38 ms·
Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone
- ars 11y ago> Apple ... will probably have little time to debug or test it overall, meaning that this feature it is being ordered to build will almost certainly put more users at risk. Eh? They are not being asked to install it to the public at large, just one phone. Of all reasons to object, this reason makes little sense.
- tptacek 11y agoThat's true. In fact, if it's possible for Apple to accomplish what DOJ is demanding of it, the best outcome would be for DOJ to succeed, and do so publicly: * There is an authentic need to get at the data on that phone * There's no likelihood at all that other users will be impacted by the backdoor * We'll all be on the same page about how secure these phones are versus the USG. It's possible that they can prevail against the 5C but not against the 5S or later, since the security architecture of the 5S is very different from that of the 5C.
- jbapple 11y ago> There is an authentic need to get at the data on that phone What is the authentic need? The shooters are dead. Do we have reason to believe that there is evidence of any pending crimes or any old unsolved crimes on the phone?
- tptacek 11y agoSure, of course that's a legitimate concern: they may have talked to other people planning attacks.
- jbapple 11y ago> they may have talked to other people planning attacks. I'm not particularly concerned with crimes that we believe "may have" occurred. Of course, they may have. Anything may have happened -- I'm asking for more than just correlation that criminals know criminals. Do we have any evidence, or even any hints or clues, that the phone contains evidence that would help solve or prevent any crimes?
- tptacek 11y agoI'm sorry, but I don't understand what you're getting at here. The legitimate concern is prevention of future attacks. They may have collaborated with people who were never apprehended on the attack that actually happened.
- jbapple 11y ago> They may have collaborated with people who were never apprehended on the attack that actually happened. Right, but we don't go searching everyone's papers just in case they are conspirators. If Alice punches Bob in the face, then is hit by a bus and dies, we don't go searching through all of Alice's stuff just in case there might have been someone else involved with the Bob-punching incident, right? Is there any evidence, any at all, that the shooters collaborated with anyone? > The legitimate concern is prevention of future attacks. I'm not questioning the "legitimate concern", but I don't think "legitimate concern" should be sufficient to get a warrant.
- BWStearns 11y agoIf you shoot a bunch of people while declaring allegiance to an organized group known for shooting bunches of people then I think that pretty clearly demonstrates that reading your communications has a pretty high likelihood of turning up something useful in preventing future incidents. If this doesn't clear your hurdle for reasonable search then what would? To be clear, I don't think the order to Apple is necessarily altogether a good idea or is even going to produce the desired results, but your complaint seems to be with the fact that this data is being pursued at all. Edit to reply: > Evidence of a conspiracy would help. You said they declared allegiance to an organized group. When they did that, did they say or hint that they had been in contact with that group, other than, say, watching public YouTube videos? The woman in the couple declared it right before the shooting[0]. Do you want a notarized letter from the deceased? > Would you agree that "high likelihood" is too low a bar for justifying searching the phones of people who live in high-crime neighborhoods? I'm pretty sure neither "high likelihood" nor "authentic need" were being used as a term of art here, but I would bet that any judge would view the commission of murder declaredly for an organized militant group to be probable cause that there is information pertaining to more criminal activity by that group on these two's phones and in their communications. Do you really view this as a government overreach or are you just trolling? Under what circumstances, if any, would you see as justified a search of someone's email? phone? house? So far you've equivocated between living in a bad neighborhood and committing murder-suicide. [0] http://www.nytimes.com/2015/12/05/us/tashfeen-malik-islamic-state.html?_r=0 http://www.nytimes.com/2015/12/05/us/tashfeen-malik-islamic-...
- jbapple 11y ago> reading your communications has a pretty high likelihood of turning up something useful in preventing future incidents Would you agree that "high likelihood" is too low a bar for justifying searching the phones of people who live in high-crime neighborhoods? > If this doesn't clear your hurdle for reasonable search then what would? Evidence of a conspiracy would help. You said they declared allegiance to an organized group. When they did that, did they say or hint that they had been in contact with that group, other than, say, watching public YouTube videos?
- 11y ago
- stevetrewick 11y ago>evidence 14 dead people and a stack of unused guns and bombs.
- tremon 11y agotwo dead attackers, stack confiscated. case closed.
- tptacek 11y agoExactly how do you know that the case is now "closed"? It sounds like you're just making an assumption. The state is too, but the cost of their assumption --- that there is valuable data to gather from the phone --- is very low, and the cost of your assumption, if you're wrong, is immense.
- tremon 11y agoPlease do keep up with the context :) I didn't feel the need to elaborate because my parent thought one word was sufficient, but let me state the full context to my thought process: > > > Do we have reason to believe that there is evidence of any pending crimes or any old unsolved crimes on the phone? > > 14 dead people and a stack of unused guns and bombs. > two dead attackers, stack confiscated. case closed. If the "evidence" for future crimes is merely some dead criminals and the ammunition they didn't get to use, there is no probable cause for further investigation. Hence, the case should be closed.
