4 ms·

The point is, it was speculated that if the phone had a Secure Enclave it would be impossible for Apple to meet the FBI's request, but it appears that even Secu

The point is, it was speculated that if the phone had a Secure Enclave it would be impossible for Apple to meet the FBI's request, but it appears that even Secure Enclave phones are vulnerable.

threeseed 11y ago
> but it appears that even Secure Enclave phones are vulnerable What proof is there of this ? Even reports I've heard from people at the White House believe the newer phones are simply not possible for Apple to compromise.
- metric10 11y ago
  This appears to be true. If you look at Page 5 of [1], there's a side note about DFU mode. There's no indication that updating the firmware wipes the secure contents of the device, which it would need to in order to be secure: """ Entering Device Firmware Upgrade (DFU) mode Restoring a device after it enters DFU mode returns it to known good state with the certainty that only unmodified Apple-signed code is present. DFU mode can be entered manually: First connect the device to a computer using a USB cable, then hold down both the Home and Sleep/Wake buttons. After 8 seconds, release the Sleep/Wake button while continuing to hold down the Home button. Note: Nothing will be displayed on the screen when the device is in DFU mode. If the Apple logo appears, the Sleep/Wake button was held down too long. """ [1] https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
  - acdha 11y ago
    That doesn't say whether the Secure Enclave code can be updated, only the main phone OS.
    - metric10 11y ago
      But we agree that the Secure Enclave code CAN be updated, correct? I know that it can, because I remember an iOS update that fixed a problem with Touch ID on my iPhone 5s. If the DFU mode can't do it, then you just need to load an OS that will do it. The only question is, does the existing firmware blank the store keys before flashing the new update. I didn't see any indication that it does.
      - acdha 11y ago
        It seems like it can be updated but it's not clear whether there are any restrictions on that process. It might accept any signed update but that wouldn't be enough if it required Touch ID or the phone to be unlocked to avoid clearing the HSM.
- tlrobinson 11y ago
  Not definitive proof, but a former Apple security engineer suggests it is: https://twitter.com/JohnHedge/status/699882614212075520 https://twitter.com/JohnHedge/status/699882614212075520 A possible mitigation against the "FBI attack" (which I don't know if Apple has implemented), while still allowing SEP firmware updates, would be to have a simple routine in ROM that the SEP always runs upon boot (before running the SEP firmware blob) to verify that as hash of the firmware blob matches the one previously recorded by the SEP. If it doesn't, it could either wipe and update the hash, or refuse to boot until the previous blob is restored. When updating the firmware normally, the SEP would simply verify the user enters their pin before updating the hash. Or simply require pin entry (or wipe) for all DFU firmware updates, which seems like a much safer option.
  - HappyTypist 11y ago
    Yeah, this changes everything. It's concerning, but I feel Apple will most likely implement given recent events.

The point is, it was speculated that if the phone had a Secure Enclave it would be impossible for Apple to meet the FBI's request, but it appears that even Secure Enclave phones are vulnerable.

threeseed 11y ago

> but it appears that even Secure Enclave phones are vulnerable What proof is there of this ? Even reports I've heard from people at the White House believe the newer phones are simply not possible for Apple to compromise.

metric10 11y ago
This appears to be true. If you look at Page 5 of [1], there's a side note about DFU mode. There's no indication that updating the firmware wipes the secure contents of the device, which it would need to in order to be secure: """ Entering Device Firmware Upgrade (DFU) mode Restoring a device after it enters DFU mode returns it to known good state with the certainty that only unmodified Apple-signed code is present. DFU mode can be entered manually: First connect the device to a computer using a USB cable, then hold down both the Home and Sleep/Wake buttons. After 8 seconds, release the Sleep/Wake button while continuing to hold down the Home button. Note: Nothing will be displayed on the screen when the device is in DFU mode. If the Apple logo appears, the Sleep/Wake button was held down too long. """ [1] https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
- acdha 11y ago
  That doesn't say whether the Secure Enclave code can be updated, only the main phone OS.
  - metric10 11y ago
    But we agree that the Secure Enclave code CAN be updated, correct? I know that it can, because I remember an iOS update that fixed a problem with Touch ID on my iPhone 5s. If the DFU mode can't do it, then you just need to load an OS that will do it. The only question is, does the existing firmware blank the store keys before flashing the new update. I didn't see any indication that it does.
    - acdha 11y ago
      It seems like it can be updated but it's not clear whether there are any restrictions on that process. It might accept any signed update but that wouldn't be enough if it required Touch ID or the phone to be unlocked to avoid clearing the HSM.
tlrobinson 11y ago
Not definitive proof, but a former Apple security engineer suggests it is: https://twitter.com/JohnHedge/status/699882614212075520 https://twitter.com/JohnHedge/status/699882614212075520 A possible mitigation against the "FBI attack" (which I don't know if Apple has implemented), while still allowing SEP firmware updates, would be to have a simple routine in ROM that the SEP always runs upon boot (before running the SEP firmware blob) to verify that as hash of the firmware blob matches the one previously recorded by the SEP. If it doesn't, it could either wipe and update the hash, or refuse to boot until the previous blob is restored. When updating the firmware normally, the SEP would simply verify the user enters their pin before updating the hash. Or simply require pin entry (or wipe) for all DFU firmware updates, which seems like a much safer option.
- HappyTypist 11y ago
  Yeah, this changes everything. It's concerning, but I feel Apple will most likely implement given recent events.