16 ms·

Your iPhone just got less secure. Blame the FBI

328 points by Libertatea 11y ago

akerro 11y ago
It always was insecure, know we just know for sure.
- milkytron 11y ago
  If there's a will, there's a way.
- pazra 11y ago
  We do not know for sure.
spriggan3 11y ago
> We don’t know what the method is, or which iPhone models it applies to. Where is the proof? there is no proof.
- CaptSpify 11y ago
  How do you prove something you don't know?
  - spriggan3 11y ago
    Well the burden of the proof lies with the person that states something as a fact. What is the title of that blog post again ? Right. now let the author show you the proof. If he doesn't know then he shouldn't talk about something like it is a fact. The only fact in this whole debacle is that the FBI has been caught lying again,again and again. So they were lying then and people should believe them now ?
    - CaptSpify 11y ago
      > Well the burden of the proof lies with the person that states something as a fact. Sure, but they aren't really stating a fact. They are saying they don't know if it's fact or not. I agree the title of the post is terrible and inaccurate, but the formatting of your comment is focused on the quote, not the title.
Karunamon 11y ago
NPR was playing this story up as if it's a blow for Apple - is it really? Isn't the vulnerability the fact that the phone has no secure enclave, and so the timeout/wipe can be worked around by external access to the flash? Isn't that the whole reason the newer phones were upgraded? Older device fails, newer device with improved security doesn't. That's not a blow to Apple, that's the way the world works.
- chillingeffect 11y ago
  You are exactly right: If the vulnerability does exist, and the FBI did contract it out, this just shows that the vulnerability is very expensive and only available to major state actors. In fact, a single government - the U.S. - couldn't do it alone. It's possible this is a actually script-kiddie exploitable vuln, but I highly doubt it. All that we have learned is what we suspected: Some "outdated"/older phones are infinitesimally less secure in a way that only internationally collaboration between some of the world's most powerful hackers can break. And it's not really the FBI's fault. They're not sharing it with anyone. (Probably). So it's not a blow to Apple at all. They already moved on before this. This phone/vuln was a stepping stone for them that is already obsolete. In fact, this is a boon to Apple, bc people will be scared into upgrading. (Except for the hopeless sheeple who "have nothing to hide" and perfer to share their personal info with the world's gubmints).
- mikeash 11y ago
  As far as I've been able to figure out, the Secure Enclave does not have its own storage. The proposed attack of cloning the phone's flash memory would work just as well on a new iPhone 6s. A lot of people are assuming that the Secure Enclave would prevent this attack, but I've not yet been able to find any basis for that assumption. The main security advantage of newer phones in this context is that Touch ID makes it practical to set a more complex passphrase. The flash cloning attack only works if you have a short passcode set, because it relies on brute force. If your passphrase is complex enough that it can't be brute forced even when the software controls are removed, then you're still safe. I'd wager that when the iPhone 7 ships this fall, it will have an upgraded Secure Enclave with internal storage that can prevent this attack entirely.
koenigdavidmj 11y ago
We'll find out based on how many of the similar cases are withdrawn. If the answer is zero, they're probably lying.
gigq 11y ago
This is the company the FBI supposedly contracted (http://www.cellebrite.com/Pages/cellebrite-solution-for-locked-apple-devices-running-ios-8x http://www.cellebrite.com/Pages/cellebrite-solution-for-lock...), if that's the case it's just older devices that don't have the secure enclave which is not surprising.
artursapek 11y ago
If Apple refused to comply with the FBI's request, why should the FBI owe Apple a disclosure of this vulnerability they found? Keep the downvotes coming, lads! They're meant for burying spam and junk comments, not expressing disagreement, but I enjoy them anyway.
- agd 11y ago
  The FBI doesn't owe Apple. It owes the public - many of whom own an Apple product.
- gambiting 11y ago
  Because FBI spent taxpayer's money to find a vulnerability in a device used by millions of people - it should release that information so that apple can fix it. Simple as that.
  - sigzero 11y ago
    Because of the pissing match, I doubt that is going to happen.
  - teacup50 11y ago
    Apple probably should have considered their own fallibility and the value of a working relationship with the FBI before launching a scorched-earth PR campaign. If the FBI could rely on Apple to provide assistance when presented with a court order, they would have no reason to keep such a method private -- or to even find and use it in the first place. Tim Cook does not come across as a sufficiently prescient CEO in this boondoggle.
- enlightenedfool 11y ago
  If I find a vulnerability and exploit someone's device, it's not okay under law. Why is a government institution exempt from law in a supposedly exemplary democracy?
  - deleted 11y ago
    [deleted]
mgberlin 11y ago
Without disclosure of the method used by the FBI, this sounds like nothing more than political posturing and a non-story. Apple is no longer able to fight the All Writs Act, and the FBI is no longer compelled to watch one of their favorite misuse-able laws get taken away.
mortenjorck 11y ago
Schneier knows this, and this is a particularly idealistic op-ed, but this is just how the exploit market works and while it would be nice if law enforcement would take the white-hat road, the hazard here is still vastly better than some kind of legal precedent for requiring backdoors. The good thing about the exploit market is that it is naturally self-limiting: you don't burn a zero-day on a dragnet; you limit its use to high-value (and ideally court-sanctioned) targets.
- woodman 11y ago
  > ...you don't burn a zero-day on a dragnet; That depends entirely upon the nature of the vulnerability. Every TLS vulnerability publicly disclosed and then patched comes to mind. The NSA can use that all day long without anybody knowing - see parallel reconstruction.
- jfoster 11y ago
  There's a bit of irony to this, too. If Apple had been more cooperative earlier, law enforcement probably would've taken the white hat approach. Apple protected users from the FBI, but is now potentially unable to protect them from organised crime.
  - laveur 11y ago
    There is absolutely no proof of that. What they where asking for was keys to every lock in the world. It would have given them unprecedented power to do whatever they wanted. Apple did the right thing. Users should always come first especially when privacy is at stake.
    - ikeboy 11y ago
      They were willing to hand over the phone to Apple and allow all work to take place on Apple premises. How does that affect other phones?
      - woodman 11y ago
studentrob 11y ago
The FBI's refusal to detail the flaw will just add to the pile of miscommunications between technologists and the government. That hurts the government's ability to advance their own technological capabilities and understanding. Every day, they're getting better at shooting themselves in the foot and widening that communication gap. I see nobody out there capable of bridging it. Not Tim Cook, not the EFF, not Obama, and certainly not the DOJ. Bruce Schneier's previous coverage from 2015-07 [1] is what first got me interested and up to speed in the recent SB case. Even if Apple isn't demanding the FBI's method at this moment, I respect what Bruce has to say here. [1] https://www.schneier.com/blog/archives/2015/07/back_doors_wont.html https://www.schneier.com/blog/archives/2015/07/back_doors_wo...
- maxerickson 11y ago
  It seems to me that Tim Cook and the FBI understand each other very well. They just don't care about the same things. Former CIA and NSA Director Michael Hayden clearly understands the issues. I saw an interview where he stated that the FBI was correct to want access (it makes their job easier) and that we shouldn't give it to them (he understands that a backdoor will be used in ways other than intended). The point being that people on the government side aren't just naive, ignorant administrators. I think the problem with a lot of national issues isn't the players lacking an understanding of the nuances, it's that people in general aren't very receptive to nuance. That makes it a losing strategy to try to address it.
  - studentrob 11y ago
