--
Seriously Apple? You have a device that is able to pull from a variety of sources of random data, and you didn't use that data in your random number generator? Why?Researcher: iOS 7 security at risk from weak random number generator
Predictable and observable random number generator
present in iOS 7
All mobile operating systems require what is called an "Early Random pseudorandom number generator (PRNG)" to give the operating system some security from kernel exploits. Researchers have revealed that the new one implemented in iOS 7 is vulnerable to brute force attacks, and can be relatively easy to predict, making security exploits somewhat easier to develop, if left unpatched.
. . .
While researching the matter, Mandt found that "we found that an unprivileged attacker, even when confined by the most restrictive sandbox, can recover arbitrary outputs from the generator and consequently bypass all the exploit mitigations that rely on the early random PRNG."
Sources of actual random data on iOS devices:
- The compass
- The accelerometer
- The fingerprint of the user
- The white balance detected by the camera
- The number of files on the device
- The last phone number called
- The last website visited in Safari
- Audio noise detected by the microphone
- The current power level of the battery
- The proximity sensor
- The ambient light sensor
- The date and time
In other words: Get seriously random Apple!
--
Some friends were riffing off this article over at Facebook. The question is: Why isn't pseudo-random data good enough any more?
ReplyDeleteSo I brainstormed a list of a few reasons why:
- Computing power has accelerated to the point where a dictionary attack on a password system can take all of a minute's time, and that includes using 1337-speak clever passwords.
- Hacking is now a money making venture. The vast majority of malware and exploitation of security holes is directed at extracting money from someone or other.
- Sources of actual random data are now accessible by the majority of computing devices, if only via their internal temperature sensor.
- Pressure mounts for superior programming beyond the crappy C-whatever and OMFG Java languages we're stuck with today. They clearly are NOT adequate, and I don't give a rat's who disagrees with me. Memory management alone is in a catastrophic state in ALL current languages. THEREFORE, alongside this modern problem is the demand that pseudo-random is just as antiquated, get rid of it and get totally random.
- 'Artificial Intelligence' is a total FAIL at this point. All we did was create far more useful expert systems. People go all GAGA over IBM's Watson, but there is nothing at all intelligent about it. It's only a terrific expert system. Therefore, again pressure on finding some way into the Jetson future all the experts imagined. Using pseudo-random data in infuriating from this perspective.
Other thoughts?