14 ms·
U.S. Says It May Not Need Apple’s Help to Unlock iPhone
- deleted 11y ago[deleted]
- georgespencer 11y agoOne of three things is true: 1. The FBI is lying to save face, 2. Someone -- but probably needs to be some people -- from Apple is willing to help them, 3. There is an undisclosed vulnerability in iOS which Apple is unaware of. I find it really hard to believe that someone would disclose a zero day exploit to the FBI without charging significant $ for it. Am I missing something obvious?
- Nadya 11y ago>Am I missing something obvious? John McAfee did promise to do it for free. /½ s The guy is eccentric but I don't think he's an idiot and I do think he is likely talented, or at least rich enough to hire those who are. That being said - he admits he was full of shit [0] and then claims that he has a proper method that isn't full of shit but which he didn't want to disclose. Chances are he's probably full of shit on that one too, given the track record, but who knows? [0] http://www.dailydot.com/politics/john-mcafee-lied-iphone-apple-fbi/ http://www.dailydot.com/politics/john-mcafee-lied-iphone-app...
- tptacek 11y agoHe is an eccentric idiot. I am just enough not of an idiot not to bet my shoe for dinner that he had nothing to do with this, but I'm really close. If I had smaller feet, I'd take that bet.
- WalterSear 11y agoI'm a size 8 and willing to let you eat one from my pair of favourite shoes, if that is more amenable. But of course, only if The Most Interesting Douchebag In the World™ is even remotely involved.
- chejazi 11y agoEarlier, he claimed he would use social engineering to unlock it, not some technical hacking [1]. Much more believable in my opinion. But the timestamp on the parent's article makes me skeptical that that proposal stood much ground. [1] http://www.businessinsider.com/john-mcafee-ill-decrypt-san-bernardino-phone-for-free-2016-2 http://www.businessinsider.com/john-mcafee-ill-decrypt-san-b...
- duskwuff 11y agoIn a later statement, McAfee explained that he'd do it in "a half an hour" by finding the location in flash where the passcode is stored. (Never mind that the passcode is used as an encryption key, not as a password.) http://arstechnica.com/security/2016/03/john-mcafee-better-prepare-to-eat-a-shoe-because-he-doesnt-know-how-iphones-work/ http://arstechnica.com/security/2016/03/john-mcafee-better-p...
- devsquid 11y agoMcAfee is a confirmed idiot man. He's just rich, so people admire him for some dumb reason.
- deleted 11y ago[deleted]
- brian-armstrong 11y agoI am guessing they caught wind of possibly losing the case and don't want the precedent set. That's what this was always about, right?
- tomschlick 11y agoThats my guess. They are waiting for another "golden" case to use.
- tlrobinson 11y agoYup, FBI wants a do-over next time one of the "Four Horsemen of the Infocalypse"[1] emerges. 1. https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalypse https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...
- rewrew 11y agoYup, and they've been called out on it, too, by others in the government even: http://arstechnica.com/tech-policy/2016/03/former-cyber-czar-says-nsa-could-crack-the-san-bernadino-shooters-phone/ http://arstechnica.com/tech-policy/2016/03/former-cyber-czar...
- ThrustVectoring 11y agoIt's weird that the offer to help was publicized before any solicitation for offers to help. Assuming that number 3 is the case, that ups the likelihood that the exploit is coming from a government insider (likely NSA, although ex-government security researchers are also likely).
- viraptor 11y agoAre you saying that if you were happy to work with them and had the ability to crack that iphone, you wouldn't get in touch with them? You can pretty much set the terms in that case. Everyone knows about this case already, so they don't need to explicitly ask.
- RichieAHB 11y ago4. They don't want to allow precedents to be set that aren't the precedents they were looking for.
- theintern 11y agoCould you elaborate on what you mean here?
- ParadoxOryx 11y agoThey don't want to lose and have a precedent set that doesn't allow them to do what they want.
- RichieAHB 11y agoThis is exactly what I mean.
