited net impact on mass security. While jailbreakers historically advocated for more user control, the panelists believe Apple will implement side-loading with strict controls, likely involving a notarization process and requiring explicit user enablement with prominent security warnings. This approach, similar to macOS, would restrict the alteration of entitlements and ensure that most users do not enable it, thus containing the potential attack surface.
4. Persistent Threat of Advanced Exploits: Despite Apple's strong security, sophisticated vulnerabilities continue to be discovered and exploited in the wild, often by nation-state actors. The panel acknowledged that "everything has bugs" and that the game between attackers and defenders is far from over. The existence of a thriving market for Enterprise signing certificates (even purchasable on platforms like AliExpress, as Dhillon Kannabhiran noted) further illustrates how determined adversaries can circumvent some of Apple's intended controls.
5. Impact on Security Research: Apple's continuous hardening of iOS makes public security research more challenging. While this might increase the barrier to entry for new researchers, it also inadvertently gives an advantage to private companies and nation-states who can dedicate significant resources to discovering and weaponizing vulnerabilities without public disclosure. This creates an asymmetry of information that could hinder broader defensive efforts.

Technical Deep Dive

▶ Watch: Impact of EU-mandated iOS app sideloading (18:10)

The panel discussion provided a rich technical retrospective and current assessment of iOS security, highlighting the escalating complexity of exploitation and Apple's robust mitigation strategies.

In the early days of iOS, gaining control was relatively straightforward. David Wang recalled exploiting a TIFF graphics processing library bug in Safari on iPhone OS 1.1.2. Crucially, Safari ran as root at the time, meaning a single successful exploit granted complete control over the device. This era also saw the development of foundational tools and concepts, such as Nikias Bassen's maintenance of the libimobiledevice open-source framework, which enabled communication with iOS devices from non-Apple operating systems.

The evolution of iOS security has been characterized by Apple's introduction of numerous mitigations designed to prevent and detect exploits. Panelists explained that where one bug once sufficed, modern iOS exploitation typically requires chaining together at least five vulnerabilities. These chains often involve:

• Kernel vulnerabilities: To achieve arbitrary read/write access or code execution in the kernel.
• Sandbox escapes: To break out of the restrictive environments applications run in.
• Privilege escalations: To gain higher permissions, often culminating in tasks for PID 0 (kernel task port access), which provides powerful control but is now significantly harder to obtain.
• Userland memory remapping restrictions: Early jailbreaks often relied on being able to remap userland memory as read-write-executable (RWX), a capability that has been severely curtailed, forcing tweak authors to adopt more complex techniques.

A significant leap in Apple's hardware-backed security came with the Secure Enclave Processor (SEP). Tarjei Mandt and David Wang were pioneers in publicly researching the SEP, a dedicated secure coprocessor responsible for cryptographic operations and protecting sensitive data like biometric information and device keys. The SEP's isolation from the main application processor makes it extremely difficult to compromise, even if the primary iOS kernel is exploited.

The panel also touched upon the practical challenges of developing and deploying jailbreaks. The fragmentation of the jailbreak ecosystem, with different authors producing incompatible tools, adds to the complexity for both developers and users. Nikias Bassen noted that tweaks often need recompilation or rewriting for each new iOS version and specific jailbreak tool. The discussion also revisited the "gentlemen hackers" era, where teams like the iPhone Dev Team and Evasion (David Wang) and GreenPois0n / Absinthe (Joshua Hill) were careful to avoid copyright infringement, sometimes patching existing Apple binaries or using apps from the App Store as components rather than bundling proprietary Apple code. This contrasts with later practices, such as the use of Enterprise signing certificates obtained from less official sources to side-load jailbreak tools, as described by Dhillon Kannabhiran.

Looking ahead, the discussion on app side-loading, driven by EU regulations, highlighted Apple's likely strategy:

• Notarization process: Similar to macOS, apps might need Apple's approval even if distributed outside the App Store.
• User warnings: Enabling side-loading would likely involve multiple prompts and warnings, deterring most users.
• Entitlement restrictions: Apple would probably restrict the ability to modify app entitlements, which define an app's permissions and access to system resources. This would prevent side-loaded apps from gaining elevated privileges or accessing restricted APIs, thus limiting their potential for malicious activity or deep system modification.

Finally, the panelists acknowledged the persistent threat of advanced exploits, including zero-click attacks. Nikias Bassen cited the iMessage exploit (likely referring to the Project Zero findings by Samuel Groß and Ian Beer), which demonstrated how an attacker could compromise a device by sending specially crafted messages, causing background daemons to crash silently without any user interaction. Detecting such attacks is incredibly difficult for end-users, underscoring the ongoing need for advanced mobile threat detection solutions.

Demo / Proof of Concept

▶ Watch: Panelists' personal motivations for jailbreaking (33:00)

As this event was a panel discussion, there was no live demonstration or proof of concept presented. The format focused on an open dialogue among the experts, sharing their experiences, insights, and perspectives on the historical and current state of iOS security and jailbreaking.

