iOS

Secure Enclave

The Secure Enclave is a found in iOS devices that contain or . It has its own secure boot process to ensure that it is completely secure. A hardware is also included as a part of this coprocessor. Each device's Secure Enclave has a unique ID that is given to it when it is made and cannot be changed. This identifier is used to create a temporary key that the in this portion of the system. The Secure Enclave also contains an anti-replay counter to prevent .[169]

Face ID

Face ID is a face scanner that is embedded in the notch on models , , , . It can be used to unlock the device, make purchases, and log into applications among other functions. When used, Face ID only temporarily stores the face data in encrypted memory in the Secure Enclave, as described below. There is no way for the device's or any other part of the system to access the raw data that is obtained from the Face ID sensor.[169]

Passcode

iOS devices can have a passcode that is used to unlock the device, make changes to system settings, and encrypt the device's contents. Until recently, these were typically four numerical digits long. However, since unlocking the devices with a fingerprint by using Touch ID has become more widespread, six-digit passcodes are now the default on iOS with the option to switch back to four or use an alphanumeric passcode.[169]

Touch ID

Touch ID is a fingerprint scanner that is embedded in the home button and can be used to unlock the device, make purchases, and log into applications among other functions. When used, Touch ID only temporarily stores the fingerprint data in encrypted memory in the Secure Enclave, as described above. There is no way for the device's or any other part of the system to access the raw fingerprint data that is obtained from the Touch ID sensor.[169]

Address Space Layout Randomization

Address Space Layout Randomization (ASLR) is a low-level technique of preventing attacks such as . It involves placing data in randomly selected locations in memory in order to make it more difficult to predict ways to corrupt the system and create exploits. ASLR makes app bugs more likely to crash the app than to silently overwrite memory, regardless of whether the behavior is accidental or malicious.[170]

Non-Executable Memory

iOS utilizes the Execute Never (XN) feature. This allows some portions of the memory to be marked as non-executable, working alongside ASLR to prevent buffer overflow attacks including .[169]

Encryption

As mentioned above, one use of encryption in iOS is in the memory of the Secure Enclave. When a passcode is utilized on an iOS device, the contents of the device are encrypted. This is done by using a hardware 256 implementation that is very efficient because it is placed directly between the and RAM.[169]

iOS, in combination with its specific hardware, uses when erasing all content and settings by all the keys in ' storage'. This renders all user data on the device cryptographically inaccessible.[171]

Keychain

The iOS keychain is a of login information that can be shared across apps written by the same person or organization.

App Security

Third-party applications such as those distributed through the App Store must be code signed with an Apple-issued . In principle, this continues the all the way from the Secure Boot process as mentioned above to the actions of the applications installed on the device by users. Applications are also , meaning that they can only modify the data within their individual unless explicitly given permission to do otherwise. For example, they cannot access data that is owned by other user-installed applications on the device. There is a very extensive set of privacy controls contained within iOS with options to control apps' ability to access a wide variety of permissions such as the camera, contacts, background app refresh, cellular data, and access to other data and services. Most of the code in iOS, including third-party applications, runs as the "mobile" user which does not have . This ensures that system files and other iOS system resources remain hidden and inaccessible to user-installed applications.[169]

App Store bypasses

Companies can apply to Apple for enterprise developer certificates. These can be used to sign apps such that iOS will install them directly (sometimes called "sideloading"), without the app needing to be distributed via the App Store.

Circa January–February 2019, it emerged that a number of software developers were misusing enterprise developer certificates to distribute software directly to non-employees, thereby bypassing the App Store. Facebook was found to be abusing an Apple enterprise developer certificate to distribute an application to underage users that would give Facebook access to all private data on their devices..[178]

Network Security

iOS supports with both low- and high-level for developers. By default, the App Transport Security framework requires that servers use at least TLS 1.2. However, developers are free to override this framework and utilize their own methods of communicating over networks. When Wi-Fi is enabled, iOS uses a randomized so that devices cannot be tracked by anyone wireless traffic.[169]

Two-Factor Authentication

Two-factor authentication is an option in iOS to ensure that even if an unauthorized person knows an and password combination, they cannot gain access to the account. It works by requiring not only the Apple ID and password, but also a verification code that is sent to a device that is already known to be trusted.