    Public officials answer to a different standard than private citizens who run companies. The oath of the FBI is not to make their own jobs easier. It is to maintain public security. If the Director of the FBI cannot do that effectively, then that is a blemish on the record of President Obama who appointed Comey. There's a definite need for someone to step up and say that on balance, we are more secure without trying to guarantee government access to encrypted data, or vice versa. So far nobody has taken that high level view and been able to convince any of the early major players in this debate. Lindsey Graham's statement during his questioning of Lynch is the closest we got to a high level player changing sides, demonstrating an understanding of both positions [1]. [1] https://youtu.be/uk4hYAwCdhU?t=6m53s https://youtu.be/uk4hYAwCdhU?t=6m53s
at-fates-hands 11y ago
Your iphone just got less secure - so don't use iphones anymore. It always amazes me when people get on their high horse and start complaining about something when the remedy is quite simple - don't use the iphone. Get an Android phone, or an Ubuntu phone, or a Blackphone or a Windows phone. There's plenty of other devices that haven't been cracked by the FBI. There's irony in the fact Apple resisted the FBI attempts to crack the phone and now this vulnerability will go unpatched and the FBI now has a zero-day exploit they can use whenever they want.
- gambiting 11y ago
  I don't believe even for a second that Android devices are any more secure than iPhones. And I use an android phone. But let's be honest - with dozens of manufacturers there isn't a single one who dedicated the same amount of work to securing their devices or engineering things like the secure enclave in iPhones. I use a Sony phone but I'm sure Sony wouldn't have the guts to stand up to FBI, or that FBI would even need to ask - the hardware is most definitely not on the same level of polish as Apple's.
  - at-fates-hands 11y ago
    Apparently Windows Mobile is getting some attention for being quite secure: Windows Phone security is top notch, says Kaspersky - http://betanews.com/2015/06/11/windows-phone-security-is-top-notch-says-kaspersky/ http://betanews.com/2015/06/11/windows-phone-security-is-top... Microsoft may have the most secure smartphone OS in Windows Phone - http://www.neowin.net/news/microsoft-may-have-the-most-secure-smartphone-os-in-windows-phone http://www.neowin.net/news/microsoft-may-have-the-most-secur... Windows Phone is the most secure mobile OS says white hat hacker - http://www.techworm.net/2015/11/windows-phone-is-the-most-secure-mobile-platform.html http://www.techworm.net/2015/11/windows-phone-is-the-most-se...
  - neximo4 11y ago
    Hi! do you have contact details/email I can reach you on?
- deleted 11y ago
AdmiralAsshat 11y ago
To be clear, the FBI isn't compelling Apple to leave the vulnerability open, are they? My understanding is they simply found/were informed of a vulnerability that existed in this model of the phone, and are not informing Apple of it. If Apple themselves finds the vulnerability and patches it, the FBI can't do anything about it.
- wrsh07 11y ago
  Correct. And to be fair, the FBI could have received the vulnerability from a foreign state that is also opposed to terrorism but did not want their identity or methods known. ie they may have reasons for not disclosing the vulnerability, and it's a shame that there's so much mistrust of the government [caused by actions of the government] so that we can't assume the best.
dahart 11y ago
Is this just FUD? Simply confirming the vulnerability seems likely to lead to it being plugged, whether or not the FBI reveals their methods, in effect doing the opposite of what the title suggests.
- michaelbuddy 11y ago
  FUD or not, if it's from the Washington Post, you can almost guarantee it's not a good source.
- llamataboot 11y ago
  How can it be plugged, if Apple doesn't know what it is?
  - runjake 11y ago
    Because Apple being the OEM of the hardware and software involved, things tend to get back to them, even if in rumor form. And them knowing their software so well gives them intimate knowledge when tracking down vulnerabilities.
- rincebrain 11y ago
  They confirmed a method to get in existed, but did not reveal - what the scope of its usefulness is (particular kinds of hardware or software revisions) - whether it still works on modern platforms Without even a vague idea where to look or whether it's still there, it's a guarantee that _something_ existed, sometime.
exelius 11y ago
This is bad reporting. The iPhone did not get less secure. It has always had this security hole. I, like many others here on HN, believe the vulnerability to be related to the lack of a secure hardware biometric / encryption module. If this is the case, then your iPhone probably did not get less secure -- such exploits would only work on iPhones prior to the 5S (I think? The 6 series phones are covered for sure). Basically, if your phone supports Apple Pay, you're good. And if it's the case, it was a design decision rather than a bug. The secure hardware wasn't ready for consumer use when those devices were designed (and even then, the first generation of iPhone fingerprint readers was pretty bad). Apple knew a desoldering attack could be successful, but such attacks are very expensive, require long-term physical possession of the phone, and are impossible to pull off covertly. There may be another way to pull off a direct hardware access attack without actually needing to desolder the flash memory, but that would still only be effective in the absence of a hardware security module. The only defense against this type of attack is a secure hardware encryption module like the one Apple included to support Apple Pay (because the banks likely insisted on this level of security).
- vox_mollis 11y ago
  believe the vulnerability to be related to the lack of a secure hardware biometric / encryption module. The problem here is that we're all just speculating. We suspect this to be the case, but we can't be sure. And we probably never will be. To take this a step further, the FBI has also learned the lesson to never take this public again. If you are worried about law enforcement attacks against any device protected by they signing keys of a US company, it is only prudent for you to ASSUME that a FISA court has or will soon compromise the signing keys of your device. Jonathan Zdziarski has already shown the enclave to be useless in this case of compromised keys. At this point, the work being done by Joanna Rutkowska, Coreboot, Purism, and others are our only hope now. And even there, we'll never own our chipsets, ethernet controllers, or CPUs. May as well give up, we've already lost.
  - yeukhon 11y ago
    > And we probably never will be. Investigation is either made completely public after the fact or partially marked secret for certain years. Now if someone intentionally hide the investigation details, well, that's a whole different story and I wouldn't be surprised at all. Writer chooses what to write in their investigation log reports. Anyway, we really don't know what method they used to gather the information and what kind of information they pulled off for sure.
mikeash 11y ago
I find this rather silly. iPhones didn't get less secure because the FBI used a known vulnerability to break into one. iPhones were that insecure all along, and the only thing that changed is that we now know it. The article further states, "There’s no such thing as a vulnerability that affects only one device." Except that I'm pretty sure that whatever attack the FBI used relied on the fact that the phone in question had a short passcode set. I'd bet dollars to donuts that whatever attack they used would not work against my phone with a secure passphrase. I'm usually a fan of Schneier, but I think he really missed with this one.
- jacquesm 11y ago
  Sad to see this downvoted, it's as far as I can see absolutely accurate.
- llamataboot 11y ago
  This is pedantic in my opinion. The main point of the article was that the FBI found a vulnerability. So before it was likely an unknown vulnerability, now it is known by law enforcement. The whole point of the article was that responsible organizations disclose vulnerabilities so that companies can make their software/hardware more secure. In this case the FBI is sitting on it, so they can continue to use it. Last week the FBI couldn't break into my iPhone. Now they /might/ be able to (it's a 6, so who knows if it is fixed). And Apple can't fix what they don't know about. Therefore, my confidence in the security of my iPhone has diminished, and it may be less secure than it was last week.
  - mikeash 11y ago
