10 ms·

FBI Makes Official Its Decision to Keep Apple iPhone Hack Secret

158 points by spuiszis 10y ago

danenania 10y ago
If the FBI can pay a million for the hack, what's stopping Apple? I'd expect them to be fully aware of it by now.
- Someone 10y ago
  I would think the fact that they don't have an official bug bounty program makes it unlikely they have an unofficial one. If you are buying, it doesn't harm to make that public. On the other hand, cases like these may make them consider starting a bug bounty program. and of course, they may already be advertising where it matters (e.g. by calling various hackers, or by using an intermediary to buy hacks) without telling the whole world.
  - Rumudiez 10y ago
    I think it would be against Apple's brand image to publicly invite people to break their software, but your last point could be the case in a very limited fashion. Apple has persisted its appearances in shipping stable, valuable software and hardware the first time quite well. No hiccups allowed here. Admitting they can't catch every last bug before release would be killing this advantage in public perception they have over competitors like Microsoft.
    - madeofpalk 10y ago
      I don't think the general public has this perception at all. Many of the non-tech (and tech) people I talk to hold off on updating iOS because they think it's always more buggy. I know people who swear by buying only the S models because they assume by then all the kinks would be ironed out and the phone will be more stable.
  - anfedorov 10y ago
    I would think the fact that they don't have an official bug bounty program makes it unlikely they have an unofficial one. Why is that? It seems to me that there are a lot of ways to run bug bounties, although I haven't thought through the details of Apple keeping theirs official / unofficial, it seems one could have arguments for having none, both, or either, depending on who you are and what kinds of bugs you are trying to get people to tell you about.
  - mjolk 10y ago
    Well, even if they're buying, that doesn't mean someone is selling. If I owned an apple tree and merchants were willing to give me $5 per piece of fruit, why would I sell the tree to a farmer for $10? That's assuming that I even want the farmer to know how I grew the tree.
    - corin_ 10y ago
      The farmer could maybe bid even higher than $10 since he's sitting on reserves of $200+ billion.
      - anfedorov 10y ago
        With that kind of reserve, is it possible that Apple simply outbids everyone for any security vulnerability placed on any market they can get in on?
- chinathrow 10y ago
  It might be a hardware flaw/hack what the company they contracted with had exploited.
- joering2 10y ago
  > If the FBI can pay a million for the hack, what's stopping Apple? Apple is not a government and does not act "in good faith of all - we the people". In other words - its okay for the GOV to pay a company to extract data from someone's phone (aka "hacking"), it is illegal for a citizen to do so, whether you're paying to crack a phone, or paying to break into someone's house.
  - pygy_ 10y ago
    They can do it all they want on their own hardware, it's called 'pen testing' (short for 'penetration').
  - Matt3o12_ 10y ago
    Organizations can also legally do that to their employees (assuming that that phone is a company phone). I've heard that some companies are very interested in restoring phones from former employers
- nashashmi 10y ago
  I don't think Apple would pay. It is a previous gen phone, and Apple isn't going to work very hard to try to secure it. The big question that looms in everyone's mind is if the hack can be used against next gen phones.
  - gherkin0 10y ago
    It Apple paid for the exploit, then they could assess if it's usable against next-gen phones.
    - ultramancool 10y ago
      But would they sell to Apple? If they do, they'd lose out on sales to other governments. Apple would probably have to pay far more than other governments who would sit on the exploit privately.
      - misnome 10y ago
        How would they necessarily know that it was apple they were selling to?
        MichaelGG 10y ago
        Yeah I always wonder what kind of "black ops" such huge companies/fortunes end up with. Do they really not have this kind of stuff? I have first/second-hand knowledge they have fairly competent internal affairs people that will do things akin to spying to find, say, internal corruption. (i.e. a manager in one part of the corp stealing money.) Seems like for critical things they should have no problem setting up fake companies or handling espionage, etc. What stops them, from, say, paying an employee a large bonus to work for a competitor while feeding back information?
        ultramancool 10y ago
        Depends who they're willing to sell to obviously. If they're only looking to sell to governmental agencies, it should be easy enough to confirm the people they're selling to are such agents. It's definitely true of a $10k exploit which might be readily available on the market, but for something more unique like this they might be more selective with their buyers to protect future profits.
- Matt3o12_ 10y ago
  Maybe they don't want to sell it to apple because, assuming Apple hasn't already fixed it and it is found in further generation phones, they could sell this exploit once to Apple or to quite a few big companies, governments and other entities. Please keep in mind that we still don't know how they did that. They could have just dumped the flash memory And flashed it again if 10 passcodes failed (my guess), or they might have exploited a software bug.
- antihero 10y ago
