Essential reading for hard-line GrapheneOS users in the quote note. Almost all of the major state-sponsored or mercenary exploits you hear about are possible through memory corruption vulnerabilities in their exploit chain. They make up most of the Critical / High vulnerabilities in Android even when the amount of them have reduced due to an increase in code written in memory safe languages.
Final's avatar Final
Deep dive showcase of #GrapheneOS hardened malloc by Synacktiv, a well-known offensive security company. https://synacktiv.com/en/publications/exploring-grapheneos-secure-allocator-hardened-malloc
View quoted note →

Replies (11)

Yes. Apple (finally) incorporated memory tagging into their latest iPhones and called it Memory Integrity Enforcement because of that. Their article provided examples on how memory tagging and secure allocators mitigated PoC exploit chains. image
Apple use can manufacture the latest ARM processors and so they have the latest iteration of ARM memory tagging (FEAT_MTE4) which they call Enhanced MTE (EMTE). Currently Pixels do not have that. If newer devices come out and add it, we can use it too. It is great they finally implemented it and with far greater coverage than stock Pixels, but they were behind on this for many years.
Billy Bapparoo's avatar
Billy Bapparoo 3 months ago
Do you have a recommendation for : calendar, Gmail client? Trying to see what users who are security/privacy aware use. Of course best to move of gmail but required as intermediate step
Generally, they're bad on every platform . All the security companies and government agencies moved to recommending memory-safe languages and replacing unsafe legacy code with new code for a reason. They become a security liability. Take a look at the charts of a project's sizeand the amount of memory-unsafe code they have: image What comprises the most dangerous vulnerabilities for these big projects like Linux and Chromium? Memory corruption. Android uses Linux and many major vulnerabilities are inherited from it.
FairEmail is a nice email client. For Calendar, you could use a local app like Fossify Calendar or a calendar service like Tuta, Proton, etc. Whatever service you use is up to you.
Thank you for sharing this! I take it this security feature alone would be a good reason to upgrade from a iphone 14 to the latest model even if my old hardware is working well?
If you have high security demands, sure. For most normal people who don't care then a sensible choice is just making sure your current iPhone is up to date and such. Using the latest device you possibly can all the time is either a luxury choice or a high-threat one. Regardless, this is an extremely significant security upgrade. If people believe they are a potential future victim for targeted attacks and require an Apple device, they should use iPhone 17 and future iDevices that support this.
I appreciate the feedback. Yeah, nowadays I've taken to only really upgrading my phone once the battery starts to suffer as there is no meaningful/noticeable difference to me between the models. But a significant security upgrade feels like it may be worth it. I don't think I'm at risk of a targeted attack at all though 😃
It's a worthwhile upgrade if you are on a much older iPhone, to be honest. My backup 13 I use for work could do with a change.