- Bluestrike2 11y agoThe issue was never that the magistrate judge would be setting the precedent. No matter who prevailed, there is going to be an appeal and that's when precedent would be set. Even at that point, a negative ruling wouldn't necessarily be an insurmountable problem for the FBI as it wouldn't be binding until the issue has been decided by higher authority. It could still be cited as an example of persuasive authority (i.e. something other courts may follow) before then, but that's not the same as being binding. So the FBI would have a lot of time before they had to worry about the consequences of a negative ruling, and they could drop the matter well before any precedent was set. Apple is in a trickier situation, in that once they've done the work, it becomes more likely that they'll face additional demands in other courts, or--and this is the worst case scenario--a few boneheaded legislators try to pass legislation on this issue. They've got a lot less room to work in, so if they could make this go away in front of a district magistrate without ever having to worry about setting any precedent (even if in their favor), they probably would. 0. http://www.law.georgetown.edu/academics/academic-programs/legal-writing-scholarship/writing-center/upload/which_court_is_binding_painter-and-mayer-final.pdf http://www.law.georgetown.edu/academics/academic-programs/le... 1. http://faculty.law.lsu.edu/toddbruno/mandatory_v__persuasive.htm http://faculty.law.lsu.edu/toddbruno/mandatory_v__persuasive...
- deleted 11y ago[deleted]
- tptacek 11y ago(3) isn't at all implausible.
- blinkingled 11y agohttps://support.apple.com/en-us/HT206166 https://support.apple.com/en-us/HT206166 Given the existence of these is disclosed now and the suspect's iPhone can be prevented from auto updating I think the FBI will have an easier time attacking it? Looking at the first one itself they might just have to attach a malicious USB device to execute arbitrary code.
- btilly 11y agoMy money is on #3. While it is likely true that nobody will give zero days to the FBI without charging, it is also basically certain that the NSA has a collection of them. And the NSA has enough interest in this problem, and enough willingness to share with the FBI, that that may be a tractable solution. Furthermore the FBI certainly doesn't want to create a precedent they don't like, and the fact that we're only in this situation thanks to THEIR incompetence is not helping them.
- lisper 11y agoIt's not an undisclosed vulnerability. The iPhone 5 is not particularly difficult to crack. It requires mucking with the hardware, but a skilled amateur could do it.
- mikeash 11y agoMaybe they're willing to consider attacking the hardware now. If you desolder the flash memory then you can bypass the brute force limitations. Just block writes, or equivalently back up the contents and reload them, and the device has no way of knowing that you previously tried any passcodes. This will allow you to make perhaps 2-5 attempts per minute, which worst case will take three or four days to brute force a four-digit passcode.
- r00fus 11y ago4. Someone from NSA with easy access to the serious tools needed to decap the chip - became available (remember, this is a 5C, so no secure enclave).
- jonknee 11y agoThat's almost certainly not it because it destroys the chip in the process and if the key isn't recovered the data is forever locked (even with Apple's best assistance). > “Testing is required to determine whether it is a viable method that will not compromise data on Farook’s iPhone,”
- jsolson 11y agoSure, there's an extremely well known vulnerability in the iPhone 5C hardware. Lacking the features introduced in later ARM releases it has an unsecured AHB or AXI bus allowing any device that can connect to perform arbitrary DMA (which can in turn allow arbitrary code execution). It would require a certain degree of technical sophistication to execute that attack, but the resources required would be well within the reach of a state-level investigative service.
- f47h3r 11y agoDo you have a link to the paper? I have a friend that was commenting about something similar the other day, but he couldn't find the sauce.
- gpm 11y agoThe ACLU showed a plausible path forward by just desoldering the storage and just rewriting it and trying again when the phone wipes it. John McCafee and others (ex US govt officials IIRC) have mentioned decapping as a serious option for the NSA. Snowden and Richard Clarke (advisor to bush on cyber security, advisor to Bill Clinton on counter terrorism, etc) have said the NSA has ways without being specific about how. I don't think this counts as a serious vulnerability. If you have access to the kind of hardware and technical ability the US govt does, Apple probably isn't too concerned about you being able to break one phone at a time with significant effort involved.
