3 ms·
>Except that if I were them, I certainly wouldn't ask that publicly, I would at least pretend I know how the FBI did it and claim that it's already fixed in the
by camillomiller 11y ago
>Except that if I were them, I certainly wouldn't ask that publicly, I would at least pretend I know how the FBI did it and claim that it's already fixed in the next version of the OS
Wow, lying doesn't really look like the best course of action for a public traded company, I guess.
>Which still means that tens of millions of iPhones are at risk today and will be for months, but at least, you get to pretend that you're ahead of the FBI while right now, it's pretty obvious that Apple has been outsmarted by a government agency.
It's extremely probable that users are not in danger. If it's true that the FBI used Cellebrite's services, they might have used a slightly upgraded version of the company's solution that enabled the hacking of 32-bit devices (i.e. no secure enclave).
The commercial solution touted publicly by Cellebrite is used by law enforcement all over the world to unlock iOS 8.x iPhones and iPads in a matter of 24h. There was a recent case in Milan, where the Court expert was able to unlock an iPhone 5 in 2 days and retrieve data thanks to the services of Cellebrite's offices in Munich.
So: 32-bit devices with iOS 9, no secure enclave, implication of a company known for providing solutions to break into iPhones since forever.
Icing on the cake: they might as well have used a system like the one suggested by ACLU and other experts: NVRAM cloning. That's a solution that's extremely phone specific and doesn't require to exploit any big scary bug to be carried out.
Most probable outcome: Apple will keep on hardening iOS security and it's own cloud security even more. In the end the common user wins.
The FBI is STILL the bad guy, acting like criminals who won't disclose a potential vulnerability (which might as well not exists) to the manufacturer.
- rtpg 11y agoWhat's the objective behind Apple wanting to know the method then? It sounds like any of these could be possible, so it's not like there's a big mystery (especially given the Cellebrite Purchase Order found on some government website).
- arrrg 11y agoIt could be something else. That’s the problem. Apple doesn’t know for sure and they would like to.
- marcoperaza 11y ago>The FBI is STILL the bad guy, acting like criminals who won't disclose a potential vulnerability (which might as well not exists) to the manufacturer. There is no obligation to disclose vulnerabilities. You are free to sell them to the highest bidder, including the government. The government has some damn good uses for them, see Stuxnet. Of course, big tech companies would love it to be required to disclose vulnerabilities. That way they get the whole security community's labor for free and don't have to pay bug bounties.