1. . . Retrieved March 24, 2020.
   


2. . Apple Developer. March 24, 2020. Retrieved March 24, 2020.
   


3. . Apple. from the original on January 4, 2019. Retrieved January 4, 2019.
   


4. . Apple. from the original on October 24, 2015. Retrieved October 24, 2015.
   


5. . Apple. Archived from on October 26, 2015. Retrieved October 24, 2015.
   


6. . Apple. from the original on January 4, 2019. Retrieved January 4, 2019.
   


7. . .
   


8. . Lifewire. Retrieved October 15, 2018.
   


9. . globalnews.ca. June 5, 2019. Retrieved June 6, 2019.
   


10. . . from the original on April 7, 2017. Retrieved April 1, 2017.
    


11. . . from the original on April 2, 2017. Retrieved April 1, 2017.
    


12. . CNN Money. from the original on April 2, 2017. Retrieved April 1, 2017.
    


13. . . from the original on April 2, 2017. Retrieved April 1, 2017.
    


14. . . . from the original on January 26, 2017. Retrieved April 1, 2017.
    


15. (January 9, 2007). . . . from the original on March 24, 2017. Retrieved April 1, 2017.
    


16. . The Next Web. from the original on April 1, 2017. Retrieved April 1, 2017.
    


17. . . . September 16, 2013. from the original on April 12, 2017. Retrieved April 1, 2017.
    


18. . . . from the original on February 20, 2017. Retrieved April 1, 2017.
    


19. . 9to5Mac. October 21, 2011. from the original on April 1, 2017. Retrieved April 1, 2017.
    


20. . . . from the original on April 2, 2017. Retrieved April 1, 2017.
    


21. . AppleInsider. from the original on April 2, 2017. Retrieved April 1, 2017.
    


22. . . from the original on April 2, 2017. Retrieved April 1, 2017.
    


23. (March 6, 2008). . . . from the original on January 27, 2017. Retrieved April 1, 2017.
    


24. . . . from the original on April 2, 2017. Retrieved April 1, 2017.
    


25. . . . from the original on March 30, 2017. Retrieved April 1, 2017.
    


26. . Apple Press Info. September 9, 2008. from the original on April 1, 2017. Retrieved April 1, 2017.
    


27. . . Situation Publishing. from the original on May 5, 2017. Retrieved April 1, 2017.
    


28. . . . from the original on June 10, 2009. Retrieved April 1, 2017.
    


29. . . . from the original on March 30, 2017. Retrieved March 29, 2017.
    


30. . . . from the original on March 30, 2017. Retrieved March 29, 2017.
    


31. . The Next Web. from the original on March 29, 2017. Retrieved March 29, 2017.
    


32. . . from the original on March 30, 2017. Retrieved March 29, 2017.
    


33. . . . from the original on March 30, 2017. Retrieved March 29, 2017.
    


34. . . . from the original on May 12, 2017. Retrieved March 29, 2017.
    


35. . . from the original on March 30, 2017. Retrieved March 29, 2017.
    


36. ^ Golson, Jordan (June 13, 2016). . . . from the original on February 10, 2017. Retrieved March 29, 2017.
    


37. . . from the original on March 30, 2017. Retrieved March 29, 2017.
    


38. . . . from the original on March 30, 2017. Retrieved March 29, 2017.
    


39. . . . from the original on January 28, 2017. Retrieved March 29, 2017.
    


40. . . . from the original on March 30, 2017. Retrieved March 29, 2017.
    


41. . . . from the original on March 30, 2017. Retrieved April 1, 2017.
    


42. . . . from the original on March 30, 2017. Retrieved March 29, 2017.
    


43. . . . from the original on June 18, 2016. Retrieved June 21, 2017.
    


44. . . . from the original on July 3, 2017. Retrieved June 21, 2017.
    


45. . . from the original on May 11, 2011. Retrieved February 2, 2011.
    


46. . . from the original on December 23, 2016. Retrieved December 22, 2016.
    


