14 ms·
The Feds Can Now Probably Unlock Every iPhone Model
- eridius 9y agoBruce Schneier says¹: > There's also a credible rumor that Cellebrite's mechanisms only defeat the mechanism that limits the number of password attempts. It does not allow engineers to move the encrypted data off the phone and run an offline password cracker. If this is true, then strong passwords are still secure. ¹https://www.schneier.com/blog/archives/2018/02/cellebrite_unlo.html https://www.schneier.com/blog/archives/2018/02/cellebrite_un...
- IBM 9y ago>The story I hear is that Cellebrite hires ex-Apple engineers and moves them to countries where Apple can't prosecute them under the DMCA or its equivalents. Crazy if true. Doesn't this also create a weird incentive problem where the FBI (or any other law enforcement agency) who would normally be tasked with helping Apple with this doesn't actually want to?
- 908087 9y ago1984: CIA smuggles cocaine into the US 2018: FBI smuggles Apple engineers out of the US
- deleted 9y ago[deleted]
- guelo 9y agoSo Israel is like a high tech Guantanamo where our government goes when those pesky laws get in the way.
- Bitcoin_McPonzi 9y agoCellebrite is a Japanese company, a subsidiary of Japan Sun Corporation.
- programmarchy 9y agoNone of the executive team is Japanese (the CEO is Israeli), and most of the positions they are hiring for are located in Israel...
- Bitcoin_McPonzi 9y agoOk then. I guess Apple's a Chinese company or an Irish Company or a Singaporean company because they have subsidiaries--each with a local CEO--in each of those countries: http://www.nytimes.com/interactive/2013/05/21/business/apples-international-structure.html http://www.nytimes.com/interactive/2013/05/21/business/apple...
- khedoros1 9y agoCellebrite itself is an Israeli company, despite being a subsidiary of a Japanese one. Apple is an American company, but they have foreign subsidiaries like Shazam Entertainment, which is a British company. If Apple Singapore is a full subsidiary, then sure, that's a Singaporean company, but Apple Inc wouldn't be.
- walrus01 9y agoRelative to the size of its population, Israel has a highly developed electronics engineering related industry. Part of it related to their state support of domestic defense contractors like IAI and their avionics/radar/C4I equipment. Aside from Cellbrite, companies like Ceragon, Alvarion, Radwin, ECI, Telrad, Elbit. Second hand knowledge: Within international organizations that have worked extensively in the Israel-Lebanon border area it is well known that Israel has pwned most of the Lebanese telecoms and ISPs quite thoroughly. To the extent that Hezbollah started laying its own fiber optic cables. https://www.google.com/search?client=ubuntu&channel=fs&q=hezbollah+fiber+optic+cables&ie=utf-8&oe=utf-8 https://www.google.com/search?client=ubuntu&channel=fs&q=hez...
- walrus01 9y agoWithin ten seconds of searching my memory I can think of at least three Israeli companies that are known for researching/hoarding secret zero days and making use of them for large sums of money. Cellebrite, NSO, and Elbit. https://www.forbes.com/sites/thomasbrewster/2016/08/25/everything-we-know-about-nso-group-the-professional-spies-who-hacked-iphones-with-a-single-text/#3e78a8653997 https://www.forbes.com/sites/thomasbrewster/2016/08/25/every... Elbit is a big defense contractor and basically wants to simultaneously be a competitor of General Dynamics and Palantir.
- dogma1138 9y agoThe DMCA is applicable in Israel via the bilateral trade agreement with the US.
- DaiPlusPlus 9y agoThe DMCA is not concerned with the security of Apple’s devices or “Secure Enclave” as Apple never said they existed for the sake of protecting copyright - that’s iTMS’s DRM which is entirely unrelated.
- dogma1138 9y agoI didn’t said it was applicable in this case however US copyright laws are enforced over most of the world in one way or another via the trade agreements basically any deal that the US signs has a clause about respecting US copyright and a mechanism through which to seek grievances.
- uptown 9y agoExactly: https://youtu.be/oYNXVgYhPOc https://youtu.be/oYNXVgYhPOc Listen carefully to the choice and emphasis on words.
- qrbLPHiKpiux 9y agoJames Mickens said, “YOU’RE STILL GONNA BE MOSSAD’ED UPON”
- zbentley 9y agohttps://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf
- rayiner 9y agoNo? The law doesn’t prevent the government from searching your property in a wide range of circumstances: e.g. with a warrant, pursuant to a valid arrest, etc. That’s the whole idea of warrants: so there is a controlled way to search private property. The government goes to Israel to defeat technological roadblocks to doing what it’s allowed to do under the law. This technology isn’t being used to break into phones at surprise checkpoints, it’s being used to search phones of people who have been arrested.
