A hacker released what he claimed to be a firmware decryption key for Apple`s Secure Enclave on Thursday, initially sparking fears that iOS security had been compromised.
Apple`s Secure Enclave Processor (SEP) handles all cryptographic operations for the Apple Watch Series 2, the A7 processor that powers the iPhone 5s, the iPad Air, the iPad mini 2 and 3, and subsequent A-series chips. The encrypted SEP is completely isolated from the rest of the system and handles Touch ID transactions, password verifications, and other security processes on a separate OS to maintain data protection integrity even if the kernel has been compromised.
One of the ways the SEP does this is by generating a Unique ID (UID) for each device for authentication purposes. The UID automatically changes every time a device is rebooted and remains unknown to other parts of the system, further enhancing its security.
Beyond that, little is known about how the SEP actually works outside of Apple, but that`s by design - the enclave`s isolation serves to obfuscate it from the rest of the system, preventing hackers from rifling through its code to make it as secure as possible.
key is fully grown https://t.co/MwN4kb9SQI use https://t.co/I9fLo5Iglh to decrypt and https://t.co/og6tiJHbCu to process— ~ (@xerub) August 16, 2017
The decryption key posted on GitHub yesterday would not enable hackers to access data stored inside the Secure Enclave, but it could allow hackers and security researchers to decrypt the firmware that controls it and potentially spot weaknesses in the code.
Speaking to TechRepublic, the hacker that released the key claimed that Apple`s effort to obfuscate the code was itself cause for concern.
`The fact that the SEP was hidden behind a key worries me,` said xerub. `Is Apple not confident enough to push SEP decrypted as they did with kernels past iOS 10?` He added that while SEP is amazing tech the fact that it`s a `black box` ad ...
|