47. . AppleInsider. from the original on December 21, 2016. Retrieved December 22, 2016.
    


48. . developer.apple.com. Retrieved February 8, 2020.
    


49. . . . from the original on August 8, 2017. Retrieved June 20, 2017.
    


50. . www.macrumors.com. Retrieved September 25, 2019.
    


51. . Apple Newsroom. Retrieved September 25, 2019.
    


52. . 9to5Mac. Retrieved September 25, 2019.
    


53. . . January 15, 2008. from the original on October 31, 2017. Retrieved June 20, 2017.
    


54. . . . from the original on July 8, 2017. Retrieved June 20, 2017.
    


55. . AppleInsider. from the original on March 5, 2017. Retrieved June 20, 2017.
    


56. . . . from the original on July 8, 2017. Retrieved June 20, 2017.
    


57. . . from the original on July 11, 2017. Retrieved June 20, 2017.
    


58. . help.apple.com. Retrieved May 24, 2015.
    


59. . support.apple.com. from the original on April 28, 2015. Retrieved May 24, 2015.
    


60. . . June 10, 2013. from the original on October 7, 2013. Retrieved September 18, 2013.
    


61. . October 21, 2013. from the original on January 13, 2015. Retrieved March 1, 2014.
    


62. . September 16, 2015. from the original on October 19, 2015. Retrieved October 17, 2015.
    


63. . . . from the original on February 10, 2017. Retrieved April 1, 2017.
    


64. May 12, 2013, at the . In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI '13). ACM, New York, NY, USA, 2137–2146.
    


65. . . from the original on October 9, 2017. Retrieved October 15, 2017.
    


66. . . . from the original on June 13, 2015. Retrieved October 15, 2017.
    


67. . . from the original on October 15, 2017. Retrieved October 15, 2017.
    


68. . 9to5Mac. from the original on July 31, 2016. Retrieved October 15, 2017.
    


69. . iMore. from the original on May 8, 2017. Retrieved October 15, 2017.
    


70. . . from the original on December 21, 2017. Retrieved October 15, 2017.
    


71. . AppleInsider. September 16, 2015. from the original on March 6, 2017. Retrieved October 15, 2017.
    


72. ^ Frakes, Dan (June 21, 2010). . . . from the original on November 1, 2017. Retrieved October 15, 2017.
    


73. . . . from the original on October 15, 2017. Retrieved October 15, 2017.
    


74. . . . from the original on August 6, 2017. Retrieved October 15, 2017.
    


75. . 9to5Mac. from the original on October 15, 2017. Retrieved October 15, 2017.
    


76. . Apple Inc. Archived from on February 14, 2012.
    


77. . . from the original on December 20, 2016. Retrieved March 31, 2017.
    


78. . . . from the original on April 1, 2017. Retrieved March 31, 2017.
    


79. . . . from the original on April 1, 2017. Retrieved March 31, 2017.
    


80. . . from the original on April 1, 2017. Retrieved March 31, 2017.
    


81. . . . from the original on April 1, 2017. Retrieved March 31, 2017.
    


82. . . . from the original on April 1, 2017. Retrieved March 31, 2017.
    


83. . . . from the original on April 1, 2017. Retrieved March 31, 2017.
    


84. . The Huffington Post. June 21, 2010. from the original on December 29, 2011. Retrieved April 13, 2013.
    


85. . PC Magazine. from the original on June 23, 2014. Retrieved April 14, 2013.
    


86. ^ Cheng, Jacqui (June 21, 2010). . . . from the original on April 2, 2017. Retrieved April 1, 2017.
    


87. . The Register. from the original on June 13, 2013. Retrieved April 14, 2013.
    


88. . Apple. from the original on September 6, 2013. Retrieved September 14, 2013.
    


89. . PC World. from the original on June 29, 2013. Retrieved April 14, 2013.
    


90. . June 14, 2010. from the original on June 15, 2010. Retrieved June 14, 2010.
    


91. . April 8, 2010. from the original on June 13, 2010. Retrieved June 14, 2010.
    


92. ^ . Developer.apple.com. from the original on July 27, 2015. Retrieved September 4, 2015.
    