Defensive Implications

▶ Watch: Panelists discuss Apple job offers (36:00)

The panel's insights offer several critical implications for defenders, both for individual users and security professionals:

1. Prioritize Software Updates: Despite the appeal of staying on older iOS versions for jailbreaking, the panelists implicitly highlighted the importance of keeping devices updated. Apple's continuous release of patches for newly discovered vulnerabilities is the primary defense against exploits, including those used in sophisticated attacks. Delaying updates exposes users to known, fixable flaws.
2. User Awareness of Phishing and Zero-Click Threats: While "zero-click" exploits like the discussed iMessage exploit require no user interaction and are nearly impossible to detect for an average user, general awareness of phishing attacks remains crucial. Many successful compromises still begin with social engineering. For zero-click attacks, users should be aware that unusual device behavior (e.g., unexpected reboots, excessive heat, rapid battery drain without heavy use) could be an indicator, though these are often subtle and hard to distinguish from normal bugs.
3. Understand the Security-Visibility Trade-off: Apple's design philosophy prioritizes security over user introspection, meaning users have limited visibility into low-level system activity. While this prevents attackers from leveraging such introspection, it also makes detecting compromise difficult. Defenders should recognize this inherent trade-off and consider enterprise-grade Mobile Threat Defense (MTD) solutions (like Zimperium, where Nikias Bassen works) for environments where advanced, silent threats are a concern.
4. Leverage Apple's Defensive Features: Features like Lockdown Mode, mentioned by Tarjei Mandt, represent Apple's attempt to provide heightened security for users at high risk of targeted attacks. While not suitable for everyday use due to functionality restrictions, it's an important tool for specific threat models.
5. Side-Loading Cautiously (When Available): With the impending introduction of app side-loading due to EU regulations, users must exercise extreme caution. As the panel suggested, Apple will likely implement it with strong warnings and require explicit user enablement. Users should only side-load applications from trusted, verified sources, understanding that this process inherently carries greater risk than relying on the App Store's vetting process, even with Apple's potential notarization requirements.
6. Enterprise Certificate Security: The revelation of a market for Enterprise signing certificates highlights a significant supply chain risk. Organizations using these certificates for internal app distribution must maintain rigorous security controls around their issuance, management, and revocation to prevent their misuse by malicious actors for distributing malware or compromised applications.

Key Takeaways

• Jailbreaking has evolved from a simple root exploit to a complex chain of at least five vulnerabilities, making it significantly harder and less prevalent today.
• Apple's robust security mitigations have improved device security but have also drastically reduced user visibility, making it nearly impossible for an average user to detect sophisticated zero-click exploits.
• The impending app side-loading feature, driven by EU regulations, is unlikely to significantly compromise mass user security due to anticipated strict Apple controls, such as notarization and explicit user opt-in with warnings.
• Sophisticated exploits, including those by nation-state actors, continue to bypass Apple's defenses, demonstrating that despite strong security, "everything has bugs" and the threat landscape is constantly evolving.
• The shift in jailbreaking's primary motivation from gaining features to pursuing technical challenge highlights Apple's success in integrating many community-requested functionalities into iOS.
• Security research is becoming more challenging due to Apple's hardening efforts, potentially creating an information asymmetry that favors well-resourced private entities and governments over public research.

About the Speaker(s)

• Dhillon Kannabhiran: The moderator for the panel, Dhillon is associated with Hack In The Box (HITB), the conference organizer. He facilitated the discussion, introducing the panelists and posing key questions about the state of iOS security.

• Nikias Bassen: Currently the VP of Product Security and leading the iOS research team at Zimperium, a company focused on mobile threat detection for iOS and Android. Nikias was originally involved in iOS jailbreaks for iOS 5 and 6, which were presented at conferences. He is also a long-time maintainer of the open-source framework libimobiledevice, a crucial tool for interacting with iOS devices.

• David Wang (aka Planetbeing): A veteran of the iOS jailbreaking scene, David was a core member of the "iPhone Dev Team" and contributed to "Darwin jailbreaks" and baseband unlocks. He was part of the "dream team" responsible for the Evasion and Evasion7 jailbreaks. Later, he co-founded Corellium, a company that provided iOS virtualization, but left after a high-profile lawsuit from Apple. He is now the Chief Architect at Quantum Metric, though he still maintains a keen interest in security as a hobby.

• Joshua Hill (aka Posix Ninja): Known for his involvement in the GreenPois0n and Absinthe jailbreaks, Joshua was also part of the jailbreak "dream team." He mentioned currently being unemployed and actively seeking new opportunities, indicating his continued engagement in the security field.

• Tarjei Mandt: Tarjei has been involved in iOS security research since iOS 5, presenting at HITB back in 2012. He and David Wang notably conducted some of the first public security research on the Secure Enclave Processor (SEP). He works at Trenchant, which was formerly Azimuth Security (acquired by Alter Harris), focusing heavily on vulnerability research. His motivation stemmed from a Windows background, finding embedded systems and Apple's security innovations (like mandatory code signing) to be a compelling and continuously challenging field.