  In a fun turn of events, if Apple bought the exploit and it could be proven that they did, they could be expected to use it at the FBI's request in the future.
  - Zhenya 10y ago
    You buy it to learn its function and then patch. The whole idea is to make attack method worthless.
    - antihero 10y ago
      Yeah, but for iPhones that haven't received said patch, you provably know how to exploit them.
- intrasight 10y ago
  I expect that the FBI bought an exclusive
- lysp 10y ago
  If I was the 3rd party and was being paid $1m a pop to use the exploit, why would they want to give the details to Apple to get it patched and lose their pay-day?
digler999 10y ago
Micro-probing the bus lines, to disable the self-destruct or time-delay counter ? Or perhaps "glitching", sending badly-timed signals to the specific part of the asic that keeps count of the number of bad tries, causing it to lock up. Then brute forcing it at high speed.
- j1vms 10y ago
  > sending badly-timed signals to the specific part of the asic I would imagine that sort of thing would be very expensive to do correctly, unless you are only talking about feeding badly-timed signals at the asic pins.
  - digler999 10y ago
    someone out there helped design the asic/MCU that does this. individuals on that team would know how to do it very easily because they built the freakin' thing.
nodesocket 10y ago
I assume Apple already knows the hack/vulnerability. Apple should announce they know it, fix it, and give the FBI a big F-U.
- unlinker 10y ago
  What makes you assume that?
- mhurron 10y ago
  Why would you assume that?
- lostgame 10y ago
  Uh...this is probably a hardware flaw. Without recalling all iPhones prior to the Secure Enclave, I'm not exactly sure how they would 'fix it'.
- yuzi 10y ago
  It's more likely that Apple did the work for them and they are both hiding it.
- Rantenki 10y ago
  There is no reason to assume that apple is either aware of the bug, or that they assisted the FBI in breaking the phone. It is not only common, but NORMAL for hackers to have unknown exploits before the vendor is aware of them. Where do you think 0-days come from? In fact, there is an annual competition to break these devices with previously unknown attacks at CanSecWest. Example: http://9to5mac.com/2014/11/13/iphone-5s-samsung-galaxy-s5-nexus-5-hacked-pwn2own/ http://9to5mac.com/2014/11/13/iphone-5s-samsung-galaxy-s5-ne...
- Someone 10y ago
  How would Apple know that _a_ vulnerability they know of is _the_ vulnerability that the FBI used, and that the FBI does not want to talk about, other than that it gave it access to one iPhone 5?
Esau 10y ago
I personally don't have a problem with this, just as I had no problem with Apple not wanting to help the government with an investigation. I don't think it is right to want it both ways.
- ksdale 10y ago
  I'm not sure I have a problem with this, but I think it's perfectly consistent to want it both ways. There are plenty of rights that accrue to citizens that don't accrue to government actors and vice versa.
  - nashashmi 10y ago
    > rights that accrue to citizens that don't accrue to government Apple should not be compelled to help the government break into one of its devices. But they can "choose" to help the government break in. Likewise, government should not be compelled to help secure its companies by buying zero-days off the black market for public security. But again they can "choose" to. The cooperation of corporations and goverments is a symbol of trade and teamwork. The lack of cooperation is a symbol of distrust and hostility.
    - woodman 10y ago
      > ...government should not be compelled... Yes, it should. Who is working for who here? I can understand someone delegating the initial implementation details of a public service to the state, but to say that the state shouldn't be subject to the demands of the public - well that is just insane. > ...trade and teamwork. The lack of cooperation is a symbol of distrust and hostility. Teamwork conveys some idea of equality, which isn't going to work if you're interested in maintaining the idea of "public servant". The state's degree of trust in the public (corporate or individual) is irrelevant, the state doesn't get to selectively perform its duties on such a basis.
- r0m4n0 10y ago
  The government doesn't get to play by the same rules as private companies. They don't get to operate under a veil of secrecy unless they can justify why so. They really didn't provide useful details in this article but claiming ignorance seems absurd and a bit of an eye for an eye mentality...
haberman 10y ago
I've never seen government decision-making work first-hand, so I wouldn't claim that this speculation should carry weight. But if I was someone on the FBI side who wanted to "win" this somehow, I could imagine how this might look like a victory. Apple wanted for its phones to look so secure that they will even stand up to the government to protect them. In response, the FBI made Apple's phones look so weak that anyone who has $1M to spend on the black market can get in.
- simondedalus 10y ago
  spending $1m to get into a 5c isn't exactly a PR disaster for apple.
  - nxzero 10y ago
    Agree, Is anyone even able to cite another singlural exploit that was solid for over a million?
    - ProAm 10y ago
      Most of those exploits that cost that kind of money are kept secret, the only reason we know about this one is because of the court case.
    - TACIXAT 10y ago
      Only seen that price for iOS jailbreaks. [1][2] 1. https://www.theguardian.com/technology/2015/nov/03/jailbreak-for-iphones-wins-1m-bounty-zerodium-apple https://www.theguardian.com/technology/2015/nov/03/jailbreak... 2. http://www.ibtimes.com/ios-9-jailbreak-reward-zerodium-offers-1-million-bounty-hackers-unlock-apples-latest-2106420 http://www.ibtimes.com/ios-9-jailbreak-reward-zerodium-offer...