93. . from the original on September 28, 2013. Retrieved September 23, 2013.
    


94. . iPhone Hacks. from the original on November 7, 2015. Retrieved September 20, 2015.
    


95. . Apple Inc. from the original on September 30, 2012. Retrieved October 9, 2012.
    


96. . Tuaw. September 18, 2013. from the original on February 21, 2014. Retrieved March 21, 2014.
    


97. . Macworld. from the original on May 30, 2013. Retrieved April 14, 2013.
    


98. . . . from the original on April 2, 2017. Retrieved April 1, 2017.
    


99. . iLounge. from the original on December 21, 2012. Retrieved April 14, 2013.
    


100. . . . from the original on July 28, 2017. Retrieved June 21, 2017.
     


101. . . from the original on July 28, 2017. Retrieved June 21, 2017.
     


102. . AppleInsider. from the original on May 27, 2017. Retrieved June 21, 2017.
     


103. . . . from the original on June 23, 2017. Retrieved June 21, 2017.
     


104. . . from the original on July 28, 2017. Retrieved June 21, 2017.
     


105. . . . from the original on July 28, 2017. Retrieved June 21, 2017.
     


106. . . . from the original on August 31, 2012. Retrieved June 21, 2017.
     


107. . . . from the original on June 24, 2017. Retrieved June 21, 2017.
     


108. . . from the original on July 28, 2017. Retrieved June 21, 2017.
     


109. . . . from the original on July 28, 2017. Retrieved June 21, 2017. (subscription required)
     


110. . . . from the original on June 15, 2017. Retrieved June 21, 2017.
     


111. . . . from the original on June 19, 2017. Retrieved June 21, 2017.
     


112. ^ . Apple. from the original on June 17, 2010. Retrieved June 14, 2010.
     


113. . . January 9, 2010. from the original on May 25, 2012. Retrieved September 1, 2010.
     


114. . Pcworld.com. Retrieved September 1, 2010.
     


115. . Apple Inc. from the original on March 6, 2013. Retrieved October 9, 2012.
     


116. . Apple. December 23, 2010. Archived from on December 23, 2010.
     


117. . Shoutpedia.
     


118. . . from the original on September 24, 2015.
     


119. . . from the original on April 28, 2017.
     


120. . . from the original on January 31, 2017.
     


121. . . from the original on June 5, 2017.
     


122. . . from the original on June 20, 2017.
     


123. . . from the original on April 29, 2017.
     


124. ^ . 9to5Mac. October 21, 2011. from the original on June 11, 2017. Retrieved June 21, 2017.
     


125. . . from the original on August 28, 2017. Retrieved June 21, 2017.
     


126. . AppleInsider. October 17, 2007. from the original on August 28, 2017. Retrieved June 21, 2017.
     


127. . . . from the original on August 28, 2017. Retrieved June 21, 2017.
     


128. (March 6, 2008). . . . from the original on June 14, 2017. Retrieved June 21, 2017.
     


129. ^ Guevin, Jennifer (March 6, 2008). . . . from the original on September 13, 2016. Retrieved June 21, 2017.
     


130. ^ Kim, Arnold (March 6, 2008). . . from the original on March 11, 2016. Retrieved June 21, 2017.
     


131. . 9to5Mac. from the original on August 22, 2016. Retrieved June 21, 2017.
     


132. . . . from the original on January 15, 2018. Retrieved June 21, 2017.
     


133. . Android Authority. from the original on June 26, 2017. Retrieved June 21, 2017.
     


134. . . . from the original on November 22, 2015. Retrieved June 21, 2017.
     


135. . . . from the original on September 24, 2014. Retrieved June 21, 2017.
     


136. . statcounter.com. from the original on May 26, 2012. Retrieved February 19, 2017.
     


137. . InsideMobileApps. July 24, 2012. Archived from on July 27, 2012. Retrieved July 24, 2012.
     


138. . . . from the original on February 10, 2017. Retrieved April 1, 2017.
     


139. . . from the original on June 23, 2016. Retrieved June 21, 2017.
     


140. . 9to5Mac. from the original on July 4, 2017. Retrieved June 21, 2017.
     