- wu-ikkyu 9y agoHow do you know what it's being used for?
- rayiner 9y agoThe iPhone hacks by their nature require having custody of the physical cell phone for an extended period of time. As far as I know, the government isn’t stealing peoples iPhones to search them.
- veidr 9y ago> As far as I know, the government isn’t stealing peoples iPhones to search them. Well, OK, now you know: The US government seizes phones and laptops, "without showing reasonable suspicion of a crime or getting a judge’s approval", on a regular basis, and has done so for a number of years. https://www.politico.com/story/2013/09/laptop-seizure-border-096516 https://www.politico.com/story/2013/09/laptop-seizure-border... https://www.theregister.co.uk/2017/03/16/canadian_privacy_commissioner_to_investigate_border_phone_seizures/ https://www.theregister.co.uk/2017/03/16/canadian_privacy_co... https://www.nytimes.com/2017/09/13/technology/aclu-border-patrol-lawsuit.html https://www.nytimes.com/2017/09/13/technology/aclu-border-pa... http://www.bbc.com/news/magazine-25458533 http://www.bbc.com/news/magazine-25458533 (et fuckin' cetera...)
- rayiner 9y agoThe government is permitted to search anything that crosses the U.S. border. It's a power inherent to nations, which are entities defined by their borders. The founding generation provided for such searches and seizures in the very first session of Congress. You might not like it, but border searches aren't illegal, and the government doesn't need to go to Israel to do them.
- justonepost 9y agoSounds like some bizarre William Gibson novel, but then most things do nowadays.
- lawnchair_larry 9y agoIt’s absolutely untrue that ex-Apple employees are helping them break in. Apple employees do not have an advantage in creating this type of thing.
- IshKebab 9y agoSure they do, they're familiar with the design. Unless it is completely open source or has been totally reverse engineer (which I doubt) then that is an advantage.
- lawnchair_larry 9y agoIt’s not an advantage, in practice. Writing exploits against iOS is a very scarce skill, and the people who can do this might be slightly more productive if aided by the source, but the reverse isn’t true. Having the source doesn’t teach you anything about finding and exploiting these bugs. It might seem logical to those unfamiliar with how these hacks work, but consider that such hacks do not depend on the secrecy of the design. Also consider that Apple hires regular software and hardware engineers, who do their best to design a system, and Apple then hires hackers (both internally, as well as external consultants) to find weaknesses in their designs. These weaknesses are then fixed before the product ships, meaning even those who were paid to break it no longer know how. This alone should tell you that people who know the system intimately are not the ones who understand how to break it. Put another way, if I need to make this product, and there are two candidates I can hire, one person who wrote the software and one who knows nothing about the software but is demonstrably skilled at finding exploits in similar systems, I’ll take the latter in a heartbeat.
- squarefoot 9y agoI don't know if that's true, but if I had the same power as a government agency, which would allow way higher salaries than Apple's or any other hi tech corporation, that's the first thing I'd attempt to do: find ex/unhappy/disgruntled engineers and offer them 5x pay plus a luxury home and lab in some tropical island. Also don't forget the hardware. Like with most/all other phone vendors, iPhone chips aren't made in the US; most of the design maybe is, but the chips themselves are not, and finding a Chinese hardware engineer happy to help would be even easier because all he should implement is a covert channel to tunnel sensitive data (passwords?) to a known place. If you have access to the hardware that should be trivial to do: just implement a small undocumented flash memory space anywhere, then when the user taps a password an also undocumented firmware routine (that's hundreds of bytes, very easy to conceal) would add the password in that small memory that can be read only in certain conditions (say connecting power+tapping a bossa rhythm while with the phone screen is facing down+disconnecting power - that seems crazy but you get the idea: every sensor is a switch and any switch can be used to enter a code). A few spare kilobytes of memory here and there would allow this and other spying mechanisms, so I would't be surprised at all if some big agency would attack the hardware/firmware rather than the software.
- bitmapbrother 9y agoThey could also have iOS 11 jailbreak exploits in their possession. iOS 11 was already jailbroken recently and the Project Zero team has also informed Apple of exploits they discovered.
- eridius 9y agoIt's been many years since I've even glanced at an iOS jailbreak, but since when can you jailbreak a locked device?
