Apple's second iOS 10 beta includes unencrypted 32-bit bootloader, RAM Disk, more

Apple turned heads in June when it released a preview version of iOS 10 containing an unencrypted kernel cache, a significant shift in software security policy meant to streamline system performance, and analysis shows the company is building on those efforts with the second beta release.

In a tweet on Wednesday, security expert Jonathan Zdziarski noted that the second iOS 10 beta leaves even more OS components unencrypted than the first preview version, the MIT Technology Review reports. Researchers clarified much more than kernel cache unobscured.

According to a chart compiled by noted iPhone software expert "MuscleNerd," 32-bit bootloaders, all kernel caches and all RAM Disks (except for Apple TV) are unencrypted in iOS 10 beta 2. In comparison, no bootloaders or RAM Disks were left unencrypted in the first beta version.

The latest release aligns with what appears to be a shift in Apple's approach toward software security. Instead of keeping all aspects of its next-generation mobile operating system under lock and key, the company is opening up certain components to developer scrutiny. The unobscured iOS 10 kernel cache is a prime example.

Since the inception of iOS (previously iPhone OS), Apple has obfuscated the kernel to discourage illicit probing that could inherently weaken system integrity. With iOS 10, however, Apple is relaxing those strict policies by leaving the kernel cache unencrypted, a move it says optimizes system performance. As the cache does not include sensitive information, leaving it unobscured poses no risk to end users.

Researchers speculate the move also benefits Apple's bug reporting efforts. The more eyes on iOS 10, the higher the chance of fleshing out overlooked flaws that can be fixed prior to public release this fall.

Apple has not commented on its decision to expand system transparency, nor has it provided comprehensive list of newly unencrypted iOS 10 assets.

16 Comments

cpsro 3236 comments · 14 Years

About 8 years ago

How does use of an unencrypted boot loader make a dent in system performance?

TurboPGT 355 comments · 9 Years

These are things typically not encrypted on other systems.

thewhitefalcon 4444 comments · 10 Years

cpsro said:

How does use of an unencrypted boot loader make a dent in system performance?

Even with hardware-accelerated encryption it still has to load/unload it. And iOS 10 boots and shuts down much faster than any version of iOS in recent memory.

ericthehalfbee 4489 comments · 13 Years

Maybe this will also be shift in how Apple deals with security. They might even start offering a bug bounty.

thewhitefalcon said:

cpsro said:

How does use of an unencrypted boot loader make a dent in system performance?

Even with hardware-accelerated encryption it still has to load/unload it. And iOS 10 boots and shuts down much faster than any version of iOS in recent memory.

ARM A6 and later are kinda fast. A millisecond faster, for a small bit of code that's executed once, is "much faster" or even more important than security? I don't think that justifies opening it up to modification. But somehow opening the boot loader to sanctioned 3rd party modifications in a secure manner might warrant the lack of encryption. If not encrypted, it can still be digitally signed--with Apple holding the keys. I expect Apple has some surprises in store concerning this.