7 ms·
Once you've changed the device id check code, you'd still need to sign it again if you wanted to distribute it widely
by fidget 11y ago
Once you've changed the device id check code, you'd still need to sign it again if you wanted to distribute it widely
- theoh 11y agoIs it possible to change a phone's device id to match the initial target, though?
- KMag 11y agoI believe the FBI is suggesting that Apple tie the update to the phone's IMEI, which I believe phone thieves routinely change by desoldering and replacing a chip.
- ryanlol 11y agoApple firmware updates are signed on a per-install basis.
- ryanlol 11y agoNot sure why this got downvoted, I'm not too familiar with iOS but AFAIK this is exactly how the SHSH system works with the modern iPhones. Quick googling seems to support this.
- KMag 11y agoI didn't downvote you, but I think you're being downvoted because the information content isn't much more than "but cryptography something something!" I mentioned that the most common method for uniquely identifying a handset (the IMEI) can be changed by switching a chip on the iPhone's main board. (At least this was true 6 years ago.) So, unless Apple uses an interactive signature scheme or prevents the FBI/intelligence agencies from ever seeing the signature (using TLS with hard-coded certs), then the signature can be replayed. If the signature can be replayed, then in order to prevent FBiOS being used on multiple phones, it must be tied to one or more unique identifiers, probably excluding the IMEI. Many people understood my post as shorthand for the above. Responding to this with "[But] Apple firmware updates are signed on a per-install basis." doesn't add to the conversation unless you provide further details. At least, that's my best guess as to why you've been downvoted.
- ryanlol 11y ago>I mentioned that the most common method for uniquely identifying a handset (the IMEI) can be changed by switching a chip on the iPhone's main board. (At least this was true 6 years ago.) https://www.theiphonewiki.com/wiki/ECID https://www.theiphonewiki.com/wiki/ECID Firmware updates use this, not IMEIs. And I think the IMEI is more commonly used to identify the radio, not the device itself. But I could be wrong about that. >So, unless Apple uses an interactive signature scheme or prevents the FBI/intelligence agencies from ever seeing the signature (using TLS with hard-coded certs), then the signature can be replayed. Every time you update an iPhone it generates a nonce, called APTicket. Apple signs that, your ECID and the firmware. The nonce essentially makes replay attacks impossible, even if you managed to swap a devices ECID.
- KMag 11y agoThanks for the research! If they're signing the ECID using an interactive signature algorithm, then it sounds like they've thought it through pretty well. > And I think the IMEI is more commonly used to identify the radio, not the device itself. Across manufactures, I'm not sure another quasi-unique identifier in common use. > Every time you update an iPhone it generates a nonce, called APTicket. Apple signs that, your ECID and the firmware. This is one variant of interactive signature scheme.
- jonlucc 11y agoYes, but that is not nearly the same burden as actually writing the compromised OS. It's probably as easy to compel them to sign the update as it is to compel them to turn over iCloud data.
- marssaxman 11y agoSure, but once the FBI has forced Apple to write the code, forcing them to update the device ID and sign the new build is trivial by comparison, which means that breaking into any random iPhone will become routine.
- kenshaw 11y agoThey could easily request the device signing keys via a different case or again using the all-writs act stating that it's necessary for whatever. Not turning over the encryption/signing keys would be followed up with jail time / contempt of court charges for any officers/developers/etc refusing to remand the keys into federal custody.