7 ms·

FBI Breaks into iPhone. We Have Some Questions

323 points by panarky 11y ago

nickysielicki 11y ago
FBI allegedly* breaks into iPhone.
chucknelson 11y ago
Two questions that I still have on this: (1) Does the public accept that the FBI is even telling the truth on this (i.e., did they actually "break into" this iPhone)? (2) If they did gain access to the iPhone's info, was it actually through the use of a vulnerability, or did they discover some other info that led them to the passcode?
- koenigdavidmj 11y ago
  And if they gained access, did they have it all along and lie about it all along? I suspect it is a career-limiting maneuver to prosecute the FBI.
- beeboop 11y ago
  Main stream media seemingly prints anything said by any government official as fact, even when it is dubious at best.
deleted 11y ago
[deleted]
nodesocket 11y ago
Apparently a 3rd party from Israel (http://www.cellebrite.com/ http://www.cellebrite.com/ [unconfirmed]) helped the FBI which begs the question, how did they do it? Do they have universal access to all iOS devices or just this particular device? If there is a known vulnerability, I'm willing to bet Apple will find it rather quickly. I'd imagine Apple has engineers pouring over the source code now.
- bdg 11y ago
  What is your source on that?
  - nodesocket 11y ago
    CNBC. Here is a link to the video where they mention Cellebrite. http://video.cnbc.com/gallery/?video=3000505023 http://video.cnbc.com/gallery/?video=3000505023
    - ne0codex 11y ago
      While stumbling upon different articles, I came across this video on YouTube of a guy in Shenzhen, China, that can replace the internal 16GB storage with a 128GB capacity NAND, so it's highly possible that a modified version of this is what's been done to the iPhone.. https://www.youtube.com/watch?time_continue=198&v=2bGb5AOwp44 https://www.youtube.com/watch?time_continue=198&v=2bGb5AOwp4...
      - yq 11y ago
        this is so cool, don't understand why you get downvoted. I thought we are in hackernews.
      - superuser2 11y ago
        There's no doubt that the FBI could arbitrarily edit/replace the contents of storage, the trick is getting it to boot after that. That's why they wanted Apple's cooperation to sign code or hand over the code signing keys.
    - deleted 11y ago
      [deleted]
- dublinben 11y ago
  If anyone was going to break into this device, it would have been them. Cellebrite have been the leaders in forensic data extraction from mobile devices for years. Most police departments have at least one of their readers for collecting information from seized phones. Years ago, I could never get a good answer from them whether they could extract information from encrypted devices. I guess we now know what the answer is, they can if they really want to.
abalone 11y ago
Most likely it's already been fixed. The iPhone 5C in question uses an A6 processor. It encrypts data by comingling the passcode with the unique device ID to create a a strong 256-bit key, so you can't just pull and brute force the flash memory chip. Meanwhile the OS will wipe the key if you guess a wrong passcode too many times, making the data forever inaccessible. However there is one vulnerability with the A6 that some have theorized.[1] If you could somehow get around the wiping part, you could keep guessing passcodes. A typical 4 or 6 digit passcode could be guessed in under a day. So it may be possible to copy the flash memory into a soldered-in test rig that is effectively wipe-proof. It would restore the contents every time it's wiped. So that's the best guess I know of for what happened here. But starting with the A7 Apple added the secure enclave. This now enforces at the hardware level an escalating time delay with each wrong passcode guess. It goes all the way up to a one hour delay.[2] That's also where the (unreadable) unique device ID resides, so there's no swapping out the processor with a rig. The key is forever wedded to this protection against brute forcing. That is pretty darn spiffy from a security standpoint. If it works as designed, about the only hope anyone has of getting at data from an A7 or later device is through iCloud backups.[3] [1] https://www.aclu.org/blog/free-future/one-fbis-major-claims-iphone-case-fraudulent https://www.aclu.org/blog/free-future/one-fbis-major-claims-... see also http://blog.cryptographyengineering.com/2014/10/why-cant-apple-decrypt-your-iphone.html http://blog.cryptographyengineering.com/2014/10/why-cant-app... [2] https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf [3] Either that or some kind of peek into the secure enclave. It's specifically designed to inhibit this at a hardware level, but perhaps a nation-state could figure it out (e.g. verrrrry carefully grinding it down without destroying it and looking at state with an electron microscope).
- nodesocket 11y ago
  That's an interesting point that I haven't heard mentioned. What if the FBI got to the data not from the phone, but iCloud. That honestly actually seems easier.
  - xupybd 11y ago
    I think they attempted that, however due to a mistake wiped the iCloud data.
studentrob 11y ago
> If the FBI used a vulnerability to get into the iPhone in the San Bernardino case, the VEP must apply, meaning that there should be a very strong bias in favor of informing Apple of the vulnerability. That would allow Apple to fix the flaw and protect the security of all its users. We look forward to seeing more transparency on this issue as well. It seems reasonable the FBI could still notify Apple of their method of entry and then later notify the public in time. The EFF, as much great work as they do, is showing a bit of impatience here. Perhaps they feel they have a bone to pick with the government, as the government seems to feel they have one to pick with tech. Neither party looks great by leveling such public complaints prematurely.
- dogma1138 11y ago
  The FBI said that they've gained access to the phone via a 3rd party (the 3rd party (who it was, not that one was used) is unconfirmed, potentially cellebrite) so most likely they have no way to inform Apple of anything. Not to mention that if indeed this was a physical attack NAND mirroring or ASIC replication there isn't really what to inform Apple about. Apple can't design a chip that wont be borken, all of them including those which use a secure enclave can be broken by physical attacks.
imh 11y ago
If the FBI pays a third party to break in, does VEP still apply?
meritt 11y ago
It's going to be amusing when Apple tries to sue the FBI under VEP and they're told pound sand.
- bigiain 11y ago
  It'd make great Apple marketing PR though :-) Did you see Charlie Stross's speculation that from Apple's end this is all about them becoming a retail bank via Apple Pay: http://www.antipope.org/charlie/blog-static/2016/03/follow-the-money-apple-vs-the-.html http://www.antipope.org/charlie/blog-static/2016/03/follow-t...
  - rashkov 11y ago
    Really interesting article, thanks.
- dfc 11y ago
  How does a corporation "sue the FBI under VEP"? This sounds more than a little silly to me but I am not a lawyer. What is the cause of action here?
yuzi 11y ago
I've gotten so used to gargantuan lies from both governments and corporations that worst case scenarios now seem the most likely. It's easy for me to believe that apple already did the work with an agreement put in place to keep it all under wraps by having the FBI drop the request.
mariodiana 11y ago
The FBI has shot themselves in the foot on this one, if you ask me. Let me just say at the outset that I am entirely unsympathetic to the FBI with respect to the Apple case. I side with Apple unreservedly. But the FBI started this case because they claimed there was "no other way" to get into the phone. Then, Lo and behold!, it turns out that there was another way. The next time the FBI tries this, I think the public reaction will be that the FBI can find a way, just like they did the last time. In other words, the FBI is now the Boy Who Cried Wolf.
sickbeard 11y ago
It doesn't have to be vulnerability to get around it. I think the EFF is a bit too eager here, assuming that encryption is absolute when it is far from it. All encryption gets cracked sooner or later.