- jamesrom 11y agoWho said they aren't paying for the exploit?
- Balgair 11y agoHanlon's Razor: "never assume malice when stupidity will suffice" The possibility that the Bureau is just plain dumb is not on your list. They are on record, many times, and in front ofa very serious congress, being very very stupid. Though I do not believe they are being stupid here, the possibility is not an edge case and should be considered.
- tux1968 11y agoPerhaps the FBI has long had an exploit and this is all just an elaborate ruse to make unsuspecting targets feel safe using iPhones. Quite unlikely, but it's in the realm of possibilities.
- msmith 11y agoIt doesn't even have to be an undisclosed vulnerability. iOS 9.3 was released today and included several fixes to vulnerabilities which allowed arbitrary code execution, including one with "kernel privileges" [1] Now that these vulns are out in the open, maybe someone has offered to help the FBI use them to gain access to the phone. [1] https://support.apple.com/en-us/HT206166 https://support.apple.com/en-us/HT206166
- deleted 11y ago[deleted]
- bcook 11y agoThey could just contact geohot... In some ways I suspect that the FBI's arguments are a smoke-screen to keep us from talking about the fact that unknown 0-days exist and perhaps the NSA even has a few.
- tptacek 11y agoHow could anyone who pays attention to modern computing not understand that zero-days exist? How can anyone who knows what the NSA is not think that they stockpile them? I will clue you in: NSA has a lot of vulnerabilities vendors don't know about.
- TillE 11y agoIt's not a very good smoke screen, since the most probable interpretation of the filing is that the NSA has an exploit. At least one security expert reported they were rebuffed by the FBI when they offered to help, so I seriously doubt the "outside party" is outside the government.
- a3n 11y ago> It's not a very good smoke screen, since the most probable interpretation of the filing is that the NSA has an exploit. I've wondered if the NSA already had the phone cracked, and Apple's help was just parallel construction to not reveal capabilities.
- BashiBazouk 11y agoCould the NSA crack the phone in a way that Apple engineers would not be able to tell the phone had been cracked?
- bcook 11y agoPresuming that we are unaware of the NSA's capabilities, the answer must be "yes".
- valine 11y agoSo basically they're saying, "This isn't going according to plan. Let's wait for another opportunity and try again."
- Johnny555 11y agoAnd lets screw over Apple by claiming that we can crack the phone after Apple claims that no one can. We'll never have to prove it, so we win, Apple loses.
- enraged_camel 11y agoI don't think anyone (who matters) is particularly inclined to trust the government over Apple, though.
- jsolson 11y agoYeah, but, they're actually telling the truth here, right? The iPhone 5C has an unsecured AHB or AXI bus. You can inject arbitrary code via DMA and trigger and interrupt to cause it to run. This went away with TrustZone (present in ARMs with a secure enclave including later iPhones).
- Avenger42 11y agoI don't think Apple has claimed no one can crack the phone. That's not what this case was about.
- Johnny555 11y agoThere's a big difference between the actual details of the case (which few outside of the technology fields understand) and the public perception of the case. To the public, it was: FBI: We need Apple to hack this terrorist's phone Apple: We could, but we won't"
- PhasmaFelis 11y agoThis is gonna get spun as "Apple wanted the phone uncracked, FBI cracked it, FBI wins," but that's not accurate: what Apple wanted was not to be forced to crack the phone themselves. If the FBI backs off on that, Apple has unequivocally won.
- deleted 11y ago[deleted]
- exabrial 11y agoThis is the outcome I was hoping for... Apple is not weakening their products and the USA is getting intel. I would probably bet theyre getting in via an exotic side channel attack of some sort to spy on the keys.
- fredgrott 11y agoa greater concern is the NSA data hook that NSA is using to press any US agency to mount court cases to support NSA's destroy encryption agenda...
