Security Bite: Apple updates Platform Security guide with first-ever details on App Store security, BlastDoor, more

May 11, 2024

4 min read

Apple this week updated its Platform Security guide, which contains in-depth technical information on security features implemented in its products. First released in 2015, the latest update adds six new topics, including first-ever details on BlastDoor 0-click protection and App Store security.

9to5Mac Security Bite is exclusively brought to you by Mosyle, the only Apple Unified Platform. Making Apple devices work-ready and enterprise-safe is all we do. Our unique integrated approach to management and security combines state-of-the-art Apple-specific security solutions for fully automated Hardening & Compliance, Next Generation EDR, AI-powered Zero Trust, and exclusive Privilege Management with the most powerful and modern Apple MDM on the market. The result is a totally automated Apple Unified Platform currently trusted by over 45,000 organizations to make millions of Apple devices work-ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple.

Apple has long touted its hardware, software, and services are designed in tandem for maximum security and transparency. Of course, nothing is one hundred percent secure, as we witnessed with the discovery of the Operation Triangulation 0-click iMessage spyware campaign in 2023.

In the midst of the exploit, Samuel Groß, a security researcher working with Google’s Project Zero discovered a hidden iMessage security system in iOS 14.3 called BlastDoor while reverse engineering an iPhone XS. He found that the feature acted as a sandbox that securely processed incoming messages in an isolated environment, checking for malware before presenting them to the user.

This was presumably Apple’s first response to the increase in iMessage exploit activity; years before the release of Lockdown Mode, which was primarily designed for high-profile individuals. However, BlastDoor went without documentation or acknowledgment for years…until this week.

Apple also shared some information about the security measures in place in the App Store. This comes as alternative app stores, which are considered less safe by Apple, are now permitted on iPhones in the EU. It seems that Apple wants to reassure users about the safety and reliability of the App Store. However, I think the reality may be slightly grimmer than what Apple portrays. There has been a growing concern about the App Store’s approval process as it continues to allow privacy-invasive and sometimes malicious apps, such as crypto wallets or GPT clones.

2024 Apple Platform Security guide

The latest Apple Platform Security guide update details some of the changes the company has implemented in the past two years.

“This documentation provides details about how security technology and features are implemented within Apple platforms. It also helps organizations combine Apple platform security technology and features with their own policies and procedures to meet their specific security needs,” says Apple.

New topics added to the Apple Platform Security guide this year:

Topics that have been updated:

Introduction to Apple platform security
Apple SoC security
Secure Enclave
Face ID, Touch ID, passcodes, and passwords
Facial matching security
Uses for Face ID and Touch ID
Express Cards with power reserve
Operating system integrity
Activating data connections securely
Verifying accessories for iPhone and iPad
System security for watchOS
Passcodes and passwords
Data Protection overview
Keybags for Data Protection
Protecting keys in alternate boot modes
Protecting user data in the face of attack
Managing FileVault in macOS
Intro to app security for iOS and iPadOS
Gatekeeper and runtime protection in macOS
Managed Apple ID security
iCloud encryption
Account recovery contact security
Legacy Contact security
iCloud Keychain security overview
Secure keychain syncing
Escrow security for iCloud Keychain
Card provisioning security overview
Adding credit or debit cards to Apple Pay
Paying with cards using Apple Pay
Apple Card security
Tap to Pay on iPhone security
Access using Apple Wallet
Access key types
IDs in Apple Wallet
Security of IDs in Apple Wallet
Developer kit security overview
HomeKit communication security
Mobile device management security overview
Configuration enforcement

You can download the full 265-page 2024 Apple Security Platforms guide here.

About Security Bite: Security Bite is a weekly security-focused column on 9to5Mac. Every week, Arin Waichulis delivers insights on data privacy, uncovers vulnerabilities, and sheds light on emerging threats within Apple’s vast ecosystem of over 2 billion active devices. Stay secure, stay safe.