- tremon 11y agoNice. Next time I'll refrain from explaining myself.
- clay_to_n 11y agoApple will not do that. It's a slippery slope argument - yes, these shooters were very bad, but if Apple sets a precedent of breaking the backdoor for this crime, why can't other courts implore them to use the same technological means for lesser crimes?
- dcposch 11y ago> * There's no likelihood at all that other users will be impacted by the backdoor That could not be further from the truth. They are trying to set a precedent that endangers the future of consumer end-to-end encryption. They are trying to repurpose an 18th-century law (the All Writs law) to force Apple to help them break iPhone encryption. If this case creates precedent, what is to stop them from, say, forcing Signal and Google to work together to deliver a backdoored app update to a specific user? You are not a lawyer. Nate Cardozo, staff attorney at the EFF, had this to say: https://twitter.com/ncardozo/status/699964225737748481 https://twitter.com/ncardozo/status/699964225737748481
- tptacek 11y agoYou and Cardozo are hyperventilating. The DOJ can make this demand because Apple phones of this vintage are already breakable, and the DOJ is merely asking Apple to exercise a capability it already has. Apple knows this, better than most, and has for many years. They have done security design work with governments as an explicit adversary. The 5C was insecure. The 5S is not: it has an entire additional processor, running an incredibly secure OS, whose entire job is to make sure that the phone keeps promises like these even if the DOJ orders Apple to sign bogus updates. Apple is so committed to this that they've extended the "ten tries and you're out" promise all the way through their server infrastructure, so that if you escrow data into iCloud it will be nuked if someone tries to brute force it. Not only that, but after rigging their HSM cluster to operate that way, they burned the update keys, so that an attempt to change that rule will break all of iCloud.
- dcposch 11y agoYou haven't responded to my comment at all. You said: > There's no likelihood at all that other users will be impacted by the backdoor The backdoor, a "master key" as Tim Cook put it, that opens all pre-5S iPhones affects millions of other users. And that's not even the main issue. The issue is the precedent it sets, which endangers a lot more than just a few million users or a few specific models of iPhone.
- CaptSpify 11y agoIt's much more than tha. If they do it "just this once", that means they can allow others to get to encrypted data, despite what they've been claiming all along. It's a very binary situation.
- rburhum 11y agoSo if I get this right, they want to (1) disable the delete feature after x retries (therefore enabling unlimited retries) and (2) enable to submit tries via a connector/wifi, bluetooth (therefore enabling a bruteforce approach). What good is an encrypted filesystem in that scenario?
- danielweber 11y agoPlenty of good if you have a reasonable passphrase and the vendor hasn't been compelled to assist. "Can only try 10 times" isn't anything guaranteed by encryption. My laptop has an encrypted partition, but an attacker can brute-force it at will. Even if I had software to say "only let it happen 10 times, then erase the partition" the whole drive could just be cloned. That's why I have a 20+ character passphrase.
- tptacek 11y agoApple goes way out of their way to avoid scenarios where they can be compelled to subvert iOS security. For instance, see pg44+ of the iOS security white paper: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf ... the HSMs that manage the escrow scheme for credentials stored in iCloud are themselves rigged to blow up on 10 failed tries, and, not only that, but the code that implements that process is burned into the HSMs and the keys Apple would need to change that logic have been destroyed.
- danielweber 11y agoInformative. Thanks!
- niij 11y agoThank you for the link. I was unaware how seriously Apple takes their security. Self-destructing HSMs to avoid brute-forcing is extremely impressive. THIS is a model of how to implement proper key escrow.
- rburhum 11y ago
- tptacek 11y agoRemember, this is an iPhone 5C, which doesn't have Touch ID or the Secure Enclave; the security model for this phone is significantly different from that of more recent iPhones. On phones with a Secure Enclave, the wipe-on-failures state is managed in the coprocessor (which runs L4), and is not straightforwardly backdoor-able. If you're worried about the police brute-forcing your phone, enable Touch ID and set a passcode that is approximately as complex as the one on your computer.
- some_guy_there 11y agoWouldn't Apple (or the manufacturer) know the key of the security enclave?
- ggreer 11y agoNo. From Apple's iOS security guide[1]: > The device’s unique ID (UID) and a device group ID (GID) are AES 256-bit keys fused (UID) or compiled (GID) into the application processor and Secure Enclave during manufacturing. No software or firmware can read them directly; they can see only the results of encryption or decryption operations performed by dedicated AES engines implemented in silicon using the UID or GID as a key. Additionally, the Secure Enclave’s UID and GID can only be used by the AES engine dedicated to the Secure Enclave. The UIDs are unique to each device and are not recorded by Apple or any of its suppliers. ... Integrating these keys into the silicon helps prevent them from being tampered with or bypassed, or accessed outside the AES engine. The UIDs and GIDs are also not available via JTAG or other debugging interfaces. Even for older devices like the iPhone 5C, if the owner chose a good passphrase, I doubt it can be decrypted with Apple's help. 1. From the section on Encryption and Data Protection. Starts on page 10: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
- some_guy_there 11y agoThanks. So only recourse for highly resourced adversary will be to decode key via hardware imaging (not sure if any research has been done on this), and after that they will still have to bruteforce the passphrase used to secure the phone, the effectiveness of which depends on the entropy of passphrase. I wonder what how Apple can help the law enforcement here.