    According to the article, the vulnerability was already known by a third party, and all the FBI did was ask/pay that third party to use it on this phone. I don't see how that act alters the security of iPhones. I agree that the FBI should inform Apple of the vulnerability they used. I just don't think that failing to do so makes iPhones less secure. Failing to do so leaves them as they are, and informing Apple would make iPhones more secure. I don't see this as pedantic, because it's the difference between the FBI actively harming us and the FBI merely not helping us.
incepted 11y ago
Blame the FBI? How is it the FBI's fault that this particular iPhone was not secure? It's mystifying to me how far Apple advocates will go to not blame their favorite company.
noobie 11y ago
I am sure they just hired some interns to code = 0000 While code_is_valid not true: enter code reboot device code++ Edit: I am pretty sure there's a delay in code execution registering a wrong pin hence by rebooting the phone, the wrong pins won't get detected.
- hyperliner 11y ago
  Good one, though I can see there is a problem with this "algorithm"! haha :-)
  - noobie 11y ago
    What might it be? I assumed the code is just 4 digits long but judging by the quick downvotes people aren't even considering this to be a possibility.
    - cjbprime 11y ago
      There's a mechanism that wipes the device after too many incorrect code attempts. Disabling this mechanism was the entire point of the FBI/Apple lawsuit.
      - noobie 11y ago
        I am pretty sure a reboot bypasses that mechanism.
        function_seven 11y ago
        Why would you be pretty sure of that? That would be totally braindead if a simple reboot bypassed the limit. It doesn't. There was a flaw in an earlier iOS version where you could reboot the phone a few milliseconds after an incorrect PIN, before the phone recorded the failure, but that was fixed some time ago.
- mikeash 11y ago
S_A_P 11y ago
I think this just feeds off the myth that the iPhone was invulnerable to exploit. The average washington post reader isnt going to know the intricacies of mobile security. NPR and to some extent this article makes it seem like the iPhone was previously secure, and now less so. There is no data supporting either hypothesis, but its likely that this was not a new exploit found that the FBI used. I am curious, however, as to whether this affects only the 5c or if it affects the newer 6/6+/s/s+
- deegles 11y ago
  I have a CS degree and I don't know the intricacies either.
known 11y ago
Windows is less secure. Can we blame FBI?
wimagguc 11y ago
Why did the FBI drop the lawsuit against Apple in the first place? They both made it sound like the stake was much higher than unlocking the one device. Or, the FBI managed to unlock this phone and so they can unlock any other devices too, now-and-forever? They don't need a backdoor any more? Wouldn't the logical next step from Apple's side be to protect their users in their future devices? Wouldn't then the FBI have to sue them again? Feels like we are missing key facts here, and I wonder why Apple is not talking now.
- XorNot 11y ago
  It's a writ. It is legally only valid if there is necessity and the court must be informed if that changes.
tptacek 11y ago
Schneier has never had a strong intuition for how software vulnerabilities work. In the 2000s, he wrote articles in his newsletter blaming eEye (a security research firm then the home of Derek Soeder, Barnaby Jack, Ryan Permeh, and the like) for publishing their vulnerability research. He is at turns anti-disclosure, pro-disclosure, and all points in between.
- bertil 11y ago
  My understanding is that “disclosure” is a nuanced thing, time-wise: responsible disclosure is to mention the vulnerability to someone who can and is intent to fix it first, give them the time to write, test and send a patch, and then publish it. Publishing it earlier sound very unreasonable, especially before handing the details to the manufacturer. I am not familiar with what Schneier said 15 years ago, though. He might have chastised someone for doing that; he might have changed his mind. If he hasn’t in a decade and a half, I’d be shocked. I realised this morning that 15 years ago, I was proud of using SAS, “the most powerful analytics software there [was]”. I changed.
  - tptacek 11y ago
    There is no such thing as "responsible disclosure". That's a term invented by vendors to coerce independent researchers into doing free work for them. Semantic drift has somewhat legitimized the term, but I think it's important we remember why it was conjured in the first place.
    - wolf550e 11y ago
      How would you call Google Project Zero's 90 day policy?
      - chopin 11y ago
        Doesn't Google do free work for the vendors with this project? I would assume so.
      - 11y ago
1632TestAccount 11y ago
Test
eggbrain 11y ago
I find myself divided on this article, as a person who values security very strongly. 1. If the vulnerability the FBI used worked because the device was an iPhone without a secure enclave, Apple probably knows how they did it, but they can't really fix devices that have already shipped without the security features. While this obviously hurts users of those phones, every phone going forward won't have this issue, and this won't be replicable on a mass scale. 2. Because this was a vulnerability that was found, not intentionally created, there is a high likelihood that the bug will be found again by security researchers, or at the very least paid for handsomely by Apple. This isn't necessarily true (Heartbleed existed for 2 years without being noticed), but it means that the vulnerability has a timetable that rapidly closes. This is far different from an _introduced_ backdoor/vulnerability, where Apple knows exactly what can be used to get into a device, but has their hands tied by the government, which would _unilaterally_ make our phones less secure. I don't like buying a door lock if I know there's a master key that can open any of the doors of that brand. 3. The author I feel is misleading when he says things like "A vulnerability in Windows 10, for example, affects all of us who use Windows 10". Even if a piece of software has a vulnerability, that vulnerability could perhaps only be exploitable under certain conditions, like software running on certain hardware (eg: without a secure enclave), or under certain conditions (passcodes of less than 4 digits). It also can be highly theoretical or impractical to do on any sort of scale -- if the vulnerability involves reading data off a hard drive using an electron microscope to check for magnetic signatures, I'm not going to be too worried that it will be abused, as the man hours to have it work for a single case would be astronomical and only feasible in the most extreme circumstances. It's probably very frustrating on Apple's part that the FBI found a vulnerability that they (likely) don't know about, and in an ideal world, governments would disclose those vulnerabilities to make us more secure. But as long as the software and hardware continue to get more secure and not intentionally crippled, any benefit they derived feels short lived at best.
- coldcode 11y ago
  I am sure Apple knows exactly what they did, it's their system and their own hacking team likely finds stuff like this. The key is if anyone else in the US is able to purchase this hack to unlock a phone: if they do and try to reference evidence based on that a judge will require the process be disclosed.
julie1 11y ago
Given how much corruption is revealed in wikileaks maybe less privacy is not a bad trade off. What amaze me is the tendency for our society to call for more privacy that favors the more powerful, hence the more likely to be corrupted. If we want make it easy for our leaders to be corrupted I definitively would call for more cryptography. Me except the normal "shameful" stuff from the common people I want privacy to. Like anyone I have stuff I want to hide. But, it is okay if I get _caught_. I will not say everything I did is okay, because, I still have hurt indirectly people. There are stuff I want to hide to protect myself from the intolerant crowd. But guess what, I have as much as I could went to present my excuses, and took responsibility for my own shitty actions. And for the stuff I should not be ashamed of, I don't see the need to hide it, in a democracy we have the freedom to fight for our opinions. None of my stupid stuff requiring privacy have been leading to blood being shed, exploitation, or making the market noncompetitive. With greater power/wealth should come greater transparency. And iPhone are definitively more expensive than most phones. So let's remember that is often the look from the others that makes us more virtuous, and let us all accept to live in an house made of glass (except for the bathroom, and the bedrooms). In a fair competitive market access to information is symmetrical. In a real democracy government are expected to be openly enforcing the choices of the voters. In a world tending towards virtue, there is no need for more privacy.