141.  1-59315-720-7.
     


142. (Press release). IDC. February 24, 2015. Archived from on February 25, 2015.
     


143. (Press release). IDC. March 12, 2015. Archived from on March 13, 2015.
     


144. . from the original on May 26, 2012. Retrieved March 6, 2015.
     


145. . Strategy Analytics. from the original on November 27, 2016. Retrieved November 27, 2016.
     


146. . . from the original on November 27, 2016. Retrieved November 27, 2016.
     


147. . . . from the original on April 1, 2017. Retrieved April 1, 2017.
     


148. . . from the original on November 6, 2007. Retrieved August 6, 2007.
     


149. . September 11, 2007. from the original on February 20, 2017. Retrieved February 19, 2017.
     


150. . . from the original on June 29, 2007. Retrieved June 28, 2007.
     


151. . IPad Forums. from the original on November 2, 2012. Retrieved November 4, 2012.
     


152. . . from the original on July 31, 2012. Retrieved December 13, 2011.
     


153. (PDF). U.S. Copyright Office. July 27, 2010. (PDF) from the original on May 1, 2012. Retrieved August 21, 2012.
     


154. . Know Your Mobile. Archived from on August 31, 2012. Retrieved November 4, 2012.
     


155. . AT&T. from the original on August 3, 2012. Retrieved August 21, 2012.
     


156. . Website. May 22, 2012. from the original on October 17, 2012. Retrieved August 21, 2012.
     


157. . Website. April 12, 2013. from the original on April 24, 2013. Retrieved May 13, 2013.
     


158. . . October 9, 2015. from the original on July 13, 2017. Retrieved October 19, 2017.
     


159. . Website. February 9, 2013. from the original on May 10, 2013. Retrieved May 13, 2013.
     


160. . from the original on April 12, 2012.
     


161. . . . from the original on April 2, 2017. Retrieved April 1, 2017.
     


162. . February 3, 2010. from the original on December 1, 2010. Retrieved June 9, 2010.
     


163. . . from the original on March 16, 2014. Retrieved February 7, 2010.
     


164. . from the original on March 5, 2012.
     


165. . Slashdot. January 31, 2010. from the original on February 8, 2010. Retrieved June 9, 2010.
     


166. (Interviewee) (January 22, 2011). . Fragoso, Victor. from the original on May 12, 2011. Retrieved March 7, 2011.
     


167. . from the original on May 15, 2010. Retrieved June 9, 2010.
     


168. ^ Available in iOS 5 to iOS 7 via General > About > Diagnostics & Usage > Diagnostics & Usage Data >(date and time).panic.plist, after a kernel crash Available in iOS 8 to iOS 10 via Privacy > Diagnostics & Usage > Diagnostics & Usage Data > JetsamEvent-(date and time).ips, when low in memory Available in iOS 11 and 12 via Privacy > Analytics > Analytics Data > JetsamEvent-(date and time).ips, when low in memory

     Available in iOS 13 via Privacy > Analytics & Improvements > Analytics Data > SystemMemoryReset-(date and time).ips, when low in memory

     
     


169. ^ Apple Inc. (May 2016). (PDF). Apple.com. (PDF) from the original on February 27, 2016.
     


170. . Theiphonewiki.com. from the original on December 23, 2016. Retrieved December 6, 2016.
     


171. . from the original on September 11, 2018. Retrieved September 21, 2018.
     


172. . developer.apple.com. from the original on December 20, 2016. Retrieved December 6, 2016.
     


173. ^ . Social.techcrunch.com. Retrieved February 20, 2019.
     


174. . Social.techcrunch.com. Retrieved February 20, 2019.
     


175. . AppleInsider. Retrieved February 20, 2019.
     


176. . The Verge. Retrieved February 20, 2019.
     


177. . Social.techcrunch.com. Retrieved February 20, 2019.
     


178. . NBC News. Retrieved February 20, 2019.
     


179. . Apple Support. from the original on December 20, 2016. Retrieved December 6, 2016.
     


180. , , Retrieved June 7, 2018.
     


181. (), model database, version as of 26 July 2007.