6 ms·

KTRW: The Journey to Build a Debuggable iPhone

77 points by archimag0 7y ago

devin 7y ago
Where does one go about obtaining the phones they describe early in the post? What is the availability and cost for phones of this kind? More generally, what forums, irc channels, sites, etc. could I go to if I wanted to get into this community of researchers?
- xuki 7y ago
  Pretty easy to find on twitter https://mobile.twitter.com/jin_store https://mobile.twitter.com/jin_store
  - devin 7y ago
    Thanks! Did you just outgoogle me, or might you have anything interesting to share about the market?
    - xuki 7y ago
      I know of these devices from reading other articles, not an expert :).
    - saagarjha 7y ago
      He's is well known if you every go down the rabbit hole of Apple internal devices, but he's by no means the only source of these.
- gen3 7y ago
  From what I have heard in the past, Apple has only given them to specific researchers who they trust. It's very much a "We'll contact you" type of situation. From a more grey perspective, the dev-fused phones do get stolen and sold around.
  - comex 7y ago
    I don't think Apple has ever intentionally handed out dev-fused phones. However, they are planning to do something like that starting next year. [1] [1] https://www.theverge.com/2019/8/8/20756629/apple-iphone-security-research-device-program-vulnerabilities https://www.theverge.com/2019/8/8/20756629/apple-iphone-secu...
- rollulus 7y ago
  There has an article [1] about this been on the hn fp half a year ago. [1]: https://news.ycombinator.com/item?id=19321270 https://news.ycombinator.com/item?id=19321270
devin 7y ago
I note that IDA Pro and LLDB are mentioned. How much penetration does NSA’s Ghidra have at this point, and is it expected to grow over time? I used IDA briefly in a past life and was really impressed with Ghidra, especially as an “open” offering. ETA: I ask because my other comment is about debuggable phone availability. IDA was always an extra gate for amateurs. I’m wondering how much access mere mortals have to the edgiest tools and information of this particular trade.
- gen3 7y ago
  I don't know how many people are actually using it, but I've been to more then one con that has had a talk about using it. The talks focused on showing off features and/or trying to get people to use it. From a cost perspective, Ghidra has a decompiler (That works really well), and is free. I would imagine this will help with adoption. (Most other tools like Binary Ninja don't have a decompiler, as they are hard. Here is a project that takes the Ghidra decompiler and puts it into Radare https://github.com/radareorg/r2ghidra-dec https://github.com/radareorg/r2ghidra-dec ). IDA is in a good position with all the existing documentation and tutorials, I think its just a question of how long it takes for Ghidra to get the same treatment.
  - comex 7y ago
    I've recently been using Ghidra for a personal project, after using IDA extensively in the past. My impressions so far: The feature set is solid. I've been frustrated by a few minor things that are missing from Ghidra, but Ghidra also has several features that are missing from IDA, and other features are better designed than in IDA. But the whole thing is crushingly slow, especially the parts written in Java. (The decompiler is written in C++ but is also slower than Hex-Rays.) That single difference would probably have been enough to make me give up and go back to IDA, if I didn't have an ideological commitment to open source. I can't stand slow programs. The UI is poorly designed, even compared to IDA's... quirkiness. Lots of paper cuts. On the other hand, unlike IDA, it doesn't randomly crash and lose your data! (It does sometimes throw random NullPointerExceptions, but those are caught and displayed in a dialog. Since it's Java you don't have to worry about memory corruption.) Overall, I agree it's in a good position with respect to adoption, although it does have to compete with pirated IDA, as well as the other alternatives.
tjoff 7y ago
Found the virtualization is in the cloud connection weird/scary. Can't imagine running that sort of thing in the cloud. And that's even before considering the security aspects.
- saagarjha 7y ago
  Are you talking about Corellium? That runs on custom hardware that is merely accessible through the web. And presumably you're not using it for your day-to-day web browsing or email…
- xmodem 7y ago
  Depends on your use case and threat model, really. The company I work for maintains a fleet of jailbroken phones. This is a difficult proposition to scale, so we're always on the lookout for alternatives, but we evaluated a major cloud emulation player and decided against it for reasons that had nothing to do with security. I imagine the thought process is totally different if you're doing security research, though.
musicale 7y ago
Nice of Google to spend so much time and effort finding security flaws in their competitors' devices.
- saagarjha 7y ago
  For what it's worth, this isn't a security flaw.