darkseas 11y ago
Did anyone else get the ad from Huawei? "Focus Perservere Breakthrough" ..delicious..
kazinator 11y ago
This is awful reporting. For weeks, the experts in security had been saying that FBI does not in fact need Apple's help to get into that phone; that they are just posturing in order to obtain a back door. This was posted on the ACLU website: https://www.aclu.org/blog/free-future/one-fbis-major-claims-iphone-case-fraudulent https://www.aclu.org/blog/free-future/one-fbis-major-claims-... The FBI can simply remove this chip from the circuit board (“desolder” it), connect it to a device capable of reading and writing NAND flash, and copy all of its data. It can then replace the chip, and start testing passcodes. If it turns out that the auto-erase feature is on, and the Effaceable Storage gets erased, they can remove the chip, copy the original information back in, and replace it. If they plan to do this many times, they can attach a “test socket” to the circuit board that makes it easy and fast to do this kind of chip swapping. Maybe the FBI has a secret new exploit --- or maybe they just did the above method, getting the "third party" help with the desoldering and the attachment of a socket, and hardware for reading NAND. It's just speculation. Even if the FBI are exploiting some hole, that is better than them having a back door, which is essentially a security hole put in by design. The article is speculating, and it's conflating security holes with back doors.
- danielweber 11y ago
  Yes. I'm not worried if the police seize a locked safe from someone and hire a safecracker to open it. That doesn't mean that I shouldn't use that safe. It may still be, in fact, the best safe for me to use.
- gravypod 11y ago
  I don't know about anyone else, but the iPhones seem to be the focus of all the academics that do security research. I'm always seeing X done to the iPhone. Just these past few weeks I remember seeing a key extraction done via EM emitted from the phone.
frade33 11y ago
Changelog: iOS 9.4 1st April 2016 - Fix FBI backdoor
Overtonwindow 11y ago
I completely disagree with the premise here. This is Tim Cook's fault and it should fall completely on Apple. I've been using Apple products my whole life, and I think security and privacy are great, but I don't believe for one second that Apple is the holy savior of our privacy. They fought the FBI because of marketing and profits, not out of a sense of duty to protect our privacy. I also don't buy the rhetorical come-back about those who would trade liberty for security deserve neither. There is a line between the two, and each side must give and take. If the FBI found a way to do it without Apple, bravo. Let Apple figure it out if they want. This is Apple's fault and they should not get a pass for spinning the PR in their favor.
- riprowan 11y ago
  You're certainly right about one thing: the people want privacy and will reward a company handsomely for delivering. In theory government is supposed to also be responsive to the will of the people especially with regards to things like privacy from government searches so I guess it's up to the reader to decide for themselves which side they're on here.
- HillaryBriss 11y ago
  Yeah, the "trade liberty for security" line is applied selectively, as far as I can tell. It tends to be trotted out frequently in discussions about data encryption. I don't see that line used nearly so often against traffic laws, driver's license laws, state medical board doctor licensing laws, laws banning the sale of guns to minors, compulsory education laws, childhood vaccination laws, laws banning lead in gasoline, building codes requiring the use of twelve-gauge wire in certain circuits, laws requiring carbon monoxide detectors in our bedrooms and kitchens, etc. The government is applying constraints to our lives and freedoms literally _all the time_ in the name of securing us against threats to life and health. Most people accept those trade offs. But those same people actually _do_ deserve both liberty and security.
HillaryBriss 11y ago
Bruce singles out the FBI for blame in this case, but if that's right, then whatever third party helped the FBI also deserves blame.
sveit 11y ago
Can we file a Freedom of Information Act request to have the method the FBI used disclosed?
Mistri 11y ago
TBH there have been so many security holes in the iOS software... this software did not "get less secure", it has been there all along. If you're an iPhone user, you notice the CONSTANT iOS security updates... most of them are because someone found a hole and patched it up! I just hope that the FBI lets Apple know of this hole once the case is over (but I doubt that will happen), or Apple figures out how they did it. If Apple can't find out, it won't be very easy for others to get into iPhones either... but it's still possible.
frogpelt 11y ago
Hilarious. Apple wouldn't give the FBI access but now the FBI should give Apple access to their information? This conversation has jumped the shark.
lmeunier 11y ago
I don't know why I still haven't seen this here, but there are plenty of videos on youtube on how to bypass the 10 wrong pass code limit. I don't understand, it looks so easy and still people are talking about encryption modules etc ... Am I missing something ?
intrasight 11y ago
I don't blame either of them. But I do blame users who put confidential information on their phone with the expectation that it will remain so.
wyldfire 11y ago
There's a typo in the URL for the "process" link in "They even have a process for deciding what to do when a vulnerability is discovered." Should be https://www.whitehouse.gov/blog/2014/04/28/heartbleed-understanding-when-we-disclose-cyber-vulnerabilities https://www.whitehouse.gov/blog/2014/04/28/heartbleed-unders... It's interesting that the government (at least this part: " Special Assistant to the President and Cybersecurity Coordinator") recognizes the pros/cons: > Disclosing a vulnerability can mean that we forego an opportunity to collect crucial intelligence ... Building up a huge stockpile of undisclosed vulnerabilities while leaving the Internet vulnerable and the American people unprotected would not be in our national security interest.
2ifrgtmypss 11y ago
Lol this is stupid.. nothing is secure
allemagne 11y ago
Ideally (for the FBI), the FBI would order Apple to build a backdoor into their system. This is functionally the same as ordering Apple not to patch a known vulnerability. In turn, this is functionally the same (in the short term) as not disclosing a known vulnerability to Apple. While the article's title is misleading, the FBI might as well be taking an active role in making the iPhone less secure. In communicating to the non-technical public, insisting on elaborating the difference is being pedantic.
TelAviv 11y ago
At least you're not blaming us here in Israel!
deleted 11y ago
[deleted]
ctdonath 11y ago
The "vulnerabilities equities process", adopted in 2010, requires the FBI disclose the exploit details to Apple on request. More info can be found in am EFF case: https://www.eff.org/files/2014/07/01/eff_v_nsa_odni_-_foia.pdf https://www.eff.org/files/2014/07/01/eff_v_nsa_odni_-_foia.p...
- kodablah 11y ago
  Maybe I misread the redacted doc [0] but from what I see, it is sent to the Entities Review Board (ERB) that then determines whether they should disseminate. I was unable to find the requirement to disclose. Can you point to it? 0 - https://www.eff.org/document/vulnerabilities-equities-process-january-2016 https://www.eff.org/document/vulnerabilities-equities-proces...
Zigurd 11y ago
There are reasons to doubt the FBI is being honest about this matter: Firstly, they must have known they could desolder and copy the chip containing the PIN-protected key, replacing it if it were erased. This method was put forward by multiple security experts. So the FBI started from a dishonest position regarding Apple being the only source of assistance. Now they claim that a mystery exploit emerged and was put to use between Sunday night and Tuesday. That's not enough time to crack the phone using a pile of chips and brute-forcing the PIN. Since the FBI started from a dishonest position, and hasn't spent enough time to plausibly have used the know approach, and they have carefully avoided saying they actually got keys and/or encrypted data out of the phone - or that they did anything at all with the phone, there is a more than small chance that the FBI has simply moved their own vague goalposts and declared that they have everything they need. Not honest or ethical.

