SoylentNews is people
SoylentNews
The security coprocessor was introduced alongside the iPhone 5s and Touch ID. It performs secure services for the rest of the SOC and prevents the main processor from getting direct access to sensitive data. It runs its own operating system (SEPOS) which includes a kernel, drivers, services, and applications.
The Secure Enclave is responsible for processing fingerprint data from the Touch ID sensor, determining if there is a match against registered fingerprints, and then enabling access or purchases on behalf of the user. Communication between the processor and the Touch ID sensor takes place over a serial peripheral interface bus. The processor forwards the data to the Secure Enclave but can't read it. It's encrypted and authenticated with a session key that is negotiated using the device's shared key that is provisioned for the Touch ID sensor and the Secure Enclave. The session key exchange uses AES key wrapping with both sides providing a random key that establishes the session key and uses AES-CCM transport encryption
Today, xerub announced the decryption key 'is fully grown'. You can use img4lib to decrypt the firmware and xerub's SEP firmware split tool to process.
Decryption of the SEP Firmware will make it easier for hackers and security researchers to comb through the SEP for vulnerabilities.
Source: iClarified
Also at ThreatPost which notes that this does not mean it is open season on SEP:
Yesterday’s news set off another flurry of angst as to the ongoing security of iOS and what would happen now that the firmware had been unlocked.
“I wouldn’t say there is any immediate threat to users at this point,” Azimuth Security’s Mandt said. “Although the key disclosure allows anyone to analyze the software that is running on the SEP processor, it still requires an attacker to find and exploit a vulnerability in order to compromise SEP.”
(Score: 0) by Anonymous Coward on Friday August 18 2017, @09:47PM (2 children)
I guess the hardware could be a problem if they are built to insert subtle errors into general math processing, but I imagine that would lead to tons of errors. I think the hardware level stuff is for more targeted attacks and wouldn't be overly helpful against decentralized and encrypted communications. The only viable solution is to flood the net with encrypted data making surveillance much more difficult. They would only be able to store the data of targeted individuals instead of sifting through everything and storing the interesting bits. To get the interesting bits they would need to decrypt all traffic, and unless they have real-time decryption then the system would quickly collapse.
Law enforcement should target suspected individuals only, dragnets are wrong on just about every level.
(Score: 2) by Arik on Friday August 18 2017, @10:41PM
If laughter is the best medicine, who are the best doctors?
(Score: 0) by Anonymous Coward on Saturday August 19 2017, @09:25PM
you're nowhere near radical enough. please pull your head out of your state apologist ass. thank you, humanity.