- nostromo 11y agoI suspect that the intelligence and law enforcement communities are afraid that if this case goes to the Supreme Court the All Writs Act may be scaled back or ruled unconstitutional. The All Writs Act goes back to 1789 and is used for all sorts of things, like wire tapping, obtaining call and ISP records, etc., and now trying to force Apple to make malware for their own phone. It's definitely a risk for the FBI to fight this battle and potentially lose a tool they use all the time. Since there is probably no new info on the phone, it may not be worth the risk of making this a big fight with a motivated and well-financed adversary like Apple.
- cturner 11y agoI assume they are not particularly interested in the phone itself. Rather, that they have been shopping for a situation with the character of this one so as to try their luck at pushing their capture rights.
- sixothree 11y agoDon't worry, one will arise.
- r00fus 11y agoSo why did they push it so far? Was it really just a game of chicken where the FBI wanted to stare down Apple?
- jonknee 11y agoIt's a game they have never lost before, it doesn't seem so far fetched. Apple pushed back hard.
- DanBC 11y agoThis one time, this specific case, Apple pushed back. They need to be commended for that, but let's not forget all the other times (and there are very many) when they (and all tech companies) just handed over the data when given a valid warrant.
- rubyfan 11y agooh no what about that "dormant cyber pathogen" ?!?!?
- jacquesm 11y agoCold feet or technology?
- marcoperaza 11y agoThere's a lot of cynicism in this thread. Would you prefer that they try to force Apple's hand anyway, even though they might have found another way that makes the issue moot?
- jacquesm 11y ago> Would you prefer that they try to force Apple's hand anyway, even though they might have found another way that makes the issue moot? Yes, very much so. That way we can put this behind us rather than to wait for the inevitable re-run with conditions carefully arranged to be more favorable in order to set precedent.
- marcoperaza 11y agoTheir legal reasoning heavily relies on Apple being the only party capable of assisting with unlocking the phone. They are talking about compelling someone, so if there's a possibility that it's not necessary, they have a duty to find out. Also, US courts don't rule on abstract ideas or hypothetical cases. No "case or controversy", no judicial standing. If the FBI can unlock the device without compelling Apple, there's no controversy since the FBI agrees Apple wouldn't be required to help in that case.
- jonknee 11y agoThey went to a great deal of effort to start this case, it would be preposterous if they hadn't exhausted other routes beforehand. They're quite obviously backing away from it on purpose.
- jacquesm 11y agoYes, but that line of reasoning requires you to believe this was about the phone's contents to begin with and it would take a serious act of suspension of disbelief to go down that particular road with what's known about this whole sordid affair to date. It's simply the FBI using a crisis to attempt to expand their powers. See also: http://www.npr.org/2016/03/14/470347719/encryption-and-privacy-are-larger-issues-than-fighting-terrorism-clarke-says http://www.npr.org/2016/03/14/470347719/encryption-and-priva...
- nness 11y agoI've always wondered what the FBI really expected to find on the phone, and more importantly, whether what they find will be worth the publicity and debate. If they find nothing, the perceived motive that they just wanted a backdoor more than the device's data would feel all but confirmed.
- ChuckMcM 11y agoI suspect this is a "Strategic Retreat" on the Justice department. The ability to reflash the phone and avoid triggering the unlock erase was a pretty obvious workaround. So after investing a lot of time and money in trying to get case law to expand the DoJ's power over corporations to conscript them into the War on the 4th Amendment, it become possible that they would see a judgement against them (especially if the Supreme court becomes more liberal with the next appointment). So I suspect the risk/reward outcomes of pushing this to a conclusion flip flopped into more risk than reward and someone fairly high up said, "Ok kill this whole effort before it makes things worse than they are." Just an opinion of course but I think it fits the observed actions.
- Johnny555 11y agoSupposedly it's not possible to reflash the phone without the new code being signed by Apple, which is why the FBI needed Apple to do it in the first place.