328 points by Libertatea 11y ago

akerro 11y ago

It always was insecure, know we just know for sure.

milkytron 11y ago
If there's a will, there's a way.
pazra 11y ago
We do not know for sure.

spriggan3 11y ago

> We don’t know what the method is, or which iPhone models it applies to. Where is the proof? there is no proof.

CaptSpify 11y ago
How do you prove something you don't know?
- spriggan3 11y ago
  Well the burden of the proof lies with the person that states something as a fact. What is the title of that blog post again ? Right. now let the author show you the proof. If he doesn't know then he shouldn't talk about something like it is a fact. The only fact in this whole debacle is that the FBI has been caught lying again,again and again. So they were lying then and people should believe them now ?
  - CaptSpify 11y ago
    > Well the burden of the proof lies with the person that states something as a fact. Sure, but they aren't really stating a fact. They are saying they don't know if it's fact or not. I agree the title of the post is terrible and inaccurate, but the formatting of your comment is focused on the quote, not the title.

Karunamon 11y ago

NPR was playing this story up as if it's a blow for Apple - is it really? Isn't the vulnerability the fact that the phone has no secure enclave, and so the timeout/wipe can be worked around by external access to the flash? Isn't that the whole reason the newer phones were upgraded? Older device fails, newer device with improved security doesn't. That's not a blow to Apple, that's the way the world works.

chillingeffect 11y ago
You are exactly right: If the vulnerability does exist, and the FBI did contract it out, this just shows that the vulnerability is very expensive and only available to major state actors. In fact, a single government - the U.S. - couldn't do it alone. It's possible this is a actually script-kiddie exploitable vuln, but I highly doubt it. All that we have learned is what we suspected: Some "outdated"/older phones are infinitesimally less secure in a way that only internationally collaboration between some of the world's most powerful hackers can break. And it's not really the FBI's fault. They're not sharing it with anyone. (Probably). So it's not a blow to Apple at all. They already moved on before this. This phone/vuln was a stepping stone for them that is already obsolete. In fact, this is a boon to Apple, bc people will be scared into upgrading. (Except for the hopeless sheeple who "have nothing to hide" and perfer to share their personal info with the world's gubmints).
mikeash 11y ago
As far as I've been able to figure out, the Secure Enclave does not have its own storage. The proposed attack of cloning the phone's flash memory would work just as well on a new iPhone 6s. A lot of people are assuming that the Secure Enclave would prevent this attack, but I've not yet been able to find any basis for that assumption. The main security advantage of newer phones in this context is that Touch ID makes it practical to set a more complex passphrase. The flash cloning attack only works if you have a short passcode set, because it relies on brute force. If your passphrase is complex enough that it can't be brute forced even when the software controls are removed, then you're still safe. I'd wager that when the iPhone 7 ships this fall, it will have an upgraded Secure Enclave with internal storage that can prevent this attack entirely.

koenigdavidmj 11y ago

We'll find out based on how many of the similar cases are withdrawn. If the answer is zero, they're probably lying.

gigq 11y ago

This is the company the FBI supposedly contracted (http://www.cellebrite.com/Pages/cellebrite-solution-for-locked-apple-devices-running-ios-8x http://www.cellebrite.com/Pages/cellebrite-solution-for-lock...), if that's the case it's just older devices that don't have the secure enclave which is not surprising.

artursapek 11y ago

If Apple refused to comply with the FBI's request, why should the FBI owe Apple a disclosure of this vulnerability they found? Keep the downvotes coming, lads! They're meant for burying spam and junk comments, not expressing disagreement, but I enjoy them anyway.

agd 11y ago
The FBI doesn't owe Apple. It owes the public - many of whom own an Apple product.
gambiting 11y ago
Because FBI spent taxpayer's money to find a vulnerability in a device used by millions of people - it should release that information so that apple can fix it. Simple as that.
- sigzero 11y ago
  Because of the pissing match, I doubt that is going to happen.
- teacup50 11y ago
  Apple probably should have considered their own fallibility and the value of a working relationship with the FBI before launching a scorched-earth PR campaign. If the FBI could rely on Apple to provide assistance when presented with a court order, they would have no reason to keep such a method private -- or to even find and use it in the first place. Tim Cook does not come across as a sufficiently prescient CEO in this boondoggle.
enlightenedfool 11y ago
If I find a vulnerability and exploit someone's device, it's not okay under law. Why is a government institution exempt from law in a supposedly exemplary democracy?
- deleted 11y ago
  [deleted]

mgberlin 11y ago

Without disclosure of the method used by the FBI, this sounds like nothing more than political posturing and a non-story. Apple is no longer able to fight the All Writs Act, and the FBI is no longer compelled to watch one of their favorite misuse-able laws get taken away.

mortenjorck 11y ago

Schneier knows this, and this is a particularly idealistic op-ed, but this is just how the exploit market works and while it would be nice if law enforcement would take the white-hat road, the hazard here is still vastly better than some kind of legal precedent for requiring backdoors. The good thing about the exploit market is that it is naturally self-limiting: you don't burn a zero-day on a dragnet; you limit its use to high-value (and ideally court-sanctioned) targets.

woodman 11y ago
> ...you don't burn a zero-day on a dragnet; That depends entirely upon the nature of the vulnerability. Every TLS vulnerability publicly disclosed and then patched comes to mind. The NSA can use that all day long without anybody knowing - see parallel reconstruction.
jfoster 11y ago
There's a bit of irony to this, too. If Apple had been more cooperative earlier, law enforcement probably would've taken the white hat approach. Apple protected users from the FBI, but is now potentially unable to protect them from organised crime.
- laveur 11y ago
  There is absolutely no proof of that. What they where asking for was keys to every lock in the world. It would have given them unprecedented power to do whatever they wanted. Apple did the right thing. Users should always come first especially when privacy is at stake.
  - ikeboy 11y ago
    They were willing to hand over the phone to Apple and allow all work to take place on Apple premises. How does that affect other phones?
    - woodman 11y ago

studentrob 11y ago

The FBI's refusal to detail the flaw will just add to the pile of miscommunications between technologists and the government. That hurts the government's ability to advance their own technological capabilities and understanding. Every day, they're getting better at shooting themselves in the foot and widening that communication gap. I see nobody out there capable of bridging it. Not Tim Cook, not the EFF, not Obama, and certainly not the DOJ. Bruce Schneier's previous coverage from 2015-07 [1] is what first got me interested and up to speed in the recent SB case. Even if Apple isn't demanding the FBI's method at this moment, I respect what Bruce has to say here. [1] https://www.schneier.com/blog/archives/2015/07/back_doors_wont.html https://www.schneier.com/blog/archives/2015/07/back_doors_wo...