- kevinastone 11y agoWhy wouldn't the FBI just clone the phone disk contents and crack the encryption on more dedicated systems?
- Mandatum 11y agoAre there tools to dump and resume iPhone/Android states? Could easily dump state, null "tryCounter++", and resume cracking?
- yarou 11y agoYou'd probably need a kernel mode debugger.
- deleted 11y ago[deleted]
- superuser2 11y agoThe PIN is an input to the HSM, where the key actually lives. HSMs are designed from the silicon up to resist inspection or modification of internal state. There are certainly no baked-in debugging/JTAG interfaces, and the hardware is designed to blow away the key if the chip is under physical or logical attack.
- deleted 11y ago[deleted]
- X-Istence 11y agoBecause AES is still secure unless the NSA knows something and is not sharing...
- manicdee 11y agoIf I was the NSA, I certainly wouldn't be exposing the fact that I could crack AES for the sake of a trivial (to the NSA) crime like this. What I would do, however, is engineer a situation where the FBI could believably brute force the password, then let them have at it for a few days until I supply them with the actual password. Then the FBI tells the public that the passphrase on the phone was actually something trivially guessable lime 000000.
- yarou 11y agoThey're effectively asking for a backdoor, plain and simple. I'd be highly surprised if Apple complied with this court order. Even if they removed said feature, the only way to decrypt the FS would be if and only if the owner had a weak strength passcode. Can somebody explain to me how this warrant is not a direct violation of this individual's 4th amendment rights? This seems like yet another case where the rights guaranteed by the Constitution are selectively applied based on your skin color.
- jack9 11y ago> Can somebody explain to me how this warrant is not a direct violation of this individual's 4th amendment rights? The person is dead and it's reasonable and the 4th isn't even applicable (depending on the interpretation of "make a backdoor in a product" as opposed to "we're looking at someone's data they own on a device they own"). Even the very liberal interpretation of the 4th doesn't apply here, when the right violation would be the act of accessing the data, not just asking to have a way to look at it. Techdirt is full of fiction by design, so I'm not surprised by the confusion.
- matt_wulfeck 11y agoIf you read the iOS security guide you'll know Apple built the phone in such a way as to wash its hands with these types of request. They'll say it's impossible and they won't be lying. Nothing is ever impossible, but it will be very impractical. The hardware and software is built to ensure this. I think the real game here is to compel Apple to build a backdoor into future models. I expect to see a lot of rhetoric around this fact, until something forces Apple hand.
- rkangel 11y agoThat is possibly true for current models of the iPhone. It is significantly less true for the 5c in question, which has less robust security features. See other answers referring to the Secure Enclave.
- blakecaldwell 11y agoDoes Apple get to bill the FBI for the time that their engineers and legal department will be busy on this request?
- savoytruffle 11y agoYes. In the court order section 5 (on line 8 of page 3) "Apple shall advise the government of the reasonable cost of providing this service." Perhaps only engineering resources. (it's always gonna be a big legal hassle)
- bb88 11y agoA reasonable cost may still be $150 to $200 per hour. Engineering time charged to a third party is never cheap.
- Joof 11y agoYeah. This may end up costing a huge amount with no results. Apple (and it's employees) doesn't have much incentive to crack the device although someone might be curious and use this as a good time to look for security holes on the government's dime.
- EGreg 11y agoI always wondered why more people don't go around bricking iPhones by entering the wrong pin several times. Same goes for any other lockout. Why not do this to someone famous by constantly logging in as them from a botnet?
- emersonrsantos 11y agoOn IOS this would only wipe user data and reset to factory settings, not wipe the entire filesystems.
- X-Istence 11y agoBecause you need physical access to the device to put in a pin?
- mplewis 11y agoThe feature that erases all data after 10 unsuccessful PIN attempts is off by default.
- ascorbic 11y agoI believe there's exponential delays enforced on attempts, so it would take hours to enter 10 incorrect pins. Not something you can do while they're at the bar.
- mchahn 11y agoWhy can't they just pull the flash memory and work on it directly?
- X-Istence 11y agoAES crypto does not lend to easy cracking...
- Karunamon 11y agoProblem becomes harder. The (comparatively weak) passcode gets run through a large number of hashing rounds, which takes about five seconds of real time to complete. The results of that hash are the actual key to a very strong algorithm. It makes more sense to try brute forcing the hash, even with the delay time.
- hardmath123 11y agoRobert Graham (Errata Security)'s notes on this: http://blog.erratasec.com/2016/02/some-notes-on-apple-decryption-san.html#.VsPuiFIq1Ec http://blog.erratasec.com/2016/02/some-notes-on-apple-decryp...
