Behind the Scenes of iOS and Mac Security

This course examines Apple's hardware-backed security architecture across macOS and iOS, including secure boot, memory-access protections, kernel integrity, code-signing controls, pointer authentication, and privacy-preserving offline device finding.

Syllabus

Intro
Gatekeeper macOS Catalina
User Data Protections Data that requires user consent to access
Two Critical Challenges
Unrestricted Direct Memory Access
Direct Memory Access with VT-d
DMA Protection for Thunderbolt
DMA Protection for PCle Bus 0
PCle Option ROMS
OROM Sandbox
EFI Exploit Mitigations
Mac Secure Boot Summary
Software Enforced Code Integrity Before iOS 9
Kernel Integrity Protection vo
Lessons Learned
Kernel Integrity Protection v1: Read-Only Data
Kernel Integrity Protection v2
Fast Permission Restrictions (APRR) iPhone X
Pre-APRR VM Permissions
APRR: JavaScriptCore Execution Threads
APRR: JavaScriptCore JIT Compiler Thread
Protecting Userland Integrity
Page Protection Layer (PPL) iPhone XS
Page Protection Layer Summary
Pointer Authentication
Helping users find lost devices, even when offline
Security and Privacy Goals Protect owners, finders, and devices
Introduced in 2016
Making It Easier to Get Started with iOS Research
iOS Security Research Device program
Apple Security Bounty Summary