maxerickson 11y ago
It seems to me that Tim Cook and the FBI understand each other very well. They just don't care about the same things. Former CIA and NSA Director Michael Hayden clearly understands the issues. I saw an interview where he stated that the FBI was correct to want access (it makes their job easier) and that we shouldn't give it to them (he understands that a backdoor will be used in ways other than intended). The point being that people on the government side aren't just naive, ignorant administrators. I think the problem with a lot of national issues isn't the players lacking an understanding of the nuances, it's that people in general aren't very receptive to nuance. That makes it a losing strategy to try to address it.
- studentrob 11y ago
  Public officials answer to a different standard than private citizens who run companies. The oath of the FBI is not to make their own jobs easier. It is to maintain public security. If the Director of the FBI cannot do that effectively, then that is a blemish on the record of President Obama who appointed Comey. There's a definite need for someone to step up and say that on balance, we are more secure without trying to guarantee government access to encrypted data, or vice versa. So far nobody has taken that high level view and been able to convince any of the early major players in this debate. Lindsey Graham's statement during his questioning of Lynch is the closest we got to a high level player changing sides, demonstrating an understanding of both positions [1]. [1] https://youtu.be/uk4hYAwCdhU?t=6m53s https://youtu.be/uk4hYAwCdhU?t=6m53s

at-fates-hands 11y ago

Your iphone just got less secure - so don't use iphones anymore. It always amazes me when people get on their high horse and start complaining about something when the remedy is quite simple - don't use the iphone. Get an Android phone, or an Ubuntu phone, or a Blackphone or a Windows phone. There's plenty of other devices that haven't been cracked by the FBI. There's irony in the fact Apple resisted the FBI attempts to crack the phone and now this vulnerability will go unpatched and the FBI now has a zero-day exploit they can use whenever they want.

gambiting 11y ago
I don't believe even for a second that Android devices are any more secure than iPhones. And I use an android phone. But let's be honest - with dozens of manufacturers there isn't a single one who dedicated the same amount of work to securing their devices or engineering things like the secure enclave in iPhones. I use a Sony phone but I'm sure Sony wouldn't have the guts to stand up to FBI, or that FBI would even need to ask - the hardware is most definitely not on the same level of polish as Apple's.
- at-fates-hands 11y ago
  Apparently Windows Mobile is getting some attention for being quite secure: Windows Phone security is top notch, says Kaspersky - http://betanews.com/2015/06/11/windows-phone-security-is-top-notch-says-kaspersky/ http://betanews.com/2015/06/11/windows-phone-security-is-top... Microsoft may have the most secure smartphone OS in Windows Phone - http://www.neowin.net/news/microsoft-may-have-the-most-secure-smartphone-os-in-windows-phone http://www.neowin.net/news/microsoft-may-have-the-most-secur... Windows Phone is the most secure mobile OS says white hat hacker - http://www.techworm.net/2015/11/windows-phone-is-the-most-secure-mobile-platform.html http://www.techworm.net/2015/11/windows-phone-is-the-most-se...
- neximo4 11y ago
  Hi! do you have contact details/email I can reach you on?
deleted 11y ago

AdmiralAsshat 11y ago

To be clear, the FBI isn't compelling Apple to leave the vulnerability open, are they? My understanding is they simply found/were informed of a vulnerability that existed in this model of the phone, and are not informing Apple of it. If Apple themselves finds the vulnerability and patches it, the FBI can't do anything about it.

wrsh07 11y ago
Correct. And to be fair, the FBI could have received the vulnerability from a foreign state that is also opposed to terrorism but did not want their identity or methods known. ie they may have reasons for not disclosing the vulnerability, and it's a shame that there's so much mistrust of the government [caused by actions of the government] so that we can't assume the best.

dahart 11y ago

Is this just FUD? Simply confirming the vulnerability seems likely to lead to it being plugged, whether or not the FBI reveals their methods, in effect doing the opposite of what the title suggests.

michaelbuddy 11y ago
FUD or not, if it's from the Washington Post, you can almost guarantee it's not a good source.
llamataboot 11y ago
How can it be plugged, if Apple doesn't know what it is?
- runjake 11y ago
  Because Apple being the OEM of the hardware and software involved, things tend to get back to them, even if in rumor form. And them knowing their software so well gives them intimate knowledge when tracking down vulnerabilities.
rincebrain 11y ago
They confirmed a method to get in existed, but did not reveal - what the scope of its usefulness is (particular kinds of hardware or software revisions) - whether it still works on modern platforms Without even a vague idea where to look or whether it's still there, it's a guarantee that _something_ existed, sometime.

exelius 11y ago

This is bad reporting. The iPhone did not get less secure. It has always had this security hole. I, like many others here on HN, believe the vulnerability to be related to the lack of a secure hardware biometric / encryption module. If this is the case, then your iPhone probably did not get less secure -- such exploits would only work on iPhones prior to the 5S (I think? The 6 series phones are covered for sure). Basically, if your phone supports Apple Pay, you're good. And if it's the case, it was a design decision rather than a bug. The secure hardware wasn't ready for consumer use when those devices were designed (and even then, the first generation of iPhone fingerprint readers was pretty bad). Apple knew a desoldering attack could be successful, but such attacks are very expensive, require long-term physical possession of the phone, and are impossible to pull off covertly. There may be another way to pull off a direct hardware access attack without actually needing to desolder the flash memory, but that would still only be effective in the absence of a hardware security module. The only defense against this type of attack is a secure hardware encryption module like the one Apple included to support Apple Pay (because the banks likely insisted on this level of security).

vox_mollis 11y ago
believe the vulnerability to be related to the lack of a secure hardware biometric / encryption module. The problem here is that we're all just speculating. We suspect this to be the case, but we can't be sure. And we probably never will be. To take this a step further, the FBI has also learned the lesson to never take this public again. If you are worried about law enforcement attacks against any device protected by they signing keys of a US company, it is only prudent for you to ASSUME that a FISA court has or will soon compromise the signing keys of your device. Jonathan Zdziarski has already shown the enclave to be useless in this case of compromised keys. At this point, the work being done by Joanna Rutkowska, Coreboot, Purism, and others are our only hope now. And even there, we'll never own our chipsets, ethernet controllers, or CPUs. May as well give up, we've already lost.
- yeukhon 11y ago
  > And we probably never will be. Investigation is either made completely public after the fact or partially marked secret for certain years. Now if someone intentionally hide the investigation details, well, that's a whole different story and I wouldn't be surprised at all. Writer chooses what to write in their investigation log reports. Anyway, we really don't know what method they used to gather the information and what kind of information they pulled off for sure.

mikeash 11y ago

I find this rather silly. iPhones didn't get less secure because the FBI used a known vulnerability to break into one. iPhones were that insecure all along, and the only thing that changed is that we now know it. The article further states, "There’s no such thing as a vulnerability that affects only one device." Except that I'm pretty sure that whatever attack the FBI used relied on the fact that the phone in question had a short passcode set. I'd bet dollars to donuts that whatever attack they used would not work against my phone with a secure passphrase. I'm usually a fan of Schneier, but I think he really missed with this one.

jacquesm 11y ago
Sad to see this downvoted, it's as far as I can see absolutely accurate.
llamataboot 11y ago
This is pedantic in my opinion. The main point of the article was that the FBI found a vulnerability. So before it was likely an unknown vulnerability, now it is known by law enforcement. The whole point of the article was that responsible organizations disclose vulnerabilities so that companies can make their software/hardware more secure. In this case the FBI is sitting on it, so they can continue to use it. Last week the FBI couldn't break into my iPhone. Now they /might/ be able to (it's a 6, so who knows if it is fixed). And Apple can't fix what they don't know about. Therefore, my confidence in the security of my iPhone has diminished, and it may be less secure than it was last week.
- mikeash 11y ago
  According to the article, the vulnerability was already known by a third party, and all the FBI did was ask/pay that third party to use it on this phone. I don't see how that act alters the security of iPhones. I agree that the FBI should inform Apple of the vulnerability they used. I just don't think that failing to do so makes iPhones less secure. Failing to do so leaves them as they are, and informing Apple would make iPhones more secure. I don't see this as pedantic, because it's the difference between the FBI actively harming us and the FBI merely not helping us.

