Sleepless in Cupertino

Apple gets peeled
Someone named xerub is causing some sleepless nights in Cupertino. What s/he has done is publish the key used for the iPhone’s Secure Enclave Processor’s (SEP) firmware.

SEP is a coprocessor inside the iPhone that is a barrier around some of the security functions like TouchID. These functions are directly controlled by the SEP itself. What has been published is the key to obscuring the SEP’s firmware in iOS, an extra step in the security fabric that was used to slow down attackers.

While this obscurity removal will make it somewhat easier to understand what goes on inside of the SEP, the takeaway here is that the functionality of SEP will not be affected by this key.

Someone may someday use this to make some sort of SEP exploit, but that day has not come. Ignore the pundits saying how this will now make iOS unsafe to use. It still works fine. And who knows, Apple may end up changing that SEP key in some way so that what has been published will become irrelevant.

The really interesting thing here is that this is a direct attack on the cryptology front door of a security solution. Attacks usually go around that front door and try to break a window because its easier to do. How the key was obtained, how that cryptology was compromised is the really important and underlying question. If it can be done on this sort of computationally intensive problem, what else can be done?

It will be more than interesting to see if the answer to that appears as time goes on.

Some good news
Researchers from the University of California, Berkeley, and the Lawrence Berkeley National Laboratory have come up with a way to set up an automated warning system about spearfishing email attacks.

In fact, it was so good that Facebook paid them $100,000 and gave them the 2017 Internet Defense Prize for their work.

Their paper on the system was presented at this week’s USENIX Security Symposium in Vancouver. It combines a new non-parametric anomaly scoring technique for ranking security alerts along with an analysis of what is inside of spear-phishing emails.

They looked at 4 years of an organization’s emails (370 million of them!) in their research and came up with two key parts: domain reputation features and sender reputation features.

The domain reputation feature looks at links in an email to see if it is a risk. They decided that a URL is risky if , for example, it has not been visited by many organization employees, or even if it has never been visited until very recently.

Want to learn more about the tech and business cases for deploying virtualized solutions in the cable network? Join us in Denver on October 18 for Light Reading's Virtualizing the Cable Architecture event – a free breakfast panel at SCTE/ISBE's Cable-Tec Expo featuring speakers from Comcast and Charter.

The sender reputation looks at identity spoofing in the “From:” header, any very close matches to a previously known senders and suspicious content that may imply immediate action is needed or reference credentials and the like.

All events are evaluated against each other, and the ones that hit the top are referred out to the security team. The advantage of doing things in this manner was is a low false positive rate.

This kind of research points the way to adding automation to the security arena in a meaningful way. Reducing false positives also reduces alert fatigue which may swamp actionable alerts.

The threats we have come of late to accept as normal due to routine communications may be mitigated by applying this kind of new automation tool.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.