25 ms·
FBI paid professional hackers one-time fee to crack San Bernardino iPhone
- x5n1 11y agoYes, yes that's exactly what happened. Apple had nothing to do with it. And that charade they put up about suing then not suing, etc, was not a charade at all. /s
- janekm 11y agoI'm continually baffled by the pathological disdain some people like yourself seem to show towards Apple... Is it the cognitive dissonance that "Google does no evil", therefore if Apple is seen working for the privacy of their users (which they have both sound business reasons and I have no reason to doubt moral convictions to do), where Google does not, then they must have a hidden agenda?
- x5n1 11y agoi said nothing about google, i am cynical about the whole industry in terms of its collusion with the government. you sound like an apple fan boy.
- janekm 11y agoFair enough, the Google comment was unfounded (and I do believe that many at Google also have strong convictions to protect their customers' privacy but it's a lot harder to do when your business model depends on storing your customers data in clear-text on your servers). Personally I am disturbed by the continual government assault on the security of personal data and I believe that companies like Apple are our strongest stalwart against it. I may be a bit of an "Apple fan boy", indeed.
- mindslight 11y agoIt's great that Apple is a company with lots of money that can stand a chance in court and all that, but that also means they're a government-legible single point of failure. Their business model is still "administer our users' devices". While this is much better than Google's "surveil our users", maintaining their privileged access puts their users at risk, as highlighted by this recent battle.
- ceejayoz 11y agoIt seems fairly clear that Apple's trying to engineer out as much of their being a single point of failure as possible.
- mindslight 11y agoI haven't heard of any plans of making the updating process more self-controlled (eg allowing users compare checksums with friends before updating, or additional third-party signatures), or hardening their firmware against local tampering (since their security model incorporates trusted computing). The references to "secure enclave" seem mostly for comparison rather than any direct analysis, and it seems like another general-purpose easily-updateable chip. It doesn't seem like it's actually possible to do all that much without releasing source for a TCB, especially with the possibility of NSL (etc) mandating secret backdoors for every device. But maybe I have just missed the recent news.
- spacecowboy_lon 11y agoI look forward to apple saying that they apply the same stance in the case of investigating miscounduct or if the CWA or Prospect in the UK started organizing apple store staff :-)
- r3bl 11y agoI completely understand your Google argument. Whenever I say that I put Google in the same basket as Facebook/Apple/(as of recently) Microsoft, I get lots and lots of people telling me how Google is not bad. In fact, in my mind, Google is even worse than the rest of the companies, because Google is the only one that has the power not only to collect my data, but to use that data to tweak my online experience. Not just on their products, but across the majority of the Internet (yes, I'm talking about their ads). I turned every single type of Google tracking off and I still feel uncomfortable using their services that are impossible to avoid completely.
- antidaily 11y agoApparently the code was 6969. Got it on the third try.
- deleted 11y ago[deleted]
- jessaustin 11y agoMissing from TFA: any consideration of whether the "work phone", which was subject at all times to repossession and inspection by San Bernardino County, stored any information about terrorism, particularly information worth overturning fundamental assumptions about the duties of electronic device manufacturers.
- janekm 11y agoIt's implicit, the equivalent of a warrant canary, if there had been anything of remote interest (which nobody expected) there would have been a lot of noise about that.
- ikeboy 11y agoIirc comey said in one interview that they wanted to know which path they went on during missing minutes on the day of the shooting when the phone was with them, and hoped the phone had location data. Edit: see http://nytimes.com/2016/03/02/technology/apple-and-fbi-face-off-before-house-judiciary-committee.html http://nytimes.com/2016/03/02/technology/apple-and-fbi-face-...
- matt_wulfeck 11y agoThat data is easily available via tower pings without needing to unlock the phone. Who sets up their phone to record constant GPS coordinates?
- janekm 11y agoAm I the only one who reads the quotes in this article as "see Apple, if you don't give us what we want then we may just have operational reasons to not disclose vulnerabilities to you, wouldn't that be a shame..."?
- beams_of_light 11y agoYep. The phone has still not been cracked, I'd bet. This is all posturing.
- mturmon 11y agoIt does come off a bit like a multidimensional pissing match - with the FBI alternately saying, "We can force you to break this phone", "We can break it ourselves if we want to", "We will break it and not tell you how", "We can insert a succession of stories in the media that will call your security into question."