incepted 11y ago

Blame the FBI? How is it the FBI's fault that this particular iPhone was not secure? It's mystifying to me how far Apple advocates will go to not blame their favorite company.

noobie 11y ago

I am sure they just hired some interns to code = 0000 While code_is_valid not true: enter code reboot device code++ Edit: I am pretty sure there's a delay in code execution registering a wrong pin hence by rebooting the phone, the wrong pins won't get detected.

hyperliner 11y ago
Good one, though I can see there is a problem with this "algorithm"! haha :-)
- noobie 11y ago
  What might it be? I assumed the code is just 4 digits long but judging by the quick downvotes people aren't even considering this to be a possibility.
  - cjbprime 11y ago
    There's a mechanism that wipes the device after too many incorrect code attempts. Disabling this mechanism was the entire point of the FBI/Apple lawsuit.
    - noobie 11y ago
      I am pretty sure a reboot bypasses that mechanism.
      - function_seven 11y ago
        Why would you be pretty sure of that? That would be totally braindead if a simple reboot bypassed the limit. It doesn't. There was a flaw in an earlier iOS version where you could reboot the phone a few milliseconds after an incorrect PIN, before the phone recorded the failure, but that was fixed some time ago.
mikeash 11y ago

S_A_P 11y ago

I think this just feeds off the myth that the iPhone was invulnerable to exploit. The average washington post reader isnt going to know the intricacies of mobile security. NPR and to some extent this article makes it seem like the iPhone was previously secure, and now less so. There is no data supporting either hypothesis, but its likely that this was not a new exploit found that the FBI used. I am curious, however, as to whether this affects only the 5c or if it affects the newer 6/6+/s/s+

deegles 11y ago
I have a CS degree and I don't know the intricacies either.

known 11y ago

Windows is less secure. Can we blame FBI?

wimagguc 11y ago

Why did the FBI drop the lawsuit against Apple in the first place? They both made it sound like the stake was much higher than unlocking the one device. Or, the FBI managed to unlock this phone and so they can unlock any other devices too, now-and-forever? They don't need a backdoor any more? Wouldn't the logical next step from Apple's side be to protect their users in their future devices? Wouldn't then the FBI have to sue them again? Feels like we are missing key facts here, and I wonder why Apple is not talking now.

XorNot 11y ago
It's a writ. It is legally only valid if there is necessity and the court must be informed if that changes.

tptacek 11y ago

Schneier has never had a strong intuition for how software vulnerabilities work. In the 2000s, he wrote articles in his newsletter blaming eEye (a security research firm then the home of Derek Soeder, Barnaby Jack, Ryan Permeh, and the like) for publishing their vulnerability research. He is at turns anti-disclosure, pro-disclosure, and all points in between.

bertil 11y ago
My understanding is that “disclosure” is a nuanced thing, time-wise: responsible disclosure is to mention the vulnerability to someone who can and is intent to fix it first, give them the time to write, test and send a patch, and then publish it. Publishing it earlier sound very unreasonable, especially before handing the details to the manufacturer. I am not familiar with what Schneier said 15 years ago, though. He might have chastised someone for doing that; he might have changed his mind. If he hasn’t in a decade and a half, I’d be shocked. I realised this morning that 15 years ago, I was proud of using SAS, “the most powerful analytics software there [was]”. I changed.
- tptacek 11y ago
  There is no such thing as "responsible disclosure". That's a term invented by vendors to coerce independent researchers into doing free work for them. Semantic drift has somewhat legitimized the term, but I think it's important we remember why it was conjured in the first place.
  - wolf550e 11y ago
    How would you call Google Project Zero's 90 day policy?
    - chopin 11y ago
      Doesn't Google do free work for the vendors with this project? I would assume so.
    - 11y ago

1632TestAccount 11y ago

Test

eggbrain 11y ago

I find myself divided on this article, as a person who values security very strongly. 1. If the vulnerability the FBI used worked because the device was an iPhone without a secure enclave, Apple probably knows how they did it, but they can't really fix devices that have already shipped without the security features. While this obviously hurts users of those phones, every phone going forward won't have this issue, and this won't be replicable on a mass scale. 2. Because this was a vulnerability that was found, not intentionally created, there is a high likelihood that the bug will be found again by security researchers, or at the very least paid for handsomely by Apple. This isn't necessarily true (Heartbleed existed for 2 years without being noticed), but it means that the vulnerability has a timetable that rapidly closes. This is far different from an _introduced_ backdoor/vulnerability, where Apple knows exactly what can be used to get into a device, but has their hands tied by the government, which would _unilaterally_ make our phones less secure. I don't like buying a door lock if I know there's a master key that can open any of the doors of that brand. 3. The author I feel is misleading when he says things like "A vulnerability in Windows 10, for example, affects all of us who use Windows 10". Even if a piece of software has a vulnerability, that vulnerability could perhaps only be exploitable under certain conditions, like software running on certain hardware (eg: without a secure enclave), or under certain conditions (passcodes of less than 4 digits). It also can be highly theoretical or impractical to do on any sort of scale -- if the vulnerability involves reading data off a hard drive using an electron microscope to check for magnetic signatures, I'm not going to be too worried that it will be abused, as the man hours to have it work for a single case would be astronomical and only feasible in the most extreme circumstances. It's probably very frustrating on Apple's part that the FBI found a vulnerability that they (likely) don't know about, and in an ideal world, governments would disclose those vulnerabilities to make us more secure. But as long as the software and hardware continue to get more secure and not intentionally crippled, any benefit they derived feels short lived at best.

coldcode 11y ago
I am sure Apple knows exactly what they did, it's their system and their own hacking team likely finds stuff like this. The key is if anyone else in the US is able to purchase this hack to unlock a phone: if they do and try to reference evidence based on that a judge will require the process be disclosed.

julie1 11y ago

Given how much corruption is revealed in wikileaks maybe less privacy is not a bad trade off. What amaze me is the tendency for our society to call for more privacy that favors the more powerful, hence the more likely to be corrupted. If we want make it easy for our leaders to be corrupted I definitively would call for more cryptography. Me except the normal "shameful" stuff from the common people I want privacy to. Like anyone I have stuff I want to hide. But, it is okay if I get _caught_. I will not say everything I did is okay, because, I still have hurt indirectly people. There are stuff I want to hide to protect myself from the intolerant crowd. But guess what, I have as much as I could went to present my excuses, and took responsibility for my own shitty actions. And for the stuff I should not be ashamed of, I don't see the need to hide it, in a democracy we have the freedom to fight for our opinions. None of my stupid stuff requiring privacy have been leading to blood being shed, exploitation, or making the market noncompetitive. With greater power/wealth should come greater transparency. And iPhone are definitively more expensive than most phones. So let's remember that is often the look from the others that makes us more virtuous, and let us all accept to live in an house made of glass (except for the bathroom, and the bedrooms). In a fair competitive market access to information is symmetrical. In a real democracy government are expected to be openly enforcing the choices of the voters. In a world tending towards virtue, there is no need for more privacy.

