49 ms·
San Bernardino 5C could be cracked in two days using a NAND flash write blocker. You only need to program an FPGA to buffer writes to NAND chips in RAM instead
by 05 11y ago
San Bernardino 5C could be cracked in two days using a NAND flash write blocker. You only need to program an FPGA to buffer writes to NAND chips in RAM instead of passing them through and to allow the reads, then you just try N PIN codes and reboot while resetting the blocker state cache. N is 4 if they haven't tried any PINs and 1 if there are delays after each because they've tried a couple PINs already. Phone boot time is ~1 minute, T(10000) = 10000 minutes / N (= a week if N==1)
- 13of40 11y agoDo you have a good citation for that or is it just a personal theory?
- mikeash 11y agoApple used to have a bug where they'd report PIN failure before writing that failure to nonvolatile storage. Somebody took advantage of this by building a box that cut power before the write could be performed, allowing a brute force attack: https://www.intego.com/mac-security-blog/iphone-pin-pass-code/ https://www.intego.com/mac-security-blog/iphone-pin-pass-cod... The proposal here is similar, just using a different technique to prevent the write. There isn't any nonvolatile storage besides the flash memory, so if you can reset that then the software has no way of knowing what happened before.
- dr_zoidberg 11y agoThanks for the link, it looks interesting.
- superuser2 11y agoNote that this was patched and is no longer feasible.
- 05 11y agoA personal theory. The iPhone Wiki has a description of iPhone storage structure - it seems newer phones (pre Secure Enclave) don't have separate NOR, NVRAM and NAND - they just use NAND for everything. [1] https://www.theiphonewiki.com/wiki/NOR https://www.theiphonewiki.com/wiki/NOR