  - r00fus 10y ago
    Exactly - anyone security conscious and even partially informed (or relying on those who are informed) would see this as a reason to upgrade to secure-enclave enabled device (ie, iPhone5S or better).
dimino 10y ago
Just seems petty of the FBI to actually make an official announcement like this. I get if it's understood that they're not releasing it, but why make a formal press release about it?
mikx007 10y ago
What would stop one or couple of apple engineers from creating a backdoor and then selling a "unlock service" trough some foreign intermediary making $1 mil each time?
- eumoria 10y ago
  probably the threat of being caught and subsequent consequences probably stop them. also (not saying Apple does and it's hard to do) but companies compartmentalize portions of software making it difficult for an individual to go rouge and break apart the security. higher up engineers probably could but the risk is pretty crazy especially with the new "we can just do whatever we want" terror laws that they would probably lay on them
  - therein 10y ago
    > not saying Apple does and it's hard to do) but companies compartmentalize portions of software making it difficult for an individual to go rouge and break apart the security Apple does this to an extreme. You can't even see the code to projects you are not on. Oh someone else's code has a bug? Well, you can do symbol search across the entire codebase but you will get the line featuring the symbol, the line above it and the line below it.
- zeckalpha 10y ago
  What would stop one or couple of TLA agents to get jobs as apple engineers, create a backdoor and then selling a "unlock service" trough some foreign intermediary making $1 mil each time to avoid VEP?
JustSomeNobody 10y ago
Would FOIA apply here in any way?
- djrogers 10y ago
  They could just reject the FOIA claim, stating it's part of an 'active investigation' for the next decade or so.
godgod 10y ago
The FBI is the criminal government.
pcl 10y ago
This is a scary precedent. From the bits I've seen of it, the Vulnerabilities Equities Process is a really great bit of government transparency, run by a group of people who understand that the best interests of different parts of the government and the citizens of the country often end up at odds. The process allows for vulnerabilities to be periodically reviewed so that the costs and benefits of not disclosing can be weighed over time, and by an at-least-somewhat independent group. Just skipping it altogether because "we paid a contractor" completely subverts the process. What's stopping all the TLAs from simply routing all their vulns through a private third party and bypassing the VEP altogether?
- nxzero 10y ago
  Makes you wonder who is really "Public Enemy No. 1" now.
  - ilyanep 10y ago
    Public: enemy no. 1
- kodablah 10y ago
  How are they supposed to submit a vulnerability they don't know about? I'm willing to bet they chose to remain willfully ignorant of the details. Are you saying they should not be allowed to outsource the work but instead must obtain the full exploit or nothing? The real scary precedent is that they paid that much without obtaining the vulnerability exclusively and the technical aspect behind it. Or maybe it's not a scary precedent (except in tax monies) that they outsourced the vulnerability without obtaining the know-how to reuse it on a whim. Either way you look at it, it is opaque, regardless of whether it goes through the VEP (and the ERB within) or they use a secret company. Were one way more transparent than the other then we should definitely favor that approach.
- deleted 10y ago
  [deleted]
- bhuga 10y ago
  It's bad enough that the VEP was bypassed, but the high-profile, 7-figure payout for the security researchers who had their hands on the bug is a problem too. Plenty of bug bounty programs have remote code execution at $10k, but the FBI paid _100 times_ that. That's an amount of money that some bug hunters might find very challenging to turn down. And this is "above board", with no shady bitcoin payments from dingy IRC channels.
taildrop 10y ago
This might be great for the FBI right up until they actually try to use the evidence in court. The defense attorney can claim (rightly so) that unless they can examine the unlock method to verify it doesn't tamper with any of the data on the phone, the evidence is inadmissible. The only way the FBI will be able to use this data in court is if they turn the process over to the defense so they can have the process independently verified. Since the article states that they don't have access to the "technical details" of the hack, they have no way to prove the method doesn't manipulate the data on the device.
- djrogers 10y ago
  This was never intended to be used in court - the guy who carried the phone is dead, as is his wife and partner-in-slaughter.
  - dantillberg 10y ago
    Information obtained from the phone could have been used to implicate a third party, though.
    - MaulingMonkey 10y ago
      That's what parallel construction is for :(
      - seanp2k2 10y ago
        If they already had all the logs of everything happening on the Internet and cell networks for that device, why even go through hacking the device?
        justinlardinois 10y ago
        My understanding is that the FBI wanted to see which, if any, third party messaging services the phone's owner was using and his usernames so they could serve a subpoena to those services.
djrogers 10y ago
https://www.whitehouse.gov/the-press-office/2015/02/13/executive-order-promoting-private-sector-cybersecurity-information-shari https://www.whitehouse.gov/the-press-office/2015/02/13/execu... Then again, goose!=gander