- williamcotton 11y agoIt is of course a territorial pissing match. Apple, and most of Silicon Valley, thinks and acts like they are more important and powerful than the country that granted them a corporate charter and the public infrastructure with which to do business.
- duaneb 11y agoRegardless of how Apple considers themselves, I would hope most companies would conduct themselves in a similar manner w/r/t this reaction to the FBI. Of all the reasons to hate on Apple their defending their own devices' collective security should NOT be high on the list.
- williamcotton 11y agoI'm sorry, but I don't buy the collective security reasoning. I'm not convinced that there aren't large custom databases of shared private keys that can be used to grant individual, time adjusted master keys that would allow the FBI to enforce their 4th amendment duties while making it impossible for a single master key to be discovered and instantly break every devices encryption. Apple would be very liable for keeping this giant database of individual private keys safe. So would tbe FBI. But I have no doubt that it could be done. It would just take political will and perhaps a bit of novel cryptography, but if Bitcoin has shown me anything, it is that there are lots of remaining solutions to existing problems using crypto. Your issue is that you're starting with a first principle based on what applied technology can currently do instead of starting with the first principle based on the relationship between an individual, the government, and public. We should be thinking about how we can use new cryptographic technologies to assist humans instead of insisting that humans must be subjected to the technological limitations of a consumer electronics company. The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. This clearly states the government has the right to warranted search and seizure for cases in which it needs to protect the public at large. This is what takes precedence, not what Apple's current crop of cryptographers can come up with. --- EDIT: I'm sorry, but I have a rate limited account because my conservative opinions are not valued by the HackerNews community. I have some follow ups to your comments: --- > However, I also don't think Apple has a responsibility—even as a "citizen" of the country—to explicitly allow government access. First, please see my other comment related to the third-party doctrine for reference: I would argue that if we are to allow publicly chartered corporations to store and maintain access to privished works that they would have to be held liable to both the individual as well as the government. Just as banks are liable to both individual customers as well as the government. Apple clearly doesn't want this responsibility. They don't want to be liable to both the individual and the government. Or perhaps anyone. They sell shiny toys. They're really not that important and perhaps they don't really care that much about privacy beyond how it affects sales. --- > That it does. But what it does not state is that the government has a right to create laws mandating that free citizens, not accused of any crime, must only create or possess items that the government can obtain access to. Again, please see my comment related to the third-party doctrine. We're going to need some new laws related to privished works. Right now you don't really have the right to privacy outside of your private person and private property. A bank will let the government open safety deposit boxes. The bank has the keys to the vault and you don't so I think we have already have some historical precedence with which to base these new legal fundamentals. --- > Whilst I don't know whether I agree, this is an argument that needs more exposure on HN. Yeah, I wouldn't hold your breathe... I don't think you realize just how dogmatic this place is. If you say anything about being in support of the government, intellectual property, or dare question the values of the open source community, you're just immediately downvoted to fucking oblivion. Also, I kind of like being a prick to who I imagine are a bunch of stuck up yuppies, so there's that as well. But where the fuck else am I to go in San Francisco? Everywhere I am I'm just surrounded by a bunch of fearful techie drones with their fucking athleisure clothing. Everyone always has fucking headphone on and is glued to their god damned phones, I can't start a conversation with anyone anyways. There's no discourse happening anywhere! All I can do now is just fucking rant and rave on HackerNews comments in the hope that someone out there might be fucking listening for a god damned change!!!! --- > However, your last three paras are quite insufferable and if I were you I would reconsider your relationship with the HN community. I have considered my relationship with HackerNews to be over for quite some time. Right now I'm just seeing how far I can push it before I get banned. That you vehemently disagree with me is WHY I AM SO FUCKING PISSED OFF! Everyone here uses the downvote button for disagreement because they're lazy fucking assholes who can't really approach my arguments. This is the number one place for discussion about technology on the web, or perhaps anywhere. I'm very well qualified to talk about tech and tech policy. Yet my ideas are constantly shit on by a bunch of ignorant and dogmatic cocksuckers. I want to see just how long YOU could put up with this abuse before you FUCKING SPRUNG A GOD DAMNED LEAK IN YOUR BRAIN! This whole "community" is insufferable and my actions are really a quite logical reflection of the kind of discourse that takes place in these forums.
