5 ms·

Yep. It's his employer's property. The shooter intentionally destroyed his personal iPhone before the attacks.

by Bud 11y ago

mtgx 11y ago
Which likely means it contains no useful information there. But the FBI wants to use the case to give it one more go at pushing for backdoors. The fact that Apple wanted to keep this private, but the FBI wanted it to be public (which they almost never do in cases where it's about revealing how they hacked into something), just confirms that to me: https://bgr.com/2016/02/19/apple-vs-fbi-iphone-encryption/ https://bgr.com/2016/02/19/apple-vs-fbi-iphone-encryption/
- Spooky23 11y ago
  Maybe not. Government phone in a social services organization without MDM? Holy incompetent batman.
  - joezydeco 11y ago
    Looks like MDM was in effect because the San Bernadino Health Dept remotely changed the iCloud password of the phone after the attack, locking the FBI out of accessing the most recent backup of the phone. http://gizmodo.com/the-san-bernardino-terrorists-icloud-password-was-accid-1760158613 http://gizmodo.com/the-san-bernardino-terrorists-icloud-pass...
    - zaroth 11y ago
      Forgive me if I nit-pick this a bit, as we are probably saying the same thing two different ways. iCloud backups are not protected by your iCloud password. I know this because I've personally reset my password and then successfully recovered an iCloud backup to a new phone with the new password. However, the auto-backup feature, which would have pushed the most recent data from the phone onto iCloud just by leaving the phone powered on... apparently that is disabled when the iCloud password is reset. Which makes sense if you think about it, the phone still has the old iCloud password, and it would need the new password in order to authenticate to iCloud. So they inadvertently disabled the backup feature by locking the phone out of iCloud! The first question this raises is can the auto-backup be made to start working again by Apple changing their backend iCloud authentication code to specifically allow this device to login to iCloud with the "wrong" (old) passsword? That would not involve touching the phone and seems like a much cleaner solution. Unless there is code on the phone which disables or destroys the iCloud authentication token / stored password after encountering a login error, which really would surprise me, because API errors could be spurious, but I guess it's possible if they are looking specifically for an "invalid login" return code and then dumping the old token in order to trigger a UI prompt to enter a new password. The second question is why are the existing backups a month and a half old? Doesn't this imply the device was not even turned on or connected to the network for that last month and a half? The other interesting tidbit in the article you linked is the statement the FBI was able to verify that the phone was never paired with any devices to obtain data. How in the world could they know that?
      - cdcarter 11y ago
        By changing the iCloud password, the device is no longer able to upload a backup to iCloud, since the device doesn't know the new password yet! The new iCloud password IS required to re-enable auto backup, but you need to get past the PIN screen first to enter the new password.
      - Spooky23 11y ago
        I haven't verified this in awhile, but I think that a password reset will log some services out until you enter the new password on the device.
    - Spooky23 11y ago
      MDM doesn't affect the iCloud id, unless the phone is supervised. (In which case this all would be a moot issue) Whomever reset the password took control of the email account or knew the secret questions and reset via a web portal.
- rtpg 11y ago
  >But the FBI wants to use the case to give it one more go at pushing for backdoors. Really? The FBI said it was 100% totally fine with giving the phone to Apple and just having remote access to the phone in this one specific case. That is to say, not having Apple turn over the tools of the trade. I feel like a lot of people here should try to play devil's advocate on this case. I'm (kind of) for Apple in this case, but I think the general representation of the gov't's stated request has been completely morphed from what was asked. The devil's advocate is that this is an Apple PR move. Apple spent a bunch of time trumping up how safe their new phones are against this very thing, and that they even backported most of it. But the fact is that Apple _can_ install a backdoor without even requiring the phone PIN code! On the older phones at least. The FBI asked for the contents, not the tool to get the contents. A thing that has been mentioned elsewhere, but: by fighting this case (a single phone unlock with a specific warrant), we are mixing this case with the more dangerous and important fight of having backdoor laws be codified. As it stands, Apple _can and should_ make the most un-backdoorable phones possible. Legislation that could be enacted because of this fight could make us lose the war on the right to not have backdoors. The fact is that the iOS update mechanism _is already a_ backdoor. Which exists for many reasons (and, to my understanding, is already mostly fixed by asking for a PIN code when updating now).
  - sehugg 11y ago
    The FBI said it was 100% totally fine with giving the phone to Apple and just having remote access to the phone in this one specific case. It's really up to the court to decide that, and this post makes the argument that it may not be possible to keep the tools under wraps if the case progresses: http://www.zdziarski.com/blog/?p=5645 http://www.zdziarski.com/blog/?p=5645
    - rtpg 11y ago
      Thanks for that read. The amount of validation required for the tool to be used in court seems to really cause the danger of a leak to go sky high... I think the DoJ might be discounting that risk with their reasoning of "Apple can just delete it" As an aside, I find it funny that the author finds it "stupid" that the jury is allowed to ask questions in a California court. I would almost declare that a constitutional right (judged by a jury of the peers)
stordoff 11y ago
I hadn't really looked at the details, because the fundamental question of "Can the courts compel work/backdoors from Apple?" is much more important IMO, but this really makes it feel like a fishing exercise from the FBI. Though possible, the chance that the attackers used an employer-owned phone to discuss/plan/coordinate the attackers seems rather remote if they a) had personal phones, and b) took the time to destroy them.
- blazespin 11y ago
  It's not a fishing exercise at all. It's a "let's prove that we can create a backdoor for further use" exercise.
- crimsoneer 11y ago
  It's going to be a brave ass FBI agent who says "well, we didn't bother to try to access this phone because he probably didn't use it".