Claudus 10y ago
Not to be a conspiracy theorist, but maybe they don't actually have a hack. Maybe they just want people to think they do.
- delecti 10y ago
  That seems like the most likely explanation to me too.
  - meddlepal 10y ago
    Really the most likely explanation is that Apple writes security bug free code? My guess is the FBI found someone who knew how to exploit the phone or asked a 3rd party with connections to the NSA so there is a level of plausible deniability on the origins.
    - delecti 10y ago
      There are obviously security bugs in Apple's code, almost certainly some which allow for breaking into a device. That's even more likely to be true because the device in question wasn't fully updated. However, the situation as I see it is this: The FBI realized they were going to lose their legal battle to compel Apple to unlock the phone in question. They then retracted their suit to avoid a precedent being set against them, and announced "don't worry guys, we got in anyway" to deflect attention from that particular iPhone, which they had argued was where the situation would end in the first place. Your explanation is certainly possible, I just don't think it's as likely that they would really spend $1m on this phone which in all likelihood has nothing of value on it to begin with.
      - janekm 10y ago
        For a government agency to spend money is not as undesirable as it would be for you and me. Budgets have to be justified, and not spending money leads to reduced budgets (and hence reduced influence). Spending budget on high-profile projects can be seen as beneficial to career advancement. Though, $1 million wouldn't get you far if it wasn't for the high-profile nature of this "project"...
coherentpony 10y ago
Oh, now they care about privacy.
justinlardinois 10y ago
Did any of the commenters here actually read the article? Although the FBI paid more than $1.3 million for the method, Amy Hess, the agency’s executive assistant director for science and technology, said Wednesday that it didn’t purchase the rights to the technical details and therefore doesn’t have the necessary information to submit the method for an Obama administration review known as the Vulnerabilities Equities Process. "The FBI assesses that it cannot submit the method to the VEP," Hess said in a statement. "We do not have enough technical information about any vulnerability that would permit any meaningful review.” ... The law enforcement agency bought the hacking tool from an entity it hasn’t identified and then used it to access data on an encrypted iPhone It sounds like the FBI doesn't actually understand the details of how the crack worked and was hand-holded through the process.
- sprucely 10y ago
  How could any information obtained in such a way be useful to them, as there is no way to prove it is not tainted (chain of custody and all that?)
  - uxp 10y ago
    It's not useful for them for any specific investigation, but it certainly can tell them where they might stick their fingers next.
  - ikeboy 10y ago
    https://news.ycombinator.com/item?id=11585324 https://news.ycombinator.com/item?id=11585324 tl;dr tainted refers to evidence obtained illegally and is not applicable here.
- williamscales 10y ago
  I think the general implication that's being suggested is that the FBI is all too happy to not know the details. It sets a dangerous precedent where these sorts of things are routed through contractors so that safeguards like the VEP are bypassed.
davesque 10y ago
So, if I understand correctly, the FBI doesn't really know how the phone was hacked? Wouldn't that also mean that they don't really know if the data their contractors retrieved from the phone is really from the phone?
- awqrre 10y ago
  "randomly" generated data, to assure accuracy
CamperBob2 10y ago
Translation: We got taken for a $1M ride, and have neither a valid exploit nor any data to disclose.
pfista 10y ago
Isn't this title a little misleading if they never knew the actual technical process of hacking the iPhone? They can't share what they don't know.
zmmmmm 10y ago
I hope that the security community reciprocates: if the FBI won't disclose security flaws to the community, then neither should the security community give the FBI any special privilege or notice in disclosing flaws in FBI software. The FBI might then learn about the benefits of disclosure the hard way.
icpmacdo 10y ago
These times are so interesting. The FBI is making policy that they wont expose the 0 days they bought for over a million USD. We need to consider the amount of cool things we learn right now and appreciate it.
yeukhon 10y ago
Are we sure the FBI is not bluffing?
namelezz 10y ago
Is FBI faking again [1]? [1] - https://news.ycombinator.com/item?id=11578240 https://news.ycombinator.com/item?id=11578240
mattnumbe 10y ago
Ive got a friend at Sun Corporation who, a few weeks ago, when I congratulated her on the recent (unconfirmed) news of her company, she said it was Cellebrite's news and not theirs.
krisgenre 10y ago
I am really beginning to think if the FBI actually used a hack. There were reports that the passcode was changed when in FBI's possession, what if this was just a deliberate attempt to force Apple to create a backdoor?
- madaxe_again 10y ago
  You mean they had access in the first place, and this is all smoke and mirrors to cover the fact that they were bluffing when they were trying to subvert apple, and there is no hack? Plausible, actually - and if they wanted a cover story that would cause apple as much collateral damage as possible, they've chosen well - as blowback doesn't matter to the FBI. They're untouchable gods, above the law, above public sentiment.

