Xerub Examines iOS Security Mitigations and the Rising Cost of Exploitation

Summary

Researcher xerub traces the evolution of iOS security mitigations, their historical bypasses and the growing difficulty of building exploit chains, while recommending Lockdown Mode as a defense against attacks such as BLASTPASS.

Key points

• Xerub describes how complex code bases, outdated libraries and inadequate testing can create security weaknesses.
• Fuzzing can uncover bugs, but the speaker cautions that some sophisticated flaws are unlikely to be found this way.
• The talk traces iOS defenses including code signing, sandboxing, ASLR, kernel protections and pointer authentication, alongside historical bypasses.
• Xerub says Lockdown Mode protected devices against BLASTPASS and recommends enabling it; the exploit involved malicious images in a pass attachment.
• The speaker says layered mitigations have substantially increased the effort and cost of building reliable exploit chains.

Vendors