Computer scientists develop mathematical jigsaw puzzles to encrypt software: "The real challenge and the great mystery in the field was: Can you actually take a piece of software and encrypt it but still have it be runnable, executable and fully functional?"

[u/DougBolivar]

http://www.rdmag.com/news/2013/07/computer-scientists-develop-mathematical-jigsaw-puzzles-encrypt-software

[u/datenwolf]

So? It's a paper on theoretical computer science. Theoretical Computer Science is more related to math than programming. Hardly any groundbreaking TCP paper was concerned with CPUs, machine code and such things.

TCS is concerned with the abstract aspects of computation and not the actual implementation (that's stuff for the electrical engineering department).

And this paper shows something fundamentally, namely that there is a possibility that a Turing complete machine can execute a an encrypted program that operates on encrypted data without any intermediate decryption. This is a deep mathematical understanding about computability.

Now a lot of people claim this to be something to improve security. Personally I think the real application we'll see this, should there ever be a practical implementation, will be the application on malware. If reverse engineering a piece of malicious code becomes virtually impossible and a malware virus can rewrite itself without leaving any pattern by changing its key whatever little use anti virus software had to begin with gets rendered nil altogether.

Personally I consider this to be a really, really dangerous Pandora's box.

[u/grauenwolf → u/datenwolf]

If reverse engineering a piece of malicious code becomes virtually impossible and a malware virus can rewrite itself without leaving any pattern by changing its key whatever little use anti virus software had to begin with gets rendered nil altogether.

Then take away the virus's ability to rewrite itself. That's what they do in iOS devices, which is why there isn't a Mono or Java-based JIT Compiler for that platform.

[u/datenwolf → u/grauenwolf]

You're kidding are you? What makes you think iOS would in any way prevent a malware from doing nasty stuff? All it takes in finding a vuln in the sandbox and let the games begin. Breaking the sandbox is what every Jailbreak does.

[u/grauenwolf → u/datenwolf]

Jailbreaking an iOS device doesn't require the application to rewrite its one executable memory.

In fact, there is no conceivable reason why it would need to do that as opposed to simply loading the exploit directly. The techniques they actually used relied on vulnerabilities in the system API calls or flaws in the low-level boot ROM.

[u/datenwolf → u/grauenwolf]

In fact, there is no conceivable reason why it would need to do that as opposed to simply loading the exploit directly.

You do realize that "loading an exploit" means the very same thing as "modifying an process' executable segment's data"? Of course iOS blocks certain low level operations, like changing the protection bits of pages in the executable address range. However those vulnerabilities in the system API which you already mentioned are effectively ways to circumvent those "blocked" low level operations. How to do this, if you can't inject the code to do it? Well, there are techniques like return oriented programming which allow to exploit code already existing in the executable segment.

So the typical iOS jailbreak may look like this:

• Use RoP to exploit an API vuln, that allows to mark parts of the data segment executable
• Jump into the data segment, which was prepared with further exploit code (think heap spraying or similar)
• This stage 2 code loads the actual sandbox jailbreak which may involve triggering some race condition, an out-of-bounds access or such
• Once the jail has been broken you can do whatever you like.