Slides From Apple’s Presentation at Black Hat USA (PDF) ⇥ blackhat.com

Apple’s head of security Ivan Krstić spoke at Black Hat USA this year to announce, amongst other things, a new bug bounty program. Their bug bounty program has very generous rewards and a 1:1 matching program for donating the reward to charity.

Black Hat posted the slides (PDF) from Krstić’s talk, with lots of information about security protocols in iOS 10, WebKit, the Secure Enclave, and lots more.

For instance, there’s a new method of backing up iCloud Keychain secrets to a secure Apple server, to be used when trying to recover the iCloud Keychain if a device is lost. Krstić says that this requires an additional credential: a device passcode, typically. I saw this firsthand when I installed the developer beta of MacOS Sierra, and was prompted to enter my iPad passcode.

The set of slides beginning at 63 is also worth your time. It’s about how Apple controls iCloud security internally, and it’s surprising, to say the least.

Like any good talk, these slides are merely supplementary and will require more context from the presentation itself. Black Hat will probably post a video to their YouTube channel in the coming weeks; keep an eye out.

If you’re looking for a deeper dive into the Secure Enclave, a few security researchers from Offcell Research and Azimuth Security did their best to examine it for quality and flaws. Almost all of their slides go way over my head, but they did say this in their conclusion:

Overall hardware design is light years ahead of competitors

That’s reassuring, at least.

If you spot a more accessible summary of either of these talks, please do let me know.