158 points by spuiszis 10y ago

danenania 10y ago

If the FBI can pay a million for the hack, what's stopping Apple? I'd expect them to be fully aware of it by now.

Someone 10y ago
I would think the fact that they don't have an official bug bounty program makes it unlikely they have an unofficial one. If you are buying, it doesn't harm to make that public. On the other hand, cases like these may make them consider starting a bug bounty program. and of course, they may already be advertising where it matters (e.g. by calling various hackers, or by using an intermediary to buy hacks) without telling the whole world.
- Rumudiez 10y ago
  I think it would be against Apple's brand image to publicly invite people to break their software, but your last point could be the case in a very limited fashion. Apple has persisted its appearances in shipping stable, valuable software and hardware the first time quite well. No hiccups allowed here. Admitting they can't catch every last bug before release would be killing this advantage in public perception they have over competitors like Microsoft.
  - madeofpalk 10y ago
    I don't think the general public has this perception at all. Many of the non-tech (and tech) people I talk to hold off on updating iOS because they think it's always more buggy. I know people who swear by buying only the S models because they assume by then all the kinks would be ironed out and the phone will be more stable.
- anfedorov 10y ago
  I would think the fact that they don't have an official bug bounty program makes it unlikely they have an unofficial one. Why is that? It seems to me that there are a lot of ways to run bug bounties, although I haven't thought through the details of Apple keeping theirs official / unofficial, it seems one could have arguments for having none, both, or either, depending on who you are and what kinds of bugs you are trying to get people to tell you about.
- mjolk 10y ago
  Well, even if they're buying, that doesn't mean someone is selling. If I owned an apple tree and merchants were willing to give me $5 per piece of fruit, why would I sell the tree to a farmer for $10? That's assuming that I even want the farmer to know how I grew the tree.
  - corin_ 10y ago
    The farmer could maybe bid even higher than $10 since he's sitting on reserves of $200+ billion.
    - anfedorov 10y ago
      With that kind of reserve, is it possible that Apple simply outbids everyone for any security vulnerability placed on any market they can get in on?
chinathrow 10y ago
It might be a hardware flaw/hack what the company they contracted with had exploited.
joering2 10y ago
> If the FBI can pay a million for the hack, what's stopping Apple? Apple is not a government and does not act "in good faith of all - we the people". In other words - its okay for the GOV to pay a company to extract data from someone's phone (aka "hacking"), it is illegal for a citizen to do so, whether you're paying to crack a phone, or paying to break into someone's house.
- pygy_ 10y ago
  They can do it all they want on their own hardware, it's called 'pen testing' (short for 'penetration').
- Matt3o12_ 10y ago
  Organizations can also legally do that to their employees (assuming that that phone is a company phone). I've heard that some companies are very interested in restoring phones from former employers
nashashmi 10y ago
I don't think Apple would pay. It is a previous gen phone, and Apple isn't going to work very hard to try to secure it. The big question that looms in everyone's mind is if the hack can be used against next gen phones.
- gherkin0 10y ago
  It Apple paid for the exploit, then they could assess if it's usable against next-gen phones.
  - ultramancool 10y ago
    But would they sell to Apple? If they do, they'd lose out on sales to other governments. Apple would probably have to pay far more than other governments who would sit on the exploit privately.
    - misnome 10y ago
      How would they necessarily know that it was apple they were selling to?
      - MichaelGG 10y ago
        Yeah I always wonder what kind of "black ops" such huge companies/fortunes end up with. Do they really not have this kind of stuff? I have first/second-hand knowledge they have fairly competent internal affairs people that will do things akin to spying to find, say, internal corruption. (i.e. a manager in one part of the corp stealing money.) Seems like for critical things they should have no problem setting up fake companies or handling espionage, etc. What stops them, from, say, paying an employee a large bonus to work for a competitor while feeding back information?
      - ultramancool 10y ago
        Depends who they're willing to sell to obviously. If they're only looking to sell to governmental agencies, it should be easy enough to confirm the people they're selling to are such agents. It's definitely true of a $10k exploit which might be readily available on the market, but for something more unique like this they might be more selective with their buyers to protect future profits.
Matt3o12_ 10y ago
Maybe they don't want to sell it to apple because, assuming Apple hasn't already fixed it and it is found in further generation phones, they could sell this exploit once to Apple or to quite a few big companies, governments and other entities. Please keep in mind that we still don't know how they did that. They could have just dumped the flash memory And flashed it again if 10 passcodes failed (my guess), or they might have exploited a software bug.
antihero 10y ago
In a fun turn of events, if Apple bought the exploit and it could be proven that they did, they could be expected to use it at the FBI's request in the future.
- Zhenya 10y ago
  You buy it to learn its function and then patch. The whole idea is to make attack method worthless.
  - antihero 10y ago
    Yeah, but for iPhones that haven't received said patch, you provably know how to exploit them.
intrasight 10y ago
I expect that the FBI bought an exclusive
lysp 10y ago
If I was the 3rd party and was being paid $1m a pop to use the exploit, why would they want to give the details to Apple to get it patched and lose their pay-day?

