4 ms·
Or, China could acquire Apple's signing keys and/or source code through espionage, and then unlock any device -- now, or at any point in the future. We already
by teacup50 11y ago
Or, China could acquire Apple's signing keys and/or source code through espionage, and then unlock any device -- now, or at any point in the future. We already know this occurs:
http://www.nytimes.com/2010/04/20/technology/20google.html http://www.nytimes.com/2010/04/20/technology/20google.html
The backdoor already exists; Apple is just being forced to admit that they designed their security (in this case, the security of the KDF-performing hardware) around the idea that Apple can neither be coerced, corrupted, nor compromised.
Pin numbers are weak passwords, and Apple built tamper-resistant hardware to provide a physical solution to this inherent weakness in the keying process. They also left a door open for themselves to subvert this physical solution in the 5c, and also in later devices with Secure Enclave.
If they hadn't left that back door in place, then the FBI would have nothing to ask for, and Apple wouldn't be an extremely high value target for authorities in states like China. They did leave that door open, however, and whether or not the FBI compels Apple to use it now limited bearing whatsoever on the risk going forward.
- criddell 11y agoWhat exactly is the back door that was left in place? Making the secure enclave firmware writable?
- teacup50 11y agoCorrect; more specifically, leaving the KDF retry enforcement behavior writable on locked devices, and in the case of secure enclave, possibly exposing fingerprint-protected keys themselves to Apple-signed updated firmware.
- pcwalton 11y agoDo you have a source that confirms this? So far everything that I've seen, including the story on Hacker News [1], indicates that we don't know whether the Secure Enclave code can be updated without already knowing the key. [1]: https://www.mikeash.com/pyblog/friday-qa-2016-02-19-what-is-the-secure-enclave.html https://www.mikeash.com/pyblog/friday-qa-2016-02-19-what-is-...
- criddell 11y agoThis doesn't have a link to an Apple source, but it's a little more information: https://www.techdirt.com/articles/20160218/10371233643/yes-backdoor-that-fbi-is-requesting-can-work-modern-iphones-too.shtml https://www.techdirt.com/articles/20160218/10371233643/yes-b...
- 05 11y agoIf you can upgrade a Touch ID enabled iPhone from Recovery Mode (you can), then yes, you can upgrade SE fw without unlocking first.
- pweissbrod 11y agoI believe if you have apple's key you can use this to deploy "updates" to locked phones. If a locked phone is powered on and capable of reaching a network, it will automatically grab the signed updates and run whatever code contained therein. Now I'm not an iphone user and wondering if the auto-update feature can be disabled?
- Crito 11y agoIs there a secure enclave in the 5C? My understanding is that there is not, and that if there was, then what the FBI is requesting simply wouldn't be possible.
- criddell 11y agoYou're right, the 5C has no secure enclave. However, I believe the issue is that phones that do have a secure enclave are still vulnerable because the secure enclave firmware can be updated and basically neutered to the point where the same attack on the 5C works on those phones as well. I think the attack is just a brute force attack.
- Crito 11y agoThe attack is a brute force attack. My understanding is that if a secure enclave is present, then the PIN timeout feature which prevents brute force is implemented in the secure enclave. If the secure enclave did not permit updates, then this logic would be relatively unassailable. But since the 5C has no secure enclave, the PIN lockout logic can simply be overwritten by updating the OS.
- criddell 11y agoI think you and I have the same understanding. Even with no secure enclave, if a user picks a good password (which nobody does on a phone), the security is still unassailable.
- cmurf 11y agoCode signing isn't a backdoor. It's the only door. Coercing or bribing someone into giving up their private key also does not make it a backdoor. But it does violate the explicit promise of code provenance, and thus very broadly and indiscriminately will reduce trust in the entire computing ecosystem, not limited to just Apple.
- codys 11y agoI believe the parent comment was referring to "allowing updates of the OS without requiring either unlock of the device or a wipe of stored data" as the backdoor.