- KMag 11y agoThe GP isn't talking about flashing an unsigned image. They're talking about physically connecting to the NAND flash chip, making a disk image, and then every 9 attempts, resetting the state of the flash back to its initial state. The image as the phone currently exists is already signed by Apple, so no cooperation from Apple is necessary. The major weakness with this model of iPhone is that it keeps the number of failed attempts stored in the NAND flash, not on the CPU die, and is therefore vulnerable to having its state reset like this. It's a fairly obvious attack that the FBI must have known about, but failed to mention in order to try and set precedent.
- pfooti 11y agoPrecisely - this seems (or seemed originally) like a best-case scenario for Justice: it's a terrorist's iPhone, rather than a drug dealer's or some other "lesser" criminal's, where the public's fear might not be on the side of the FBI. It definitely feels like fishing for a precedent for other phones (especially the later models where this attack isn't feasible).
- deleted 11y ago[deleted]
- lmcd 11y agoHere's one approach you could use if you had a reliable zero-day at your disposal. I've been out of the jailbreak scene for a while, so I might be way off the mark: 1) Have zero-day ([0]) that can be used to deliver executable payload over SMS (think Stagefright). iOS devices can receive text messages before the filesystem is decrypted. Perhaps Apple should close this vector. 2) Deploy dylib that patches the SpringBoard UI (where the lock screen lives), disabling the code that counts incorrect passcode attempts 3) Brute force the passcode [0] http://www.wired.com/2015/11/hackers-claim-million-dollar-bounty-for-ios-attack/ http://www.wired.com/2015/11/hackers-claim-million-dollar-bo...
- jamesrom 11y ago> Perhaps Apple should close this vector. Perhaps. However, it's very likely that receiving SMS before decryption is not a bug, but a feature.
- geekam 11y agoCan someone explain to me why is it wrong (cynical) to think they didn't have this capability all along?
- zaroth 11y agoIt's not, and they did. What I don't understand why so-called "reporters" are regurgitating the blatant trash from "unnamed FBI sources" as if it's fit to print. I would hope at least to see front page NYT and WP editorials blasting the FBI for their obvious failed attempt here to capitalize on a mass murder for their own legal/policy purposes. A few weeks ago they couldn't figure out how to unlock the phone, when it's blatantly obvious the security weaknesses of the 5c, and today they suddenly have seen the light but it just needs more testing? Department of Homeland Security has been funding research into NAND-blockers for at least 6 years now. In a fair and adversarial system, the court would somehow sanction the FBI for their prior sworn testimony that they couldn't do this themselves. But of course when Federal agents lie under oath, it's not a crime, just a misunderstanding.
- ipsin 11y agoIs it possible that Apple could file for a declaratory judgement with respect to the All Writs Act, to remove the potential of the government filing substantially the same request at a later date? Until that happens, it seems like a very real risk to Apple's security claims.
- guscost 11y ago> On a conference call with reporters late Monday, a law enforcement official ... said the case was never about setting a precedent, but only about getting information from a dead terrorist’s phone Pure 100% unpasteurized bullshit.
- la6470 11y agoReally I think Apple should be treated as a hostile agency operating in this country.Most countries in the world would. Sometimes one should get off their high horses.
- studentrob 11y agoBeautiful. Congrats to the DOJ for seeing the light. Will Obama now stop seeking "middle ground" as he mentioned at SXSW? Will Burr-Feinstein halt their work on a backdoor bill? Nothing has changed on this front, and there are still a host of reasons why a backdoor law is a bad idea.
- joering2 11y agoKnowing both Burr and Feinstein past how little good their bills ever did, I would highly doubt they ever stop wasting tax payers money.
- hackuser 11y agoThere was no reason to think this phone, unlike every other system, was uncrackable. Apple is setting impossible expectations, especially when the attacker has the resources of the U.S. goverment.
- j1vms 11y agoAnd wouldn't it be ironic if the "outside party", referenced in the article, was Apple itself. Maybe through several layers of indirection. Something to think about, but most probably not the case.
- thegayngler 11y agoThere needs to be a constitutional amendment blocking the federal government from this type of business disruption in the future.
