5 ms·
The GP isn't talking about flashing an unsigned image. They're talking about physically connecting to the NAND flash chip, making a disk image, and then every
by KMag 11y ago
The GP isn't talking about flashing an unsigned image. They're talking about physically connecting to the NAND flash chip, making a disk image, and then every 9 attempts, resetting the state of the flash back to its initial state. The image as the phone currently exists is already signed by Apple, so no cooperation from Apple is necessary.
The major weakness with this model of iPhone is that it keeps the number of failed attempts stored in the NAND flash, not on the CPU die, and is therefore vulnerable to having its state reset like this. It's a fairly obvious attack that the FBI must have known about, but failed to mention in order to try and set precedent.
- pfooti 11y agoPrecisely - this seems (or seemed originally) like a best-case scenario for Justice: it's a terrorist's iPhone, rather than a drug dealer's or some other "lesser" criminal's, where the public's fear might not be on the side of the FBI. It definitely feels like fishing for a precedent for other phones (especially the later models where this attack isn't feasible).
- rtpg 11y agoIsn't it pretty possible to mess up this and brick the device though?
- xxs 11y agoBricking is on the 'flash', so if you have a copy and/or install an FPGA to replace the flash. There is nothing to 'brick'
- KMag 11y agoI'm also not sure if the OS would notice if you tied the flash NAND chip's write-enable pin to ground. The OS would almost certainly notice the failed writes, but might try to make a best effort at error recovery and allow you to keep trying PINs.