3 ms·

But the version signed could check the id of the phone and shut down if not a hard coded id. Yes, it could be installed on any phone, but it would be useless o

by ikeboy 11y ago

But the version signed could check the id of the phone and shut down if not a hard coded id. Yes, it could be installed on any phone, but it would be useless on any other phone. And in order to modify it to work on other phones (even with source code) you'd need Apple's keys.

nacs 11y ago
It'd be easy for anyone to patch memory at runtime to skip over that `if` check on the phone's ID (or at least easier than hacking the phone without the backdoor code). Once the backdoor/exploit is created and released, there's no securing it to where it will only be used on a single phone.
- daeken 11y ago
  If you could trivially patch memory at runtime, they wouldn't need this firmware in the first place -- they'd just patch out the lock-on-fail code. If you assume that the chain of trust is compromised such that memory changes can be made, you own the device.
- moyix 11y ago
  Patching memory at runtime on an iPhone is not in any sense "easy". If it were the FBI wouldn't need Apple's help right now at all; they could just NOP out the code that implements the increasing timeout and erase-on-too-many-failures code. To put it another way – if it were in fact easy to patch memory at runtime, there would be no need for the jailbreak community to spend huge amounts of time and effort every new OS release.
geofft 11y ago
You're right, that's a good point.
- ikeboy 11y ago
  Also, Apple does have the ability to prevent signed updates from being installed on phones they don't want it to be. Every update must be signed by Apple specifically to the phone that's being updated, and this includes a nonce to prevent replay attacks. (I forgot about this in my reply above). See https://en.wikipedia.org/wiki/SHSH_blob https://en.wikipedia.org/wiki/SHSH_blob, https://www.theiphonewiki.com/wiki/SHSH https://www.theiphonewiki.com/wiki/SHSH, http://www.saurik.com/id/12 http://www.saurik.com/id/12

by ikeboy 11y ago

nacs 11y ago

It'd be easy for anyone to patch memory at runtime to skip over that `if` check on the phone's ID (or at least easier than hacking the phone without the backdoor code). Once the backdoor/exploit is created and released, there's no securing it to where it will only be used on a single phone.

daeken 11y ago
If you could trivially patch memory at runtime, they wouldn't need this firmware in the first place -- they'd just patch out the lock-on-fail code. If you assume that the chain of trust is compromised such that memory changes can be made, you own the device.
moyix 11y ago
Patching memory at runtime on an iPhone is not in any sense "easy". If it were the FBI wouldn't need Apple's help right now at all; they could just NOP out the code that implements the increasing timeout and erase-on-too-many-failures code. To put it another way – if it were in fact easy to patch memory at runtime, there would be no need for the jailbreak community to spend huge amounts of time and effort every new OS release.

geofft 11y ago

You're right, that's a good point.

ikeboy 11y ago
Also, Apple does have the ability to prevent signed updates from being installed on phones they don't want it to be. Every update must be signed by Apple specifically to the phone that's being updated, and this includes a nonce to prevent replay attacks. (I forgot about this in my reply above). See https://en.wikipedia.org/wiki/SHSH_blob https://en.wikipedia.org/wiki/SHSH_blob, https://www.theiphonewiki.com/wiki/SHSH https://www.theiphonewiki.com/wiki/SHSH, http://www.saurik.com/id/12 http://www.saurik.com/id/12