3 ms·

What do we think the likelihood is that at least some of the three-letter agencies already have the capability to get into a locked iPhone (likely their method

What do we think the likelihood is that at least some of the three-letter agencies already have the capability to get into a locked iPhone (likely their method would be based on some sort of baseband vulnerability) and this whole thing is simply a bid to gain the ability to openly unlock these phones?

deleted 11y ago
[deleted]
542458 11y ago
Baseband vuln seems likely. Additionally, I've always wondered if the NSA or the like could just decap and read out data (IE: the passcode hash) from the chips. Then again, I'm not a computer engineer and don't really know anything about the physics of all this! EDIT: This paper [1] seems to document such an attack, decapping the chip and reading the memory cells using lasers (although the details are over my head). [1]: https://www.cl.cam.ac.uk/~rja14/Papers/SISW02.pdf https://www.cl.cam.ac.uk/~rja14/Papers/SISW02.pdf
- matt_wulfeck 11y ago
  I think most of us are fine with the government being able to decap our phones and steal data, or at least try. I'm fine with that because It cost money and time and would be difficult for them to do in a massive, dragnet style operation. The idea is once they have the phone they can do whatever they want with it, but they can't go to a manufacturer and force them to weaken the security of _all_ phones because they don't want to do any work.
  - 542458 11y ago
    Yeah, I'm completely fine with that as well - I'm happy to see the NSA do computer-security stuff that isn't this dystopian "monitor everybody all the time" nonsense.
Swannie 11y ago
Such a vulnerability would almost certainly require the phone to be powered on, and for the boot time pin code entered (to allow the phone to decrypt user-space data). It's mechanism of action would be along the lines of reading the PIN code out of memory, trick the user into entering their PIN into a fake screen, read the decryption key out of memory, of make un-authorised calls to decrypt data. In the case that we're all talking about, this capability would be pointless. On the other hand, could a 3rd party create a crack that manipulated the PIN reset counter, in a way similar to that being requested by the FBI? Potentially with the right vulnerability. (Note, I've only skimmed the Apple white paper, so I may be wrong here).
visarga 11y ago
If I was in their place (FBI, NSA) I would infiltrate agents into all the big companies to place hidden vulnerabilities in the code. Some of the employees could be contacted covertly and convinced to "work for their country" and "be real patriots". If they didn't do this, they didn't do their job as spies. The same is true for China and other major powers. There are enough foreign origin people working at these companies to pick from. So, NSA is basically keeping up with everyone else. Even smaller groups/organizations could have a spying system in place. There is no real safety when it comes to information, as long as we use operating systems and software created and compiled by other people. It's just trust that keeps it running.
GBond 11y ago
This topic was brought up by Apple's lawyer during the hearing in support to the theory the FBI's request was more about setting a legal precedent than getting help for this one phone. http://motherboard.vice.com/read/apple-fbi-should-ask-the-nsa-to-hack-shooters-iphone http://motherboard.vice.com/read/apple-fbi-should-ask-the-ns...
forgottenpass 11y ago
For a few weeks Patrick Gray has been saying he has a source(s?) that claim there is a viable attack involving pulling the NAND from the phone, reprogramming it offline and reattaching. We'll have to see if the reverse engineers are able to reproduce and publish, but between this and my overall security cynicism, I lean towards there being a way in but wouldn't be surprised that if the intelligence agencies have it, they're legit not sharing.

deleted 11y ago

[deleted]

542458 11y ago

Baseband vuln seems likely. Additionally, I've always wondered if the NSA or the like could just decap and read out data (IE: the passcode hash) from the chips. Then again, I'm not a computer engineer and don't really know anything about the physics of all this! EDIT: This paper [1] seems to document such an attack, decapping the chip and reading the memory cells using lasers (although the details are over my head). [1]: https://www.cl.cam.ac.uk/~rja14/Papers/SISW02.pdf https://www.cl.cam.ac.uk/~rja14/Papers/SISW02.pdf

matt_wulfeck 11y ago
I think most of us are fine with the government being able to decap our phones and steal data, or at least try. I'm fine with that because It cost money and time and would be difficult for them to do in a massive, dragnet style operation. The idea is once they have the phone they can do whatever they want with it, but they can't go to a manufacturer and force them to weaken the security of _all_ phones because they don't want to do any work.
- 542458 11y ago
  Yeah, I'm completely fine with that as well - I'm happy to see the NSA do computer-security stuff that isn't this dystopian "monitor everybody all the time" nonsense.

Swannie 11y ago

Such a vulnerability would almost certainly require the phone to be powered on, and for the boot time pin code entered (to allow the phone to decrypt user-space data). It's mechanism of action would be along the lines of reading the PIN code out of memory, trick the user into entering their PIN into a fake screen, read the decryption key out of memory, of make un-authorised calls to decrypt data. In the case that we're all talking about, this capability would be pointless. On the other hand, could a 3rd party create a crack that manipulated the PIN reset counter, in a way similar to that being requested by the FBI? Potentially with the right vulnerability. (Note, I've only skimmed the Apple white paper, so I may be wrong here).

visarga 11y ago

If I was in their place (FBI, NSA) I would infiltrate agents into all the big companies to place hidden vulnerabilities in the code. Some of the employees could be contacted covertly and convinced to "work for their country" and "be real patriots". If they didn't do this, they didn't do their job as spies. The same is true for China and other major powers. There are enough foreign origin people working at these companies to pick from. So, NSA is basically keeping up with everyone else. Even smaller groups/organizations could have a spying system in place. There is no real safety when it comes to information, as long as we use operating systems and software created and compiled by other people. It's just trust that keeps it running.

GBond 11y ago

This topic was brought up by Apple's lawyer during the hearing in support to the theory the FBI's request was more about setting a legal precedent than getting help for this one phone. http://motherboard.vice.com/read/apple-fbi-should-ask-the-nsa-to-hack-shooters-iphone http://motherboard.vice.com/read/apple-fbi-should-ask-the-ns...

forgottenpass 11y ago

For a few weeks Patrick Gray has been saying he has a source(s?) that claim there is a viable attack involving pulling the NAND from the phone, reprogramming it offline and reattaching. We'll have to see if the reverse engineers are able to reproduce and publish, but between this and my overall security cynicism, I lean towards there being a way in but wouldn't be surprised that if the intelligence agencies have it, they're legit not sharing.