- Myrmornis 11y agoWhy the worry about auto-wiping? Is it not possible to make a copy of the encrypted data and then play around with it as much as you want?
- peeters 11y agoYeah I've got the same question. Is there some hardware safeguard that prevents copying the memory itself? You'd think the first rule of crypto forensics is to work on a copy.
- X-Istence 11y agoEven if there were no such safeguard, you'd still have to break AES encryption...
- greiskul 11y agoThey "just" need to break the users password. If it's a weak one, which is likely for most users, a simple dictionary attack would work.
- deleted 11y ago[deleted]
- X-Istence 11y agoThe users password goes through a password based key derivation function, that function spits out an key that is use for the AES crypto used for the file system. Now, the PBKDF requires a secret that is only stored within the iPhone itself (within the CPU even, where it can't be read out directly). So if we instead grab a copy of the data, all we get is an AES encrypted file system. We have 2 choices. 1. We can attack AES directly, and attempt to brute force the AES key, or 2. We can attempt to get the AES key somehow by bruteforcing the users password. 2 is infinitely simpler compared to 1. However, 2 becomes more difficult (but still less so than just cracking AES itself) when you need to run your brute force guesses through the CPU within the iPhone.
- doggydogs94 11y agoIf Apple can jailbreak the phone in its current state, Apple (or the NSA) may be able to help.
- samfisher83 11y agoCan't they use the dead guys finger print?
- savoytruffle 11y agoThe phone in question is an iPhone 5c that doesn't have a fingerprint sensor. Also even if it did, simply rebooting the device will require a complex passcode instead of a stored fingerprint.
- X-Istence 11y agoTouchID requires passcode after 48 hours.
- zuck9 11y agoAlso, Touch ID measures the blood flow and so doesn't work with disembodied fingers: http://www.engadget.com/2013/09/16/why-a-disembodied-finger-cant-be-used-to-unlock-the-touch-id-se/ http://www.engadget.com/2013/09/16/why-a-disembodied-finger-...
- frogpelt 11y agoWho goes to jail if Apple flat out refuses?
- BWStearns 11y ago...... worst internship ever. 1/5 stars.
- bgentry 11y agoNobody would have to go to jail. They'd hold Apple in contempt and charge them a non-trivial sum of money for every day they refuse. If they continue refusing, the amount increases exponentially until the company is threatened with bankruptcy. In short: they can't refuse without a justified explanation of why they are unable to comply.
- kchoudhu 11y agoAAPL cash reserves as of Jan 2016: 217B. Looks like the judge's district is about to make a metric shit ton of money!
- gambiting 11y agoIn which case the best way to proceed would be to say that they will try to do it and after few months of investigation say the data became corrupted before they even got the phone. Who's going to verify it? No one.
- philip1209 11y agoA thought experiment: Let's say the government makes hardware encryption standards in the style of FedRAMP that sets standards for preventing tampering by foreign governments. Then, imagine that a consumer electronics company voluntarily makes all devices comply with this standard. Could a court attempt to compel the company to defeat the standards which the government set as tamper-proof against governments? A second: What happens if Apple states that it will take a 50-person team with an average annual labor cost of $200K/person approximately 5 weeks to fix the problem with a 50% chance of success. Can Apple bill the court a million dollars to try to fix the issue? A third: Apple open-sources their encryption modules and firmware. They no longer have proprietary information for how to unlock the phone. Are they legally required to be the ones who defeat a system to which they hold no proprietary information? A fourth: The small team that built the system no longer works for Apple. Perhaps their visa was revoked and they left the country, perhaps they were poached by a competitor, or perhaps they retired in the years since this module was published. Who is responsible for complying with the order? A fifth: The data is actually corrupted. Apple presents this conclusion under penalty of perjury after a thousand hours spent on the project, which it requests are compensated. A sixth: Apple requests that trading of its stock is frozen for one month while it expends considerable resources on complying with an unexpected court order relevant to national security.
- Spooky23 11y agoIronically, many .gov organizations are rolling out iPhones by the thousand because of the strong security controls available on the platform.
- ghettoimp 11y agoThis order says Apple must... - bypass the auto-erase feature - enable the FBI to "submit" passcodes - not purposefully introduce additional delays I don't see that this requires Apple to do anything in particular with whatever passcodes the FBI submits. bool tryPasscode (string passcode) { return false; } Reasonable cost of service: $5?
- ncallaway 11y agoJudges are not strict compilers. They will interpret "submit passcodes" to mean what a lay person would read it to mean: if the submitted passcode is correct, the phone will be unlocked. Games like this will get you contempt of court. I don't know if an obstruction of justice charge could come out of this, but I wouldn't test it myself...
- elgenie 11y ago"""To the extent that Apple believes that compliance with this Order would be unreasonably burdensome, it may make an application to this Court for relief within five business days of receipt of the Order.""" If what Apple's security guides claim is true, "unreasonably burdensome" should be an easy standard to meet on practical technical feasibility grounds. The issue is whether they'll want to challenge this on non-technical grounds.
