Wibbly Wobbly, Timey Wimey - What's Really Inside Apple's U1 Chip

Presented at DEF CON 29 (2021), Aug. 7, 2021, 11 a.m. (45 minutes)

Apple introduced an Ultra Wideband (UWB) chip in the iPhone 11. Its cryptographically secured spatial measurement capabilities are accessible via the Nearby Interaction framework since iOS 14. As of now, it only supports interaction with other Apple devices including the latest Apple Watch and HomePod mini. These are the first steps to support UWB in a larger ecosystem, as measuring precise distance and direction can be an enabler for various future applications. The automotive industry already announced UWB support for mobile car keys on the iPhone. But what's really inside Apple's U1 chip, internally called Rose? In this talk, we will travel through time, space, firmware and kernel components-and fight daemons to modify firmware interaction from user space. This will not only cover one or two, but three firmwares that process or forward each Rose time measurement: The Rose Digital Signal Processor (DSP), Rose Application Processor (AP), and the Always-On Processor (AOP). REFERENCES: There's almost nothing known about UWB on the iPhones... So the only reference is this: https://support.apple.com/guide/security/ultra-wideband-security-sec1e6108efd/web

Presenters:

• Alexander Heinrich - TU Darmstadt, SEEMOO
  Alexander is a security researcher at the Secure Mobile Networking Lab at the Technical University of Darmstadt. Before he joined the university as a researcher he gained a lot of experiences an an app developer on Apple operating systems starting with iOS 5. This deep understanding of the systems naturally resulted in a focus on those systems in his security research. He joined the Secure Mobile Networking Lab 2020 as a PhD student right after his Master Thesis on the security of Apple's Handoff and Universal Clipboard features. After working with a team of skilled researchers on AirDrop and Apple's Find My network his focus now shifted to the security and privacy of ultra-wideband and Apple U1 chip. @Sn0wfreeze
• Jiska Classen - TU Darmstadt, SEEMOO   as jiska
  Jiska breaks things. @naehrdine

Links:

• https://defcon.org/html/defcon-29/dc-29-speakers.html#jiska
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Jiska Alexander Heinrich - Wibbly Wobbly, Timey Wimey - Whats Really Inside Apples U1 Chip.mp4
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 presentations/jiska Alexander Heinrich - Wibbly Wobbly, Timey Wimey - Whats Really Inside Apples U1 Chip.pdf (slides)
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Jiska Alexander Heinrich - Wibbly Wobbly, Timey Wimey - Whats Really Inside Apples U1 Chip.srt (subtitles)
• https://www.youtube.com/watch?v=k1H7fiVlTPA

Similar Presentations:

• Black Hat USA 2022 / UWB Real Time Locating Systems: How Secure Radio Communications May Fail in Practice
• Black Hat USA 2021 / Wibbly Wobbly, Timey Wimey – What's Really Inside Apple's U1 Chip
• Black Hat Europe 2017 / Jailbreaking Apple Watch