Hacker News Reader

Comment by pacificmint | Hacker News Reader

If a PC is infected I can (and should) reinstall everything from scratch. That should remove the malware, barring some super resistant malware that hides in the BIOS or something like that.

What do you do on an iOS device? Does a full device reset reinstall the OS, or does it simply remove all user settings?

I feel like the locked down nature of iOS makes it harder to attack, but if an attack goes thru it would also make it harder to clean up the attack?

View on HN

A full reinstall of iOS--done by putting the device into DRU mode and then entirely re-imaging it over USB with iTunes from a firmware image--really does reinstall everything on the system that can possibly be changed by anyone (like, excepting code that is so fixed it isn't upgradeable even by Apple)... if anything you sometimes get some settings left around in awkward places for some of the lower-level components (that maybe could be used to smuggle intent or even attacks across the reinstall). iOS is actually really really good about this in comparison to a lot of other devices.

DRU -> DFU (typo :()

If you're going against an adversary capable and willing to drop multiple zero days to breach you, let alone 11, I wouldn't wager much on a simple system wipe getting you back to a good state (iOS or not).

Given the price of iOS devices vs good security consultant hourlies, the easiest and most effective clean-up for a few devices is likely just starting over.

Reinstalling everything from scratch is a good start, but persistence of an exploit can easily be achieved through most data backups. Nobody wants to part with their important Word and Excel files, so those will get restored onto the fresh machine, carrying all the usual embedded macro nasties that an attacker planted there.

Of course you can try to be diligent and skip everything that is potentially a problem, but it is even harder than reinstalling and the data you are dropping is usually more valuable than the OS installation.

> persistence of an exploit can easily be achieved through most data backups

Not on iOS.

There is a bootrom exploit called checkm8 (and corresponding jailbreak called checkra1n) for some iOS devices, you could exploit that, which lets you run code before any possible malware, then use that code to wipe the device and reinstall iOS, although I expect it would be hard to obtain a pristine copy of all the firmware in all the parts of the SoC.

https://checkra.in/

Reply on news.ycombinator.com