- dplgk 11y agoThe 5th amendment protects evidence inside the brain of the accused. As devices becomes more and more an extension of the brain, the more I think we'll need to adjust the rule of the 5th amendment to cover things outside of the brain.
- radiorental 11y agoI'm having trouble correlating the intent of the law with your suggestion "[No person]…shall be compelled in any criminal case to be a witness against himself" Person/Compelled is key here, not the facts of the case or where they reside.
- dplgk 11y agoSo when technology arises that can scan a person's brain for memories and thoughts, that will be evidence admissible in court?
- radiorental 11y agoIf the person agrees to the scan. I'm not sure you fully understand the law.
- BWStearns 11y agoThink about what we want as a society though. If you did commit a crime, we want to convict you. The reason the 5th protects you from compelled self-incrimination is to prevent unjust interrogation and investigation techniques from the cops[0], not to make the overall likelihood of conviction lower, although it incidentally has this effect. From a policy standpoint the ideal world would be one where all criminals are convicted and no innocents are convicted. In our system we try [see 0 again] to err on the side of letting criminals go rather than convicting innocents. One of the interesting things about the new normal of everything being recorded always and everywhere is how this might change our laws. Laws are supposed to accomplish something, speeding law is supposed to improve road safety for example. If automatic enforcement instead imposes massive taxes on everyone while not improving road safety, society (should) modify the law since it didn't get them to where they wanted to go. Sorry, long winded way of saying, our electronic artifacts aren't really all that different than letters. If I wrote an email to my friend demonstrating premeditation in murdering your puppy, you and everyone else have an interest in that email being valid evidence. That's a wholly separate discussion from the encryption debate. I definitely you're right that we need to think about it but I just wanted to play devils advocate here for why we might want to think twice. [0] Yes, shit still happens, but the system is SUPPOSED to limit these abuses.
- whatwhatwhat999 11y agoUnfortunately, there's no good outcome here. If Apple can unencrypt the phone, it will prove to everyone that backdoors exist. If they can't, and they tell the FBI as much, it will just give politicians more reasons sound off about how we have to have backdoors, because this shooter was a "terrorist" after all, and we just have to suck it up and do whatever is necessary to go after people like that. Either way, we end up with backdoors.
- tannhauser23 11y agoDid you read the article? The court didn't order Apple to decrypt the phone. Instead, Apple has to disable the phone's feature that automatically wipes the hard drive after 10 failed password attempts. This is so that the FBI can brute-force its way into the data.
- whatwhatwhat999 11y agoYes, and that's effectively the same thing. Bypassing controls counts as a "backdoor".
- BinaryIdiot 11y agoBrute forcing a password could take more time, with today's technology, than we have left on Earth depending on complexity and if there are known vulnerabilities. I'm not sure I would effectively consider this order an order to "unencrypt".
- kondro 11y agoPasscodes are only 4 or 6 digits.
- gambiting 11y agoThe encryption key is calculated from your passcode + the AES key etched into the chip inside the phone. There's no way to read that key directly, unless you do some crazy chip imaging where you read the actual electron state of the memory - could be done, but the chance of corrupting that memory is very high, and if they read even one bit wrong then the entire key is useless. So there are two ways to go about this - they can either brute force AES, which, quite simply, can't be done(and I don't mean can't be done with current computers, the number of possible combinations is larger than the atoms in the universe or something stupid like that), unless NSA has a way to crack AES faster(but if they do, they won't make that knowledge public). Or try every passcode combination going through the Apple's full algorithm, which takes about ~5 seconds to generate a key. So it's doable, but it would take some time.
- deleted 11y ago[deleted]
- gizi 11y agoBig problem. People will generally stop using phones of which they suspect that they are back-doored. At the same time, it would be a hopeless endeavour for law enforcement to get a swarm of (Chinese or other Asian) companies to help with unlocking their phones. They would literally not even answer the phone. Therefore, this may very well spell the end of highly centralized, Apple-style companies that can be effectively pressured and browbeaten into "compliance".
- venomsnake 11y agoWhy no one is attacking on hardware level? Cut the processor to get the GID and UID, dump the flash, pregenerate rainbow tables with pin, power flash chip externally and give the codes ... Yeah it is expensive, but I would not be surprised if there aren't such labs that could provide such service. Why does FBI goes trough such pains?
- mediocrejoker 11y agoI would like to know the answer to this also. Maybe there is some sort of booby trap whereby cutting the processor damages the vital data?
- BinaryIdiot 11y agoWhile I'm also curious why this isn't possible (as per everyone else's comments), the phone in question doesn't even have the same level of security so does it even have a dedicated chip with the GID and UID?
- tremon 11y agoAs I've understood from other posts in the thread, you can't reproduce the hardware security module on the chip. It has a unique per-device key that cannot be read out (except perhaps with an electron microscope).
- exabrial 11y agoOk someone murders a bunch of defenseless people... Why is Apple dragging their feet? This is tasteless. I'm NOT for backdoors, but this is ridiculous.
