In the past a USB or WIFI/Bluetooth attack would have got kernel mode execution then used the secure enclave to brute force credentials.
I think what makes this statement interesting is that Apple recently introduced anti-replay counters into their A12 SOC to defeat replay attacks that just reset the memory after each attempt.
I think this might represent a new generation of attacks that either have found a bug in the secure enclave OS itself or some kind of local timing/side channel attack.
The secure enclave has been getting more complex (things like neural net for FaceID) and I have no idea if it has modern mitigations like ASLR so there is reasonable chance people can get execution there. Really just another local privilege escalation.
The side-channel idea is also really interesting because a lot of the row-hammer and SPECTRE style attacks seem far-fetched in real scenarios but attacking a different ring of your own chip with full kernel access makes any kind of hardware attack seem much more reasonable.
Comments
In the past a USB or WIFI/Bluetooth attack would have got kernel mode execution then used the secure enclave to brute force credentials.
I think what makes this statement interesting is that Apple recently introduced anti-replay counters into their A12 SOC to defeat replay attacks that just reset the memory after each attempt.
I think this might represent a new generation of attacks that either have found a bug in the secure enclave OS itself or some kind of local timing/side channel attack.
The secure enclave has been getting more complex (things like neural net for FaceID) and I have no idea if it has modern mitigations like ASLR so there is reasonable chance people can get execution there. Really just another local privilege escalation.
The side-channel idea is also really interesting because a lot of the row-hammer and SPECTRE style attacks seem far-fetched in real scenarios but attacking a different ring of your own chip with full kernel access makes any kind of hardware attack seem much more reasonable.