digler999 10y ago

Micro-probing the bus lines, to disable the self-destruct or time-delay counter ? Or perhaps "glitching", sending badly-timed signals to the specific part of the asic that keeps count of the number of bad tries, causing it to lock up. Then brute forcing it at high speed.

j1vms 10y ago
> sending badly-timed signals to the specific part of the asic I would imagine that sort of thing would be very expensive to do correctly, unless you are only talking about feeding badly-timed signals at the asic pins.
- digler999 10y ago
  someone out there helped design the asic/MCU that does this. individuals on that team would know how to do it very easily because they built the freakin' thing.

nodesocket 10y ago

I assume Apple already knows the hack/vulnerability. Apple should announce they know it, fix it, and give the FBI a big F-U.

unlinker 10y ago
What makes you assume that?
mhurron 10y ago
Why would you assume that?
lostgame 10y ago
Uh...this is probably a hardware flaw. Without recalling all iPhones prior to the Secure Enclave, I'm not exactly sure how they would 'fix it'.
yuzi 10y ago
It's more likely that Apple did the work for them and they are both hiding it.
Rantenki 10y ago
There is no reason to assume that apple is either aware of the bug, or that they assisted the FBI in breaking the phone. It is not only common, but NORMAL for hackers to have unknown exploits before the vendor is aware of them. Where do you think 0-days come from? In fact, there is an annual competition to break these devices with previously unknown attacks at CanSecWest. Example: http://9to5mac.com/2014/11/13/iphone-5s-samsung-galaxy-s5-nexus-5-hacked-pwn2own/ http://9to5mac.com/2014/11/13/iphone-5s-samsung-galaxy-s5-ne...
Someone 10y ago
How would Apple know that _a_ vulnerability they know of is _the_ vulnerability that the FBI used, and that the FBI does not want to talk about, other than that it gave it access to one iPhone 5?

Esau 10y ago

I personally don't have a problem with this, just as I had no problem with Apple not wanting to help the government with an investigation. I don't think it is right to want it both ways.

ksdale 10y ago
I'm not sure I have a problem with this, but I think it's perfectly consistent to want it both ways. There are plenty of rights that accrue to citizens that don't accrue to government actors and vice versa.
- nashashmi 10y ago
  > rights that accrue to citizens that don't accrue to government Apple should not be compelled to help the government break into one of its devices. But they can "choose" to help the government break in. Likewise, government should not be compelled to help secure its companies by buying zero-days off the black market for public security. But again they can "choose" to. The cooperation of corporations and goverments is a symbol of trade and teamwork. The lack of cooperation is a symbol of distrust and hostility.
  - woodman 10y ago
    > ...government should not be compelled... Yes, it should. Who is working for who here? I can understand someone delegating the initial implementation details of a public service to the state, but to say that the state shouldn't be subject to the demands of the public - well that is just insane. > ...trade and teamwork. The lack of cooperation is a symbol of distrust and hostility. Teamwork conveys some idea of equality, which isn't going to work if you're interested in maintaining the idea of "public servant". The state's degree of trust in the public (corporate or individual) is irrelevant, the state doesn't get to selectively perform its duties on such a basis.
r0m4n0 10y ago
The government doesn't get to play by the same rules as private companies. They don't get to operate under a veil of secrecy unless they can justify why so. They really didn't provide useful details in this article but claiming ignorance seems absurd and a bit of an eye for an eye mentality...

haberman 10y ago

I've never seen government decision-making work first-hand, so I wouldn't claim that this speculation should carry weight. But if I was someone on the FBI side who wanted to "win" this somehow, I could imagine how this might look like a victory. Apple wanted for its phones to look so secure that they will even stand up to the government to protect them. In response, the FBI made Apple's phones look so weak that anyone who has $1M to spend on the black market can get in.

simondedalus 10y ago
spending $1m to get into a 5c isn't exactly a PR disaster for apple.
- nxzero 10y ago
  Agree, Is anyone even able to cite another singlural exploit that was solid for over a million?
  - ProAm 10y ago
    Most of those exploits that cost that kind of money are kept secret, the only reason we know about this one is because of the court case.
  - TACIXAT 10y ago
    Only seen that price for iOS jailbreaks. [1][2] 1. https://www.theguardian.com/technology/2015/nov/03/jailbreak-for-iphones-wins-1m-bounty-zerodium-apple https://www.theguardian.com/technology/2015/nov/03/jailbreak... 2. http://www.ibtimes.com/ios-9-jailbreak-reward-zerodium-offers-1-million-bounty-hackers-unlock-apples-latest-2106420 http://www.ibtimes.com/ios-9-jailbreak-reward-zerodium-offer...
- r00fus 10y ago
  Exactly - anyone security conscious and even partially informed (or relying on those who are informed) would see this as a reason to upgrade to secure-enclave enabled device (ie, iPhone5S or better).