323 points by panarky 11y ago

FBI allegedly* breaks into iPhone.

Two questions that I still have on this: (1) Does the public accept that the FBI is even telling the truth on this (i.e., did they actually "break into" this iPhone)? (2) If they did gain access to the iPhone's info, was it actually through the use of a vulnerability, or did they discover some other info that led them to the passcode?

koenigdavidmj 11y ago
And if they gained access, did they have it all along and lie about it all along? I suspect it is a career-limiting maneuver to prosecute the FBI.
beeboop 11y ago
Main stream media seemingly prints anything said by any government official as fact, even when it is dubious at best.

deleted 11y ago

[deleted]

nodesocket 11y ago

Apparently a 3rd party from Israel (http://www.cellebrite.com/ http://www.cellebrite.com/ [unconfirmed]) helped the FBI which begs the question, how did they do it? Do they have universal access to all iOS devices or just this particular device? If there is a known vulnerability, I'm willing to bet Apple will find it rather quickly. I'd imagine Apple has engineers pouring over the source code now.

bdg 11y ago
What is your source on that?
- nodesocket 11y ago
  CNBC. Here is a link to the video where they mention Cellebrite. http://video.cnbc.com/gallery/?video=3000505023 http://video.cnbc.com/gallery/?video=3000505023
  - ne0codex 11y ago
    While stumbling upon different articles, I came across this video on YouTube of a guy in Shenzhen, China, that can replace the internal 16GB storage with a 128GB capacity NAND, so it's highly possible that a modified version of this is what's been done to the iPhone.. https://www.youtube.com/watch?time_continue=198&v=2bGb5AOwp44 https://www.youtube.com/watch?time_continue=198&v=2bGb5AOwp4...
    - yq 11y ago
      this is so cool, don't understand why you get downvoted. I thought we are in hackernews.
    - superuser2 11y ago
      There's no doubt that the FBI could arbitrarily edit/replace the contents of storage, the trick is getting it to boot after that. That's why they wanted Apple's cooperation to sign code or hand over the code signing keys.
  - deleted 11y ago
    [deleted]
dublinben 11y ago
If anyone was going to break into this device, it would have been them. Cellebrite have been the leaders in forensic data extraction from mobile devices for years. Most police departments have at least one of their readers for collecting information from seized phones. Years ago, I could never get a good answer from them whether they could extract information from encrypted devices. I guess we now know what the answer is, they can if they really want to.

