Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 17 submissions in the queue.
posted by Fnord666 on Sunday August 02 2020, @06:59PM   Printer-friendly
from the secure-enclave-isn't dept.

New 'unpatchable' exploit allegedly found on Apple's Secure Enclave chip, here's what it could mean - 9to5Mac:

The Secure Enclave is a security coprocessor included with almost every Apple device to provide an extra layer of security. All data stored on iPhone, iPad, Mac, Apple Watch, and other Apple devices is encrypted with random private keys, which are only accessible by the Secure Enclave. These keys are unique to your device and they're never synchronized with iCloud.

[...] It's important to note that although the Secure Enclave chip is built into the device, it works completely separately from the rest of the system. This ensures that apps won't have access to your private keys, since they can only send requests to decrypt specific data such as your fingerprint to unlock an app through the Secure Enclave.

[...] Now, Chinese hackers from the Pangu Team have reportedly found an "unpatchable" exploit on Apple's Secure Enclave chip that could lead to breaking the encryption of private security keys.

[...] The only thing we know so far is that this vulnerability in Secure Enclave affects all Apple chips between the A7 and A11 Bionic [...] Apple has already fixed this security breach with the A12 and A13 Bionic chips


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by c0lo on Monday August 03 2020, @02:02AM

    by c0lo (156) Subscriber Badge on Monday August 03 2020, @02:02AM (#1030532) Journal

    Not secure... just more so than an uninvited OTA upgrade.

    Given that you can't change the chip as it is now with an OTA (even if you can exploit it), I have this feeling that it doesn't make any difference if the chip is soldered or plugged-in a socket.

    Regarding...

    You're supposed to put the chip in a socket so it can be replaced.

    ... assuming security is important for me, I still prefer a chip that is soldered (and then encapsulated in hard epoxy resin) for security. If it turns out that the chip is unsecure, I'll just exchange the phone entirely (and blend the older one to pieces [youtu.be]).
    Replacing the chip is kinda ReadWrite, only with hardware.

    --
    https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2