dimino 10y ago

Just seems petty of the FBI to actually make an official announcement like this. I get if it's understood that they're not releasing it, but why make a formal press release about it?

mikx007 10y ago

What would stop one or couple of apple engineers from creating a backdoor and then selling a "unlock service" trough some foreign intermediary making $1 mil each time?

eumoria 10y ago
probably the threat of being caught and subsequent consequences probably stop them. also (not saying Apple does and it's hard to do) but companies compartmentalize portions of software making it difficult for an individual to go rouge and break apart the security. higher up engineers probably could but the risk is pretty crazy especially with the new "we can just do whatever we want" terror laws that they would probably lay on them
- therein 10y ago
  > not saying Apple does and it's hard to do) but companies compartmentalize portions of software making it difficult for an individual to go rouge and break apart the security Apple does this to an extreme. You can't even see the code to projects you are not on. Oh someone else's code has a bug? Well, you can do symbol search across the entire codebase but you will get the line featuring the symbol, the line above it and the line below it.
zeckalpha 10y ago
What would stop one or couple of TLA agents to get jobs as apple engineers, create a backdoor and then selling a "unlock service" trough some foreign intermediary making $1 mil each time to avoid VEP?

JustSomeNobody 10y ago

Would FOIA apply here in any way?

djrogers 10y ago
They could just reject the FOIA claim, stating it's part of an 'active investigation' for the next decade or so.

godgod 10y ago

The FBI is the criminal government.

pcl 10y ago

This is a scary precedent. From the bits I've seen of it, the Vulnerabilities Equities Process is a really great bit of government transparency, run by a group of people who understand that the best interests of different parts of the government and the citizens of the country often end up at odds. The process allows for vulnerabilities to be periodically reviewed so that the costs and benefits of not disclosing can be weighed over time, and by an at-least-somewhat independent group. Just skipping it altogether because "we paid a contractor" completely subverts the process. What's stopping all the TLAs from simply routing all their vulns through a private third party and bypassing the VEP altogether?

nxzero 10y ago
Makes you wonder who is really "Public Enemy No. 1" now.
- ilyanep 10y ago
  Public: enemy no. 1
kodablah 10y ago
How are they supposed to submit a vulnerability they don't know about? I'm willing to bet they chose to remain willfully ignorant of the details. Are you saying they should not be allowed to outsource the work but instead must obtain the full exploit or nothing? The real scary precedent is that they paid that much without obtaining the vulnerability exclusively and the technical aspect behind it. Or maybe it's not a scary precedent (except in tax monies) that they outsourced the vulnerability without obtaining the know-how to reuse it on a whim. Either way you look at it, it is opaque, regardless of whether it goes through the VEP (and the ERB within) or they use a secret company. Were one way more transparent than the other then we should definitely favor that approach.
deleted 10y ago
[deleted]
bhuga 10y ago
It's bad enough that the VEP was bypassed, but the high-profile, 7-figure payout for the security researchers who had their hands on the bug is a problem too. Plenty of bug bounty programs have remote code execution at $10k, but the FBI paid _100 times_ that. That's an amount of money that some bug hunters might find very challenging to turn down. And this is "above board", with no shady bitcoin payments from dingy IRC channels.

taildrop 10y ago

This might be great for the FBI right up until they actually try to use the evidence in court. The defense attorney can claim (rightly so) that unless they can examine the unlock method to verify it doesn't tamper with any of the data on the phone, the evidence is inadmissible. The only way the FBI will be able to use this data in court is if they turn the process over to the defense so they can have the process independently verified. Since the article states that they don't have access to the "technical details" of the hack, they have no way to prove the method doesn't manipulate the data on the device.

djrogers 10y ago
This was never intended to be used in court - the guy who carried the phone is dead, as is his wife and partner-in-slaughter.
- dantillberg 10y ago
  Information obtained from the phone could have been used to implicate a third party, though.
  - MaulingMonkey 10y ago
    That's what parallel construction is for :(
    - seanp2k2 10y ago
      If they already had all the logs of everything happening on the Internet and cell networks for that device, why even go through hacking the device?
      - justinlardinois 10y ago
        My understanding is that the FBI wanted to see which, if any, third party messaging services the phone's owner was using and his usernames so they could serve a subpoena to those services.

djrogers 10y ago

https://www.whitehouse.gov/the-press-office/2015/02/13/executive-order-promoting-private-sector-cybersecurity-information-shari https://www.whitehouse.gov/the-press-office/2015/02/13/execu... Then again, goose!=gander