abalone 11y ago

Most likely it's already been fixed. The iPhone 5C in question uses an A6 processor. It encrypts data by comingling the passcode with the unique device ID to create a a strong 256-bit key, so you can't just pull and brute force the flash memory chip. Meanwhile the OS will wipe the key if you guess a wrong passcode too many times, making the data forever inaccessible. However there is one vulnerability with the A6 that some have theorized.[1] If you could somehow get around the wiping part, you could keep guessing passcodes. A typical 4 or 6 digit passcode could be guessed in under a day. So it may be possible to copy the flash memory into a soldered-in test rig that is effectively wipe-proof. It would restore the contents every time it's wiped. So that's the best guess I know of for what happened here. But starting with the A7 Apple added the secure enclave. This now enforces at the hardware level an escalating time delay with each wrong passcode guess. It goes all the way up to a one hour delay.[2] That's also where the (unreadable) unique device ID resides, so there's no swapping out the processor with a rig. The key is forever wedded to this protection against brute forcing. That is pretty darn spiffy from a security standpoint. If it works as designed, about the only hope anyone has of getting at data from an A7 or later device is through iCloud backups.[3] [1] https://www.aclu.org/blog/free-future/one-fbis-major-claims-iphone-case-fraudulent https://www.aclu.org/blog/free-future/one-fbis-major-claims-... see also http://blog.cryptographyengineering.com/2014/10/why-cant-apple-decrypt-your-iphone.html http://blog.cryptographyengineering.com/2014/10/why-cant-app... [2] https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf [3] Either that or some kind of peek into the secure enclave. It's specifically designed to inhibit this at a hardware level, but perhaps a nation-state could figure it out (e.g. verrrrry carefully grinding it down without destroying it and looking at state with an electron microscope).

nodesocket 11y ago
That's an interesting point that I haven't heard mentioned. What if the FBI got to the data not from the phone, but iCloud. That honestly actually seems easier.
- xupybd 11y ago
  I think they attempted that, however due to a mistake wiped the iCloud data.

studentrob 11y ago

> If the FBI used a vulnerability to get into the iPhone in the San Bernardino case, the VEP must apply, meaning that there should be a very strong bias in favor of informing Apple of the vulnerability. That would allow Apple to fix the flaw and protect the security of all its users. We look forward to seeing more transparency on this issue as well. It seems reasonable the FBI could still notify Apple of their method of entry and then later notify the public in time. The EFF, as much great work as they do, is showing a bit of impatience here. Perhaps they feel they have a bone to pick with the government, as the government seems to feel they have one to pick with tech. Neither party looks great by leveling such public complaints prematurely.

dogma1138 11y ago
The FBI said that they've gained access to the phone via a 3rd party (the 3rd party (who it was, not that one was used) is unconfirmed, potentially cellebrite) so most likely they have no way to inform Apple of anything. Not to mention that if indeed this was a physical attack NAND mirroring or ASIC replication there isn't really what to inform Apple about. Apple can't design a chip that wont be borken, all of them including those which use a secure enclave can be broken by physical attacks.

imh 11y ago

If the FBI pays a third party to break in, does VEP still apply?

meritt 11y ago

It's going to be amusing when Apple tries to sue the FBI under VEP and they're told pound sand.

bigiain 11y ago
It'd make great Apple marketing PR though :-) Did you see Charlie Stross's speculation that from Apple's end this is all about them becoming a retail bank via Apple Pay: http://www.antipope.org/charlie/blog-static/2016/03/follow-the-money-apple-vs-the-.html http://www.antipope.org/charlie/blog-static/2016/03/follow-t...
- rashkov 11y ago
  Really interesting article, thanks.
dfc 11y ago
How does a corporation "sue the FBI under VEP"? This sounds more than a little silly to me but I am not a lawyer. What is the cause of action here?

yuzi 11y ago

I've gotten so used to gargantuan lies from both governments and corporations that worst case scenarios now seem the most likely. It's easy for me to believe that apple already did the work with an agreement put in place to keep it all under wraps by having the FBI drop the request.

mariodiana 11y ago

The FBI has shot themselves in the foot on this one, if you ask me. Let me just say at the outset that I am entirely unsympathetic to the FBI with respect to the Apple case. I side with Apple unreservedly. But the FBI started this case because they claimed there was "no other way" to get into the phone. Then, Lo and behold!, it turns out that there was another way. The next time the FBI tries this, I think the public reaction will be that the FBI can find a way, just like they did the last time. In other words, the FBI is now the Boy Who Cried Wolf.

sickbeard 11y ago

It doesn't have to be vulnerability to get around it. I think the EFF is a bit too eager here, assuming that encryption is absolute when it is far from it. All encryption gets cracked sooner or later.