- nodesocket 11y ago> "The U.S. government now has to weigh whether to disclose the flaws to Apple..." Apple is going to find the flaw. They wrote all the code and have some of the smartest people in the world working there. No reason for Apple to even ask the government to disclose the vulnerability to them.
- mkoryak 11y agoThats assuming that this flaw exists, and that the FBI is telling us the truth...
- piyush_soni 11y agoWell, the same smartest people unknowingly put the bug there. It's not as easy to find a security flaw (without someone telling about it) as you think. They'll eventually figure it out, but may be not immediately.
- zxv 11y agoResponsible disclosure involves notifying the vendor (Apple) first. https://en.wikipedia.org/wiki/Responsible_disclosure https://en.wikipedia.org/wiki/Responsible_disclosure If the FBI wanted to protect the public, responsible disclosure of the exploit is a first step. Sigh.
- coderdude 11y agoResponsible disclosure isn't the FBI's most effective way of protecting the public.
- CiPHPerCoder 11y agoAs much as I'm inclined to agree with this line of argument in this particular case, I do take issue with the term "responsible disclosure" for many of the reasons outlined here: https://adamcaudill.com/2015/11/19/responsible-disclosure-is-wrong/ https://adamcaudill.com/2015/11/19/responsible-disclosure-is...
- wcummings 11y agoI don't like what the FBI has done, but I'll say what I always say when "responsible" disclosure comes up, for consistency. Responsible disclosure is a courtesy. Exploits are valuable. Information asymmetry is the name of the game. Apple is not entitled to free labor. If they don't like it they should hire researchers, as the FBI has.
- beedogs 11y agoI knew those clowns couldn't have done it themselves. The FBI are more or less inept.
- ocfx 11y agoI think most people couldn't do it. Wouldn't consider the FBI inept because they don't house programmers specifically for a single purpose. If they have the resources to get someone else to do it that is the opposite of inept.
- droopybuns 11y agoPhilosophical rudderlessness: Fidelitry, Bravery, Integrity. If you want a successful career in public service, don't serve the public. The FBI does not want the public protected from this vulnerability.
- themartorana 11y agoThe FBI is willing to protect you how they see fit only, notwithstanding how that may fit within the bounds of Constitutionality. If you are not willing to give up such rights, the FBI will protect you through any means necessary - through force if it comes to it.
- smegel 11y agoI suspected as much. Those guys who kept jailbreaking time after time seem like good candidates.
- rasz_pl 11y agogeohot is busy doing car AI
- PascalsMugger 11y agoI wonder what the price was.
- Azkar 11y agoHow come the FBI isn't afraid these guys are going to sell the same exploit to foreign governments which will use them to break into US government phones?
- roel_v 11y ago? The FBI probably assumes that yes, other actors do have access to unknown exploitable vulnerabilities. It's 2016. Any data that hasn't been airgapped for the entirety of its existence needs to be considered if not public, then at least known to the enemy. (if accountants in tax havens would take that to heart, they wouldn't be in the predicament they are in now...)
- deleted 11y ago[deleted]
- madaxe_again 11y agoSorry, but selling to corrupt governments for personal profit makes you black, not grey, hat.
- ComodoHacker 11y agoSo not the NAND mirroring thing, right? Just a software exploit?
- facepalm 11y agoJust had a thought: couldn't you copy the encrypted phone, run it in 10000 emulators and try a different PIN in every emulator? If the problem really is just a 4 digit PIN, that should work? Or is the flash memory and the flash memory controller doing the decryption entangled on a single chip so that they can not be physically separated?
- zakarum009 11y agoFBI also paid professional researchers to deanonymize the Tor network, so I don't see how this comes as a surprise to anyone.
- wdr1 11y agoWorking under the assumption the FBI works for us, the people, I would hope two things: 1) They disclose the vulnerability to Apple and make us all safer 2) Having now unlocked the phone, disclose if there was additional information that materially helped the case. I'm cynical about them doing either, but I think they're both reasonable requests from the population.
- begemotz 11y agoDid the FBI pay for them to hack or pay for the (exclusive rights to the) exploit? The rest of the article implies the latter- but if the former, what is stopping Apple from paying the "hackers" for the exploit?
- bogomipz 11y agoDoes any suspect that this might all just be PR posturing? They found a zero day exploit but they don't have to say what it was. They don't have to whether or not more interesting data was found. Nothing. Could it be they are just trying to save face? Granted they've looked quite foolish in all of this but still.