Yep. It's his employer's property. The shooter intentionally destroyed his personal iPhone before the attacks.

by Bud 11y ago

Yep. It's his employer's property. The shooter intentionally destroyed his personal iPhone before the attacks.

mtgx 11y ago

Which likely means it contains no useful information there. But the FBI wants to use the case to give it one more go at pushing for backdoors. The fact that Apple wanted to keep this private, but the FBI wanted it to be public (which they almost never do in cases where it's about revealing how they hacked into something), just confirms that to me: https://bgr.com/2016/02/19/apple-vs-fbi-iphone-encryption/ https://bgr.com/2016/02/19/apple-vs-fbi-iphone-encryption/

Spooky23 11y ago
Maybe not. Government phone in a social services organization without MDM? Holy incompetent batman.
- joezydeco 11y ago
  Looks like MDM was in effect because the San Bernadino Health Dept remotely changed the iCloud password of the phone after the attack, locking the FBI out of accessing the most recent backup of the phone. http://gizmodo.com/the-san-bernardino-terrorists-icloud-password-was-accid-1760158613 http://gizmodo.com/the-san-bernardino-terrorists-icloud-pass...
  - zaroth 11y ago
    Forgive me if I nit-pick this a bit, as we are probably saying the same thing two different ways. iCloud backups are not protected by your iCloud password. I know this because I've personally reset my password and then successfully recovered an iCloud backup to a new phone with the new password. However, the auto-backup feature, which would have pushed the most recent data from the phone onto iCloud just by leaving the phone powered on... apparently that is disabled when the iCloud password is reset. Which makes sense if you think about it, the phone still has the old iCloud password, and it would need the new password in order to authenticate to iCloud. So they inadvertently disabled the backup feature by locking the phone out of iCloud! The first question this raises is can the auto-backup be made to start working again by Apple changing their backend iCloud authentication code to specifically allow this device to login to iCloud with the "wrong" (old) passsword? That would not involve touching the phone and seems like a much cleaner solution. Unless there is code on the phone which disables or destroys the iCloud authentication token / stored password after encountering a login error, which really would surprise me, because API errors could be spurious, but I guess it's possible if they are looking specifically for an "invalid login" return code and then dumping the old token in order to trigger a UI prompt to enter a new password. The second question is why are the existing backups a month and a half old? Doesn't this imply the device was not even turned on or connected to the network for that last month and a half? The other interesting tidbit in the article you linked is the statement the FBI was able to verify that the phone was never paired with any devices to obtain data. How in the world could they know that?
    - cdcarter 11y ago
      By changing the iCloud password, the device is no longer able to upload a backup to iCloud, since the device doesn't know the new password yet! The new iCloud password IS required to re-enable auto backup, but you need to get past the PIN screen first to enter the new password.
    - Spooky23 11y ago
      I haven't verified this in awhile, but I think that a password reset will log some services out until you enter the new password on the device.
  - Spooky23 11y ago
    MDM doesn't affect the iCloud id, unless the phone is supervised. (In which case this all would be a moot issue) Whomever reset the password took control of the email account or knew the secret questions and reset via a web portal.
rtpg 11y ago
>But the FBI wants to use the case to give it one more go at pushing for backdoors. Really? The FBI said it was 100% totally fine with giving the phone to Apple and just having remote access to the phone in this one specific case. That is to say, not having Apple turn over the tools of the trade. I feel like a lot of people here should try to play devil's advocate on this case. I'm (kind of) for Apple in this case, but I think the general representation of the gov't's stated request has been completely morphed from what was asked. The devil's advocate is that this is an Apple PR move. Apple spent a bunch of time trumping up how safe their new phones are against this very thing, and that they even backported most of it. But the fact is that Apple _can_ install a backdoor without even requiring the phone PIN code! On the older phones at least. The FBI asked for the contents, not the tool to get the contents. A thing that has been mentioned elsewhere, but: by fighting this case (a single phone unlock with a specific warrant), we are mixing this case with the more dangerous and important fight of having backdoor laws be codified. As it stands, Apple _can and should_ make the most un-backdoorable phones possible. Legislation that could be enacted because of this fight could make us lose the war on the right to not have backdoors. The fact is that the iOS update mechanism _is already a_ backdoor. Which exists for many reasons (and, to my understanding, is already mostly fixed by asking for a PIN code when updating now).
- sehugg 11y ago
  The FBI said it was 100% totally fine with giving the phone to Apple and just having remote access to the phone in this one specific case. It's really up to the court to decide that, and this post makes the argument that it may not be possible to keep the tools under wraps if the case progresses: http://www.zdziarski.com/blog/?p=5645 http://www.zdziarski.com/blog/?p=5645
  - rtpg 11y ago
    Thanks for that read. The amount of validation required for the tool to be used in court seems to really cause the danger of a leak to go sky high... I think the DoJ might be discounting that risk with their reasoning of "Apple can just delete it" As an aside, I find it funny that the author finds it "stupid" that the jury is allowed to ask questions in a California court. I would almost declare that a constitutional right (judged by a jury of the peers)

stordoff 11y ago

I hadn't really looked at the details, because the fundamental question of "Can the courts compel work/backdoors from Apple?" is much more important IMO, but this really makes it feel like a fishing exercise from the FBI. Though possible, the chance that the attackers used an employer-owned phone to discuss/plan/coordinate the attackers seems rather remote if they a) had personal phones, and b) took the time to destroy them.

blazespin 11y ago
It's not a fishing exercise at all. It's a "let's prove that we can create a backdoor for further use" exercise.
crimsoneer 11y ago
It's going to be a brave ass FBI agent who says "well, we didn't bother to try to access this phone because he probably didn't use it".