- vinay427 11y agoThis sounds to me like the type of law that appears to solve a problem in this particular case but would open a can of worms in other cases that involve legitimate investigation into faulty business practices.
- nickbauman 11y agoMay? That's rich. They've always had the ability to circumvent the encryption on Farook's phone since day one. They could have made a byte-by-byte copy of the encrypted drive and bruteforced copies over and over. It's just that they prefer to coerce Apple into making it easier for them by making GovtOS.
- sflicht 11y agoSo does qualified immunity mean that Apple can't sue the Justice Department for the (substantial) legal expenses it incurred?
- cmurf 11y agoDicks. They know they're fucked. They don't want a precedent. And they want to bully everyone else like they did Lavabit.
- hellbanner 11y agoI just want to point out that lots of HN recently has been saying "Apple would NEVER deal with the FBI, there's too much risk of a leak!".. and yet, with the example of what happened to Manning, Snowden (ETC) -- would you, with a 6 figure salary, want to tell the world of misdeeds when you could toil away comfortably? "So obvious no one will ever notice" Apple removed their warrant canary about a year ago timed with press releases about "revamping their privacy policy for better security and user happiness" and a bunch of marketing bullshit. What I saw was the guarantees that they had done everything they could to protect your data was gone, replaced by "we'll follow the law" AKA they will screw you over willingly if they need to. --- Also, the FBI is NOT dumb. "Poor legal council" was mentioned in this thread. With their budget, why would you not assume they have Grade AAA legal council? --- https://news.ycombinator.com/item?id=11332377 https://news.ycombinator.com/item?id=11332377
- TazeTSchnitzel 11y agoWhat? Apple are quite good with privacy. Unlike Microsoft, for example, Apple's operating systems have encryption on by default.
- trakout 11y agoThey removed their warrant canary. That's a giant red flag if there ever was one. Cooperation w/ governments negates encryption, no matter how good.
- TazeTSchnitzel 11y agoYes, the canary disappeared. That doesn't mean Apple didn't fight their hardest against the order. They're legally compelled to silence.
- hellbanner 11y agoFront page of HN says Apple suspects "third party tampering" with servers en route to them. The plot thickens. If you didn't build it, you can't trust it.
- 11y ago
- gherkin0 11y agoIf the FBI is playing games with the court system, could Apple call them out on it and convince the court to rule on issues anyway?
- awt 11y agoPerhaps they think they've successfully moved the Overton Window.
- known 11y agohttp://www.iphoneasyunlock.com/ http://www.iphoneasyunlock.com/ FTW
- RussellDussel 11y agoCan somebody please point out to me the obvious fact I am missing. Don't Apple design their security such that even they themselves can't crack it? Like storing hashed passwords, they don't want that kind of accountability. The media keeps suggesting that Apple won't do it, I thought it would be the case that Apple can't do it...
- snowwrestler 11y agoApple did try to design encryption that it can't break. But they also want to be able to fix bugs. So they can update the OS on the phone even if it is locked. So by writing a new update, they could remove some of the ancillary security features that reinforce short passcodes: the "wipe after 10 tries" feature, and the "progressively longer delay between tries" feature. Without these, a numeric (short) passcode can be brute-forced in a day or two. This is what the FBI has been trying to force them to do: write a new update to remove these features. That's what Apple has been refusing to do. BTW, if you use a long alphanumeric passcode, then it wouldn't matter if Apple was forced to push this update. A 15 character passcode with upper case, lower case, numbers, and symbols would probably be safe from brute forcing no matter how fast someone tries. But most folks are not willing to remember or type in 15 characters on their phone.
- inci 11y agoWhat happens when Apple finds a way to secure this new attack vector. Is Apple now actively working against the feds? That is certainly how it will be seen by the US Gov.
- perfectstorm 11y agowhat if Apple agreed to unlock it (either by custom software or by some other means) but FBI won't say it publicly so Apple gets to save their face and FBI gets what they want.
- the_watcher 11y agoI know this is somewhat counterintuitive, but this is potentially good news. It means that we have not established precedent that the government can force a private company to destroy even the illusion of privacy.