- bbatsell 11y ago> I'm NOT for backdoors I think you've just learned that you are, in fact, for backdoors. A backdoor doesn't become any less of a backdoor when it's only used against bad people.
- exabrial 11y agoNo, don't put words into my mouth. I think Apple should go to some extraordinary means to assist here. Any system is hackable if have physical possession and control over the input.
- feld 11y agoDo you know what a HSM is?
- feld 11y agoDo you know what a HSM is?
- Natsu 11y agoIt's true that we haven't seen perfection yet, but there are tamper-resistant devices where the above is not trivially true. If each device were protecting the same keys or we just needed to break the platform, I might be more inclined to agree, but given that they have individual keys and a failed break could leave the data unobtainable, I'm not so confident. That said, I think this particular phone doesn't have the secure enclave, so it may be breakable here.
- dmak 11y agoIt's more than just that. It's about setting a precedent. If you let the government walk all over your security, then where do you draw the line? What's the point of security at that point? Security doesn't favor good or bad.
- nanocyber 11y agoI thought this was an excellent write-up regarding how the iOS security platform (recent iPhone models) works from someone obviously in the know, as posted in the forums of Apple Insider. (Source: http://forums.appleinsider.com/discussion/191851 http://forums.appleinsider.com/discussion/191851) " Apple uses a dedicated chip to store and process the encryption. They call this the Secure Enclave. The secure enclave stores a full 256-bit AES encryption key. Within the secure enclave itself, you have the device's Unique ID (UID) . The only place this information is stored is within the secure enclave. It can't be queried or accessed from any other part of the device or OS. Within the phone's processor you also have the device's Group ID (GID). Both of these numbers combine to create 1/2 of the encryption key. These are numbers that are burned into the silicon, aren't accessible outside of the chips themselves, and aren't recorded anywhere once they are burned into the silicon. Apple doesn't keep records of these numbers. Since these two different pieces of hardware combine together to make 1/2 of the encryption key, you can't separate the secure enclave from it's paired processor. The second half of the encryption key is generated using a random number generator chip. It creates entropy using the various sensors on the iPhone itself during boot (microphone, accelerometer, camera, etc.) This part of the key is stored within the Secure Enclave as well, where it resides and doesn't leave. This storage is tamper resistant and can't be accessed outside of the encryption system. Even if the UID and GID components of the encryption key are compromised on Apple's end, it still wouldn't be possible to decrypt an iPhone since that's only 1/2 of the key. The secure enclave is part of an overall hardware based encryption system that completely encrypts all of the user storage. It will only decrypt content if provided with the unlock code. The unlock code itself is entangled with the device's UDID so that all attempts to decrypt the storage must be done on the device itself. You must have all 3 pieces present: The specific secure enclave, the specific processor of the iphone, and the flash memory that you are trying to decrypt. Basically, you can't pull the device apart to attack an individual piece of the encryption or get around parts of the encryption storage process. You can't run the decryption or brute forcing of the unlock code in an emulator. It requires that the actual hardware components are present and can only be done on the specific device itself. The secure enclave also has hardware enforced time-delays and key-destruction. You can set the phone to wipe the encryption key (and all the data contained on the phone) after 10 failed attempts. If you have the data-wipe turned on, then the secure enclave will nuke the key that it stores after 10 failed attempts, effectively erasing all the data on the device. Whether the device-wipe feature is turned on or not, the secure enclave still has a hardware-enforced delay between attempts at entering the code: Attempts 1-4 have no delay, Attempt 5 has a delay of 1 minute. Attempt 6 has a delay of 5 minutes. Attempts 7 and 8 have a delay of 15 minutes. And attempts 9 or more have a delay of 1 hour. This delay is enforced by the secure enclave and can not be bypassed, even if you completely replace the operating system of the phone itself. If you have a 6-digit pin code, it will take, on average, nearly 6 years to brute-force the code. 4-digit pin will take almost a year. if you have an alpha-numeric password the amount of time required could extend beyond the heat-death of the universe. Key destruction is turned on by default. Even if you pull the flash storage out of the device, image it, and attempt to get around key destruction that way it won't be successful. The key isn't stored in the flash itself, it's only stored within the secure enclave itself which you can't remove the storage from or image it. Each boot, the secure enclave creates it's own temporary encryption key, based on it's own UID and random number generator with proper entropy, that it uses to store the full device encryption key in ram. Since the encryption key is also stored in ram encrypted, it can't simply be read out of the system memory by reading the RAM bus. The only way I can possibly see to potentially unlock the phone without the unlock code is to use an electron microscope to read the encryption key from the secure enclave's own storage. This would take considerable time and expense (likely millions of dollars and several months) to accomplish. This also assumes that the secure enclave chip itself isn't built to be resistant to this kind of attack. The chip could be physically designed such that the very act of exposing the silicon to read it with an electron microscope could itself be destructive."