Claudus 10y ago

Not to be a conspiracy theorist, but maybe they don't actually have a hack. Maybe they just want people to think they do.

delecti 10y ago
That seems like the most likely explanation to me too.
- meddlepal 10y ago
  Really the most likely explanation is that Apple writes security bug free code? My guess is the FBI found someone who knew how to exploit the phone or asked a 3rd party with connections to the NSA so there is a level of plausible deniability on the origins.
  - delecti 10y ago
    There are obviously security bugs in Apple's code, almost certainly some which allow for breaking into a device. That's even more likely to be true because the device in question wasn't fully updated. However, the situation as I see it is this: The FBI realized they were going to lose their legal battle to compel Apple to unlock the phone in question. They then retracted their suit to avoid a precedent being set against them, and announced "don't worry guys, we got in anyway" to deflect attention from that particular iPhone, which they had argued was where the situation would end in the first place. Your explanation is certainly possible, I just don't think it's as likely that they would really spend $1m on this phone which in all likelihood has nothing of value on it to begin with.
    - janekm 10y ago
      For a government agency to spend money is not as undesirable as it would be for you and me. Budgets have to be justified, and not spending money leads to reduced budgets (and hence reduced influence). Spending budget on high-profile projects can be seen as beneficial to career advancement. Though, $1 million wouldn't get you far if it wasn't for the high-profile nature of this "project"...

coherentpony 10y ago

Oh, now they care about privacy.

justinlardinois 10y ago

Did any of the commenters here actually read the article? Although the FBI paid more than $1.3 million for the method, Amy Hess, the agency’s executive assistant director for science and technology, said Wednesday that it didn’t purchase the rights to the technical details and therefore doesn’t have the necessary information to submit the method for an Obama administration review known as the Vulnerabilities Equities Process. "The FBI assesses that it cannot submit the method to the VEP," Hess said in a statement. "We do not have enough technical information about any vulnerability that would permit any meaningful review.” ... The law enforcement agency bought the hacking tool from an entity it hasn’t identified and then used it to access data on an encrypted iPhone It sounds like the FBI doesn't actually understand the details of how the crack worked and was hand-holded through the process.

sprucely 10y ago
How could any information obtained in such a way be useful to them, as there is no way to prove it is not tainted (chain of custody and all that?)
- uxp 10y ago
  It's not useful for them for any specific investigation, but it certainly can tell them where they might stick their fingers next.
- ikeboy 10y ago
  https://news.ycombinator.com/item?id=11585324 https://news.ycombinator.com/item?id=11585324 tl;dr tainted refers to evidence obtained illegally and is not applicable here.
williamscales 10y ago
I think the general implication that's being suggested is that the FBI is all too happy to not know the details. It sets a dangerous precedent where these sorts of things are routed through contractors so that safeguards like the VEP are bypassed.

davesque 10y ago

So, if I understand correctly, the FBI doesn't really know how the phone was hacked? Wouldn't that also mean that they don't really know if the data their contractors retrieved from the phone is really from the phone?

awqrre 10y ago
"randomly" generated data, to assure accuracy

CamperBob2 10y ago

Translation: We got taken for a $1M ride, and have neither a valid exploit nor any data to disclose.

pfista 10y ago

Isn't this title a little misleading if they never knew the actual technical process of hacking the iPhone? They can't share what they don't know.

zmmmmm 10y ago

I hope that the security community reciprocates: if the FBI won't disclose security flaws to the community, then neither should the security community give the FBI any special privilege or notice in disclosing flaws in FBI software. The FBI might then learn about the benefits of disclosure the hard way.

icpmacdo 10y ago

These times are so interesting. The FBI is making policy that they wont expose the 0 days they bought for over a million USD. We need to consider the amount of cool things we learn right now and appreciate it.

yeukhon 10y ago

Are we sure the FBI is not bluffing?

namelezz 10y ago

Is FBI faking again [1]? [1] - https://news.ycombinator.com/item?id=11578240 https://news.ycombinator.com/item?id=11578240

mattnumbe 10y ago

Ive got a friend at Sun Corporation who, a few weeks ago, when I congratulated her on the recent (unconfirmed) news of her company, she said it was Cellebrite's news and not theirs.

krisgenre 10y ago

I am really beginning to think if the FBI actually used a hack. There were reports that the passcode was changed when in FBI's possession, what if this was just a deliberate attempt to force Apple to create a backdoor?

madaxe_again 10y ago
You mean they had access in the first place, and this is all smoke and mirrors to cover the fact that they were bluffing when they were trying to subvert apple, and there is no hack? Plausible, actually - and if they wanted a cover story that would cause apple as much collateral damage as possible, they've chosen well - as blowback doesn't matter to the FBI. They're untouchable gods, above the law, above public sentiment.