- abalone 11y agoWhile the legal maneuvering is interesting, I'd like to talk more about the technical mechanisms. Is it actually possible? Snowden said the FBI is full of shit[1] and of course the phone is hackable, citing an ACLU report.[2] This report states that one could "easily" bypass the auto-erase-after-10-attempts function by popping out the Flash memory chip, copying its contents into some sort of test rig wired in its place, and then restoring it whenever it gets erased. This is an interesting modification of an attack scenario laid out in an excellent review of iPhone/iOS8 security by Matthew Green: "Since only the device itself knows UID -- and the UID can't be removed from the Secure Enclave -- this means all password cracking attempts have to run on the device itself. That rules out the use of FPGA or ASICs to crack passwords. Of course Apple could write a custom firmware that attempts to crack the keys on the device but even in the best case such cracking could be pretty time consuming, thanks to the 80ms PBKDF2 timing."[3] What this theoretical rig changes is it essentially allows a custom chip to run on the device (namely a delete-proof Flash chip), bypassing the need for Apple to write custom firmware. So a typical 6 digit one would take under a day to crack, based on the 80ms cost per attempt. So, it does seem possible to crack the pre-A7 phone in question with this rig. However, and here is where it gets interesting, Apple has said conflicting things about current phones. One the one hand, ever since the A7 they've added a hardware-level escalating time delay between failed passcode attempts: "On devices with an A7 or later A-series processor, the delays are enforced by the Secure Enclave. If the device is restarted during a timed delay, the delay is still enforced, with the timer starting over for the current period."[4] This would in theory make it infeasible to attempt this kind of rig on a current iPhone. Even a typical weak passcode would encounter an hour-long delay at least once every 10 attempts. It could take years to bruteforce all but the most predictable passcodes. However, Apple has also said that "Yes, it is certainly possible to create an entirely new operating system to undermine our security features as the government wants."[5] This would seem to suggest that software alone could enable bruteforcing, and this implication is in stark contrast to the statement on hardware defenses within the secure enclave. (Did they mean possible only on pre-A7 phones? It sure feels like they feel there's more at stake than that.) So I don't know what to believe at this point. The ACLU seems wrong in suggesting that this particular rig would work on anything but old pre-A7 iPhones, based on the current secure enclave's time delay. But Apple has outright stated that GovtOS could enable the cracking of iPhones. So... how? [1] https://twitter.com/Snowden/status/707299113449230336 https://twitter.com/Snowden/status/707299113449230336 [2] https://www.aclu.org/blog/free-future/one-fbis-major-claims-iphone-case-fraudulent https://www.aclu.org/blog/free-future/one-fbis-major-claims-... [3] http://blog.cryptographyengineering.com/2014/10/why-cant-apple-decrypt-your-iphone.html http://blog.cryptographyengineering.com/2014/10/why-cant-app... [4] https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf [5] http://www.apple.com/customer-letter/answers/ http://www.apple.com/customer-letter/answers/
- pearjuice 11y agoBecause iOS is closed source, proprietary software, the latest update might as wel include a backdoor. Nobody knows. This isn't an issue about privacy but rather with people comfortably trusting closed source software by the color of Tim Cook's eyes.