- j1vms 11y agoIt's at times like these they're surely knocking on the door of every company whose R&D in quantum computing, information theory and algorithms they've been funding for at least the past 2 or so odd decades. "So, is it ready yet?"
- dmak 11y agoI'm assuming you are referring to quantum computing for it's speed computations? That wouldn't make a different here. They have only X amount of tries before the phone locks them out. It is the number of tries that is the issue here.
- mmel 11y agoFrom my understanding, if you had for example a 128-qbit quantum computer, it would be able to crack any 16 character password in a single operation.
- BinaryIdiot 11y agoIt's not really a single operation though. How would that quantum computer test against an iPhone when each test is a mark against the 10 max test count? An iPhone is still based in standard silicon using bits; you can't exactly pop a process that uses qubits into it and expect it to work.
- misterrobot 11y agoNope. For general search operations (modeling your 128-bit cipher as a black box) the best we know how to do is Grover's algorithm, which gives you a quadratic speed up. Your 128 bit problem is now a 64 bit problem (which is of course still quite good).
- j1vms 11y agoNo, what I am assuming is the company will be compelled to provide the data on the phone without the potential for lock=out or erasure during brute-force. Then, in all likelihood state-of-the-art methods in brute-forcing AES (with the best theoretical speed-up up to and including quadratic due to Grover's algorithm on a quantum computer, or some unknown state-of-the-art slower than that on a classical computer) will be employed until the data is ultimately decrypted.
- gcb0 11y agothis is smoke screen. Purely. they can already desolder the flash memory chips and brute force the data, programatically no less, all they want.
- tlrobinson 11y agoAre you suggesting they can brute force AES-256? iOS's security is quite sophisticated: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
- tzs 11y agoThe article at Errata Security [1] is better. There is an HN submission for it [2], but it hasn't drawn any attention. In particular, it addresses technical issues not covered in the Techdirt article that are relevant to many of the existing comments here on HN. [1] http://blog.erratasec.com/2016/02/some-notes-on-apple-decryption-san.html#.VsPXQ_krIdU http://blog.erratasec.com/2016/02/some-notes-on-apple-decryp... [2] https://news.ycombinator.com/item?id=11115251 https://news.ycombinator.com/item?id=11115251
- headmelted 11y agoFor me, the most interesting question I would have is absent from the article. The court is basically ordering Apple to produce new firmware that doesn't block brute forcing. If Apple were to comply, who keeps this firmware after the fact? There's no mention of this at all, but if the firmware image stays with the FBI then the implications are much more profound with regard to privacy.
- threeseed 11y agoI would bet you all the money in the world that the very second such a firmware image was provided to the FBI it would find its way to the CIA/NSA. All with the assumption of course that the FBI has no rogue agents who work for foreign governments or criminal organisations. Apple is right to be terrified at the thought of being asked to make such a firmware image.
- robk 11y agoExactly this! Once it's in existence somewhere it's immediately part of the NSA/CIA/FBI basic iPhone toolkit.
- chopin 11y ago>The SIF will be coded by Apple with a unique identifier of the phone so that the SIF would only load and execute on the SUBJECT DEVICE. If I understand the cited order correctly the firmware is ordered to be constructed in a way that it runs only on the target phone.
- headmelted 11y agoI do wonder though that had Apple not predicted this exact scenario ahead of time (likely), how would they control this? It's unlikely they can rely on hardware protections to provide this device locking, so is it the case that they would build the unique identifier into the image. Optimistically some obfuscation could help but are the FBI/CIA/NSA really more than a few hops away from opening the binary image in a hex editor and changing it by hand? If Apple firmware images for the iPhone are signed per-device then fine, but is that the case? I don't know this but it seems unlikely to me that a custom device-signed build of iOS happens for every iDevice, and if that's not the case, I can't see how Apple can reliably restrict this with confidence.
- mariuolo 11y agoDo I sound conspiratorial if I suspect this is all PR and NSA has already ways to get around the encryption? It would entice $EVILDOERS to use a compromised platform.
- mineshaftgap 11y agoSounds like the best way to justify hate for both the US and Apple. Pretty far fetched though.
- dschiptsov 11y agoThis is wrong. Engineers who make encrypted devices should do their best to make them undecipherable. This is an universal standard - to do your best. If encryption cannot be broken it means it has been done right, and engineers should have the highest respect. Govts, on the other hand, should use appropriate policies, not orders or force or backdoors.
- SideburnsOfDoom 11y agoSo, Apple says that "the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation." https://www.apple.com/customer-letter/ https://www.apple.com/customer-letter/ If it's possible to make such a "backdoored" build of iOS, then there are state actors who will be throwing $Millions at doing it already, with or without any willing help from Apple.
- ascorbic 11y agoI'm guessing this would need to involve stealing Apple's private code signing key.
- SideburnsOfDoom 11y agoThis is mentioned here: https://news.ycombinator.com/item?id=11116390 https://news.ycombinator.com/item?id=11116390
- tomohawk 11y agoThe phone in question was not owned by the shooter, but by his employer, who has consented to the search. This seems like a poor basis to contest protecting someone's privacy.