darkseas 11y ago

Did anyone else get the ad from Huawei? "Focus Perservere Breakthrough" ..delicious..

kazinator 11y ago

This is awful reporting. For weeks, the experts in security had been saying that FBI does not in fact need Apple's help to get into that phone; that they are just posturing in order to obtain a back door. This was posted on the ACLU website: https://www.aclu.org/blog/free-future/one-fbis-major-claims-iphone-case-fraudulent https://www.aclu.org/blog/free-future/one-fbis-major-claims-... The FBI can simply remove this chip from the circuit board (“desolder” it), connect it to a device capable of reading and writing NAND flash, and copy all of its data. It can then replace the chip, and start testing passcodes. If it turns out that the auto-erase feature is on, and the Effaceable Storage gets erased, they can remove the chip, copy the original information back in, and replace it. If they plan to do this many times, they can attach a “test socket” to the circuit board that makes it easy and fast to do this kind of chip swapping. Maybe the FBI has a secret new exploit --- or maybe they just did the above method, getting the "third party" help with the desoldering and the attachment of a socket, and hardware for reading NAND. It's just speculation. Even if the FBI are exploiting some hole, that is better than them having a back door, which is essentially a security hole put in by design. The article is speculating, and it's conflating security holes with back doors.

danielweber 11y ago
Yes. I'm not worried if the police seize a locked safe from someone and hire a safecracker to open it. That doesn't mean that I shouldn't use that safe. It may still be, in fact, the best safe for me to use.
gravypod 11y ago
I don't know about anyone else, but the iPhones seem to be the focus of all the academics that do security research. I'm always seeing X done to the iPhone. Just these past few weeks I remember seeing a key extraction done via EM emitted from the phone.

frade33 11y ago

Changelog: iOS 9.4 1st April 2016 - Fix FBI backdoor

Overtonwindow 11y ago

I completely disagree with the premise here. This is Tim Cook's fault and it should fall completely on Apple. I've been using Apple products my whole life, and I think security and privacy are great, but I don't believe for one second that Apple is the holy savior of our privacy. They fought the FBI because of marketing and profits, not out of a sense of duty to protect our privacy. I also don't buy the rhetorical come-back about those who would trade liberty for security deserve neither. There is a line between the two, and each side must give and take. If the FBI found a way to do it without Apple, bravo. Let Apple figure it out if they want. This is Apple's fault and they should not get a pass for spinning the PR in their favor.

riprowan 11y ago
You're certainly right about one thing: the people want privacy and will reward a company handsomely for delivering. In theory government is supposed to also be responsive to the will of the people especially with regards to things like privacy from government searches so I guess it's up to the reader to decide for themselves which side they're on here.
HillaryBriss 11y ago
Yeah, the "trade liberty for security" line is applied selectively, as far as I can tell. It tends to be trotted out frequently in discussions about data encryption. I don't see that line used nearly so often against traffic laws, driver's license laws, state medical board doctor licensing laws, laws banning the sale of guns to minors, compulsory education laws, childhood vaccination laws, laws banning lead in gasoline, building codes requiring the use of twelve-gauge wire in certain circuits, laws requiring carbon monoxide detectors in our bedrooms and kitchens, etc. The government is applying constraints to our lives and freedoms literally _all the time_ in the name of securing us against threats to life and health. Most people accept those trade offs. But those same people actually _do_ deserve both liberty and security.

HillaryBriss 11y ago

Bruce singles out the FBI for blame in this case, but if that's right, then whatever third party helped the FBI also deserves blame.

sveit 11y ago

Can we file a Freedom of Information Act request to have the method the FBI used disclosed?

Mistri 11y ago

TBH there have been so many security holes in the iOS software... this software did not "get less secure", it has been there all along. If you're an iPhone user, you notice the CONSTANT iOS security updates... most of them are because someone found a hole and patched it up! I just hope that the FBI lets Apple know of this hole once the case is over (but I doubt that will happen), or Apple figures out how they did it. If Apple can't find out, it won't be very easy for others to get into iPhones either... but it's still possible.

frogpelt 11y ago

Hilarious. Apple wouldn't give the FBI access but now the FBI should give Apple access to their information? This conversation has jumped the shark.

lmeunier 11y ago

I don't know why I still haven't seen this here, but there are plenty of videos on youtube on how to bypass the 10 wrong pass code limit. I don't understand, it looks so easy and still people are talking about encryption modules etc ... Am I missing something ?

intrasight 11y ago

I don't blame either of them. But I do blame users who put confidential information on their phone with the expectation that it will remain so.

wyldfire 11y ago

There's a typo in the URL for the "process" link in "They even have a process for deciding what to do when a vulnerability is discovered." Should be https://www.whitehouse.gov/blog/2014/04/28/heartbleed-understanding-when-we-disclose-cyber-vulnerabilities https://www.whitehouse.gov/blog/2014/04/28/heartbleed-unders... It's interesting that the government (at least this part: " Special Assistant to the President and Cybersecurity Coordinator") recognizes the pros/cons: > Disclosing a vulnerability can mean that we forego an opportunity to collect crucial intelligence ... Building up a huge stockpile of undisclosed vulnerabilities while leaving the Internet vulnerable and the American people unprotected would not be in our national security interest.

2ifrgtmypss 11y ago

Lol this is stupid.. nothing is secure

allemagne 11y ago

Ideally (for the FBI), the FBI would order Apple to build a backdoor into their system. This is functionally the same as ordering Apple not to patch a known vulnerability. In turn, this is functionally the same (in the short term) as not disclosing a known vulnerability to Apple. While the article's title is misleading, the FBI might as well be taking an active role in making the iPhone less secure. In communicating to the non-technical public, insisting on elaborating the difference is being pedantic.

TelAviv 11y ago

At least you're not blaming us here in Israel!

deleted 11y ago

[deleted]

ctdonath 11y ago

The "vulnerabilities equities process", adopted in 2010, requires the FBI disclose the exploit details to Apple on request. More info can be found in am EFF case: https://www.eff.org/files/2014/07/01/eff_v_nsa_odni_-_foia.pdf https://www.eff.org/files/2014/07/01/eff_v_nsa_odni_-_foia.p...

kodablah 11y ago
Maybe I misread the redacted doc [0] but from what I see, it is sent to the Entities Review Board (ERB) that then determines whether they should disseminate. I was unable to find the requirement to disclose. Can you point to it? 0 - https://www.eff.org/document/vulnerabilities-equities-process-january-2016 https://www.eff.org/document/vulnerabilities-equities-proces...

Zigurd 11y ago

There are reasons to doubt the FBI is being honest about this matter: Firstly, they must have known they could desolder and copy the chip containing the PIN-protected key, replacing it if it were erased. This method was put forward by multiple security experts. So the FBI started from a dishonest position regarding Apple being the only source of assistance. Now they claim that a mystery exploit emerged and was put to use between Sunday night and Tuesday. That's not enough time to crack the phone using a pile of chips and brute-forcing the PIN. Since the FBI started from a dishonest position, and hasn't spent enough time to plausibly have used the know approach, and they have carefully avoided saying they actually got keys and/or encrypted data out of the phone - or that they did anything at all with the phone, there is a more than small chance that the FBI has simply moved their own vague goalposts and declared that they have everything they need. Not honest or ethical.