77 points by archimag0 7y ago

Where does one go about obtaining the phones they describe early in the post? What is the availability and cost for phones of this kind? More generally, what forums, irc channels, sites, etc. could I go to if I wanted to get into this community of researchers?

xuki 7y ago
Pretty easy to find on twitter https://mobile.twitter.com/jin_store https://mobile.twitter.com/jin_store
- devin 7y ago
  Thanks! Did you just outgoogle me, or might you have anything interesting to share about the market?
  - xuki 7y ago
    I know of these devices from reading other articles, not an expert :).
  - saagarjha 7y ago
    He's is well known if you every go down the rabbit hole of Apple internal devices, but he's by no means the only source of these.
gen3 7y ago
From what I have heard in the past, Apple has only given them to specific researchers who they trust. It's very much a "We'll contact you" type of situation. From a more grey perspective, the dev-fused phones do get stolen and sold around.
- comex 7y ago
  I don't think Apple has ever intentionally handed out dev-fused phones. However, they are planning to do something like that starting next year. [1] [1] https://www.theverge.com/2019/8/8/20756629/apple-iphone-security-research-device-program-vulnerabilities https://www.theverge.com/2019/8/8/20756629/apple-iphone-secu...
rollulus 7y ago
There has an article [1] about this been on the hn fp half a year ago. [1]: https://news.ycombinator.com/item?id=19321270 https://news.ycombinator.com/item?id=19321270

devin 7y ago

I note that IDA Pro and LLDB are mentioned. How much penetration does NSA’s Ghidra have at this point, and is it expected to grow over time? I used IDA briefly in a past life and was really impressed with Ghidra, especially as an “open” offering. ETA: I ask because my other comment is about debuggable phone availability. IDA was always an extra gate for amateurs. I’m wondering how much access mere mortals have to the edgiest tools and information of this particular trade.

gen3 7y ago
I don't know how many people are actually using it, but I've been to more then one con that has had a talk about using it. The talks focused on showing off features and/or trying to get people to use it. From a cost perspective, Ghidra has a decompiler (That works really well), and is free. I would imagine this will help with adoption. (Most other tools like Binary Ninja don't have a decompiler, as they are hard. Here is a project that takes the Ghidra decompiler and puts it into Radare https://github.com/radareorg/r2ghidra-dec https://github.com/radareorg/r2ghidra-dec ). IDA is in a good position with all the existing documentation and tutorials, I think its just a question of how long it takes for Ghidra to get the same treatment.
- comex 7y ago
  I've recently been using Ghidra for a personal project, after using IDA extensively in the past. My impressions so far: The feature set is solid. I've been frustrated by a few minor things that are missing from Ghidra, but Ghidra also has several features that are missing from IDA, and other features are better designed than in IDA. But the whole thing is crushingly slow, especially the parts written in Java. (The decompiler is written in C++ but is also slower than Hex-Rays.) That single difference would probably have been enough to make me give up and go back to IDA, if I didn't have an ideological commitment to open source. I can't stand slow programs. The UI is poorly designed, even compared to IDA's... quirkiness. Lots of paper cuts. On the other hand, unlike IDA, it doesn't randomly crash and lose your data! (It does sometimes throw random NullPointerExceptions, but those are caught and displayed in a dialog. Since it's Java you don't have to worry about memory corruption.) Overall, I agree it's in a good position with respect to adoption, although it does have to compete with pirated IDA, as well as the other alternatives.

tjoff 7y ago

Found the virtualization is in the cloud connection weird/scary. Can't imagine running that sort of thing in the cloud. And that's even before considering the security aspects.

saagarjha 7y ago
Are you talking about Corellium? That runs on custom hardware that is merely accessible through the web. And presumably you're not using it for your day-to-day web browsing or email…
xmodem 7y ago
Depends on your use case and threat model, really. The company I work for maintains a fleet of jailbroken phones. This is a difficult proposition to scale, so we're always on the lookout for alternatives, but we evaluated a major cloud emulation player and decided against it for reasons that had nothing to do with security. I imagine the thought process is totally different if you're doing security research, though.

musicale 7y ago

Nice of Google to spend so much time and effort finding security flaws in their competitors' devices.

saagarjha 7y ago
For what it's worth, this isn't a security flaw.