- DyslexicAtheist 11y ago>>A magistrate judge, an Apple employee, and an FBI agent agree to meet at a local bar. Only the Apple employee makes it. Why? Because the bar didn't have a back door.
- deleted 11y ago[deleted]
- cant_kant 11y agoThe key parts of the Federal order: "Apple's reasonable technical assistance shall accomplish the following three important functions: (1) it will bypass or disable the auto-erase function whether or not it has been enabled; (2) it will enable the FBI to submit passcodes to the SUBJECT DEVICE for testing electronically via the physical device port, Bluetooth, Wi-Fi, or other protocol available on the SUBJECT DEVICE and (3) it will ensure that when the FBI submits passcodes to the SUBJECT DEVICE, software running on the device will not purposefully introduce any additional delay between passcode attempts beyond what is incurred by Apple hardware. Apple's reasonable technical assistance may include, but is not limited to: providing the FBI with a signed iPhone Software file, recovery bundle, or other Software Image File ("SIF") that can be loaded onto the SUBJECT DEVICE. The SIF will load and run from Random Access Memory and will not modify the iOS on the actual phone, the user data partition or system partition on the device's flash memory. The SIF will be coded by Apple with a unique identifier of the phone so that the SIF would only load and execute on the SUBJECT DEVICE. The SIF will be loaded via Device Firmware Upgrade ("DFU") mode, recovery mode, or other applicable mode available to the FBI. Once active on the SUBJECT DEVICE, the SIF will accomplish the three functions specified in paragraph 2. The SIF will be loaded on the SUBJECT DEVICE at either a government facility, or alternatively, at an Apple facility; if the latter, Apple shall provide the government with remote access to the SUBJECT DEVICE through a computer allowing the government to conduct passcode recovery analysis. If Apple determines that it can achieve the three functions stated above in paragraph 2, as well as the functionality set forth in paragraph 3, using an alternate technological means from that recommended by the government, and the government concurs, Apple may comply with this Order in that way."
- curryhowardiso 11y agoLiterally the one time the west coast would have needed Scalia...
- fab13n 11y agoFortunately for the future, this kind of attack can be thwarted through key stretching (making each attempt intrinsically long to perform, by making it computationally expensive). I expect to see an optional, configurable key stretching setup in future phones, for those whose privacy is worth a couple of seconds' delay when unlocking their phones.
- tosseraccount 11y agoIt's not his phone. He worked for the government It belongs to the government.
- empressplay 11y agoIt bothers me that Tim Cook lied: he stated in his open letter that if they provided the modified OS it could be used on other phones, but the court order specifically says Apple should make the software only work on the specific phone in question.
- Filligree 11y agoWhy do you think he lied? The court order may have said that, but I don't think it's possible.
- cp9 11y agothe second software like this exists that was signed with Apple's release key, the second they can no longer control it
- diabeetusman 11y agoIf it can work with one phone, Apple can easily modify it to work on any phone
- briankwest 11y agoThe headlines keep changing, is it crypto, is it auto-erase, is it a purple unicorn? sheesh lets muddy up the actual issue with incomplete, or inconsistent data. Its the American way!
- kirykl 11y agoThe implications are quite important for future technologies. Neural implants for example. Neural implants are currently used for prosthetics and paralysis. A forced backdoor would kill all research to develop a co-processor directly linked to the brain. Who would want a government backdoor directly to the brain
- zekevermillion 11y agoIf Apple is capable of compromising security on its devices (by using its root key to sign a custom version of iOS, or through some other method), then I see no way that they will avoid eventually being subject to a court order in some jurisdiction that compels this action. If that's true, then device security is already compromised and Apple knows this. Let's say the facts of the case were slightly different, that the FBI "knows" a terrorist attack is about to occur, and Jack Bauer-style demands that Apple assist in compromising a specific device that has the top seekrit plans on it. In that instance, do you think Apple would comply with a warrantless request for cooperation? Hm... Reading Tim Cook's announcement in light of this thought experiment, methinks he doth protest too much! Apple does not have any objection to compromising user security at the root level, and in fact has already done so by creating a device that has some limited vulnerability to malicious action by the manufacturer signed with its root key. (By the way, no doubt every other manufacturer has done worse, so this is not to deprecate Apple vs. any other big company.) I would speculate that Tim Cook's goals with this announcement are largely PR-based, and that the goal of Apple's legal strategy is not to avoid cooperation but rather to retain the ability to decide whether to cooperate, and/or to impose a higher perceived cost on the government for such requests. No doubt Apple is correct to say that once a precedent is established, then it will be widely used by law enforcement even in routine cases. At the end of the day, I am not optimistic that we can avoid a world in which large device manufacturers are compelled (legally and practically) to build security flaws into their devices. Perhaps not the flaw of a back-doored crypto implementation, but other flaws such as those that have been identified in current iOS devices that allow the government (with commitment of sufficient resources) to chip away at some of the more superficial protections.