Apple details Secure Exclaves, isolated runtimes for camera and microphone data
Apple published details of Secure Exclaves, a security architecture designed to protect camera and microphone data during background processing.
Apple published details of Secure Exclaves, a security architecture designed to protect camera and microphone data during background processing.
Apple says data processed and analyzed within Secure Exclaves cannot be accessed by the main operating system, apps, or the company itself, and the company uses Secure Exclaves for person recognition on HomeView, as well as for Siri Recap and Live Rewind.
In active mode, full sensor data can be released to the main operating system, with a secure indicator informing the user that this is happening.
Secure indication lets users see whether an active sensor session is in progress, without interference from the main operating system.
Ambient sensing uses the microphone and camera to understand the surrounding environment and recognize an enrolled user’s voice and face, and it reduces sensor streams to simple signals, such as whether a specific sound was detected or an enrolled user was recognized.
In ambient mode, sensors respond to particular triggers in their surroundings, but only specific metadata can be shared with the rest of the system.
A controlled interface limits what can cross that boundary to a precisely defined set of information.
For this reason, we utilized an Apple-customized version of the L4 microkernel which we originally built for some of our most security-sensitive deployments, including the Secure Enclave Processor (SEP), Apple explained.
The microkernel uses capabilities, which are secure resource handles that identify a resource and authorize access to it.
The Secure Page Table Monitor (SPTM), which runs at a higher privilege level than the main operating system’s kernel, enforces memory isolation.
On iPhone, a display exclave checks that the pixels used to render the indicator meet a minimum brightness threshold and are not obscured by nearby pixels.
They can notify the main operating system that someone may be present without sharing images or audio.
What happened
Apple published details of Secure Exclaves, a security architecture designed to protect camera and microphone data during background processing.
Apple says data processed and analyzed within Secure Exclaves cannot be accessed by the main operating system, apps, or the company itself, and the company uses Secure Exclaves for person recognition on HomeView, as well as for Siri Recap and Live Rewind.
What changed
In active mode, full sensor data can be released to the main operating system, with a secure indicator informing the user that this is happening.
Secure indication lets users see whether an active sensor session is in progress, without interference from the main operating system.
Who is affected
Ambient sensing uses the microphone and camera to understand the surrounding environment and recognize an enrolled user’s voice and face, and it reduces sensor streams to simple signals, such as whether a specific sound was detected or an enrolled user was recognized.
Why it matters
In ambient mode, sensors respond to particular triggers in their surroundings, but only specific metadata can be shared with the rest of the system.
A controlled interface limits what can cross that boundary to a precisely defined set of information.
Technical details
For this reason, we utilized an Apple-customized version of the L4 microkernel which we originally built for some of our most security-sensitive deployments, including the Secure Enclave Processor (SEP), Apple explained.
The microkernel uses capabilities, which are secure resource handles that identify a resource and authorize access to it.
The Secure Page Table Monitor (SPTM), which runs at a higher privilege level than the main operating system’s kernel, enforces memory isolation.
Response
On iPhone, a display exclave checks that the pixels used to render the indicator meet a minimum brightness threshold and are not obscured by nearby pixels.
They can notify the main operating system that someone may be present without sharing images or audio.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.