- baldajan 11y agoWhat's interesting about this case is, when it started, the sides were split 50/50 between Apple and the FBI. But as time went on, and Apple's PR, legal, and executive machine spoke and educated more people on the issue, the side tipped towards Apple. Then the congressional hearing happened, where Issa (R - Calirfornia) knew more about the technical details of the phone than Commey. Given that Commey didn't bring a technical aide with him, and him saying things like 'this software would be obsolete because of newer iPhones, and wouldn't work on the 6 and 6S' were completely false and hard to imagine were made with merely negligence (i.e. He was very clearly lying). And after all that, and the FBI and DOJ PR machine trying to fight back, it became clear that media was starting to side with Apple (Morning Joe on MSNBC is a perfect example of what a 2-3 week time span can do to an opinion). I even suspect the Judge would have also sided with Apple and the FBI would be fighting for the appeal, and they would have known that. It's smart for the FBI to drop the case, but timing + intentions to bring up the case in the first place were scummy. Let's remember that Commey, the director of the FBI, was a NY prosecutor. Given that the current NY prosecutor wanted to unlock phones with ease (as they don't have the resources of the FBI and access to the NSA), Commey was "simply" trying to help a friend by deceiving the public and forcing Apple to do something it didn't want to, that Apple knew it shouldn't. It simply wasn't worth the fight, and I do believe it put the FBI in their place, as even a terror attack couldn't even get them the mandate they sought. This is likely not the end, and the FBI knows that any company that has the reach they need will likely set a precedent against them, so it'll be interesting to see what they do next. All in all, what the FBI got out of this mess: making a whole lot of devices and services more secure.
- tuyguntn 11y agoIMO. 1. NSA and any other govt. organization do not need a help from Apple to gain necessary information 2. Most probably Apple and govt. are working together for the face of good PR 3. Now after Apple keynote, seems like sales are ok, now they can publish actual story step by step In summary: digital is not secure enough to rely on, all other things are PR
- Destreza 11y agoThis is very sad.
- Destreza 11y agoThis is very sad, which means Apple has failed in terms of its security protocol. Will Apple continue to win the customer's trust?
- mattlutze 11y agoWhat courses of action are available for private persons to bring questions like this in front of the Supreme Court? Is there something here that a private individual / corporation could find cause for a suit against the USG, so that the high courts have the opportunity to narrow the scope? Or are we just left to petitioning and lobbying Congress to rewrite parts of it?
- astaroth360 11y agoIf they actually manage to break into the phone, will that damage Apple's reputation in the realm of security? Anybody have any ideas what this 3rd party method could be?
- stestagg 11y agoWouldn't it be great if Apple sued the FBI for details of the exploit, for public interest reasons
- pigpaws 11y agoThere is always a coward willing to sell out their freedom and yours for their own profit & "security".
- a_imho 11y agoIs it normal to refer to the Justice Department as the U.S.? If I understand correctly it is part of the Government, yes, but this whole issue was promoted as FBI vs Apple, not US vs Apple. Not a native speak, just sounds strange to me.
- oddevan 11y agoI think it's just an easier-to-read headline; there's always some oversimplification in those.
- batz 11y agoSurveillance only works when people believe their communications are private and secure. The 3rd party was probably NSA and they did not intervene up until because it would reveal the existence of a cracking technique. What changed is that weighed against a possible court verdict that would tell every terrorist that no U.S. made device or encryption could possibly be secure, (causing targets to avoid using broken crypto) revealing the existence of a possible forensic technique was low risk. The belief that it is possible to communicate securely is the most important thing for spies to maintain. The FBI wants to discourage people from believing it because they think it will make people less likely to commit crimes. The spies want to encourage the belief because it ensures they can collect the intelligence they need to maintain the status quo.
- XorNot 11y agoIt seems far more likely then most of the conspiracy theories here that the FBI was simply running parallel work for breaking into the phone that has recently yielded results. Since the All Writs Act has as a test, necessity, to stay within the law they're required to notify the courts if that changes.
- wahsd 11y agoLet's realize something here that I can attest to being 100% correct; the US government is abysmally behind the curve ball on anything and all things technology. I really even hate stating that because we are operating on a kind of inertial perception of America's cyber might that partially was conjured through movies and perception, but reality is that we are really bad off. We're not just behind the curve ball, we're on a short bus trying to figure out how to get to the damn ballpark. The problem is a systemic one too, a lack of actual leadership, a personnel problem if you will.
- Relys 11y agoMartin Hector (@marcan42) from the established hardware hacking group fail0verflow has to say about the situation: https://marcan.st/2016/03/untangling-ios-pin-code-security/ https://marcan.st/2016/03/untangling-ios-pin-code-security/ Essentially you can just automate the backup/restore of the eMMC flash storage and brute force the PIN. :)