- bitmapbrother 9y agoThere's been a number of ways to bypass a locked iOS device throughout the years[1]. This hardware box worked up until iOS 11 beta[2]. I imagine Cellebrite is using something similar, but gets around the fix Apple released. [1]https://www.youtube.com/results?search_query=everything+apple+pro+lock+screen+bypass https://www.youtube.com/results?search_query=everything+appl... [2]https://www.youtube.com/watch?v=IXglwbyMydM https://www.youtube.com/watch?v=IXglwbyMydM
- tinus_hn 9y agoThese devices allow you to perform a brute force attack. Jailbreak requires a reboot of the device and after a reboot the encryption key for the useful data on the device is not available. If the device uses a strong passcode (as opposed to a numeric code) it cannot practically be brute forced even if you force the device to allow you to enter many attempts quickly.
- jsjohnst 9y agoThis is exactly why I use an XKCD style multi-word password for my phone. TouchID/FaceID keep me from having to enter it a lot and the rapid pressing of the power button to disable it give me convenience without significant compromise.
- 9y ago
- notadoc 9y agoNot too surprising based on economics alone. Presumably a security professional selling a usable exploit to a company like Celibrite pays far better than the $0 that comes from releasing it as a "jailbreak" to the general public.
- saagarjha 9y agoI'd assume things like these are generally difficult to release to the public in any meaningful way, since they often require hardware hacks like desoldering components.
- threeseed 9y agoWhat ? No they don't. All of the jailbreaks have just involved tethering your phone to iTunes or visiting a particular website or app. There's never been a need to do any desoldering.
- AgentME 9y agoI think he's just talking about attacks against locked devices. I'd consider that a different category of thing than jailbreaks (rooting an unlocked device).
- cheeze 9y agoAll of the jailbreaks that were released as easily accessible jailbreaks. It's definitely plausible that this exploit requires direct access of pinouts on the motherboard. The difference is just that those exploits which were difficult enough that they required soldering generally weren't released or didn't get much traction. That being said, I remember soldering a modchip on my original xbox 16 years ago
- caymanjim 9y agoI'm too lazy to find a link for it, but last time I read about Cellebrite, they were cloning the data and simply trying unlock codes in sequence until one worked. They could restore the cloned data before each try, or possibly do it on custom hardware or an emulator, and start with a fresh copy each time, so they never triggered "erase after 10 failures". It's a pretty straightforward approach, but it doesn't scale well. Works for targeted cracking of high-value targets.
- pls2halp 9y agoAs far as I can remember, that was the proof of concept which ended up emerging for the 5C crack a few years ago, and I don’t see any reason the methods would’ve changed.
- brandon 9y agoThe iPhone 5C could be attacked this way because it didn't contain the Secure Enclave that shipped as part of the A7 chip. Attacks on devices with the A7 (or newer chips) would be novel.
- eugeniub 9y agoThis is not true. You cannot just clone the data and run passcodes against it, because the data is not encrypted by your passcode. Instead, each file on iOS 11 is encrypted with a different AES 256-bit key, and cracking even one 256-bit key through exhaustive search is thought to be out of reach of humankind (https://security.stackexchange.com/questions/6141/amount-of-simple-operations-that-is-safely-out-of-reach-for-all-humanity/6149#6149 https://security.stackexchange.com/questions/6141/amount-of-...). The file keys are wrapped by, among other things, the device's Unique ID, a 256-bit key generated by the Secure Enclave, and accessible only to the Secure Enclave, not any other hardware or software running on an iOS device. In the end, the only options are: bruteforcing passcodes on the original device while attempting to trick the device into allowing more than 10 failures, or prying open the Secure Enclave to obtain the Unique ID — both options a lot more complicated than just cloning the data and trying passcodes on it.
- viraptor 9y ago> relatively inexpensive, costing as little as $1,500 per unlock That's not be good. Since we're bound to have that cost-of-unlock war anyway as new workarounds are found, it should at least be higher. I'd hope for $50k+ so if it's really needed, it goes through several levels of approvals.
- julianj 9y agoI wish there was a kind of "dead man switch" app that would wipe a device if it is not unlocked for x days or met some other kind of personalized criteria.
- alwillis 9y agoYou mean like automatically erasing the device after 10 incorrect passcode attempts? That option has been built in to the iPhone pretty much since the beginning.
- julianj 9y agoNo. An example would be automatically erase if the device has not been unlocked in 3 days.
- lostlogin 9y agoThis would be inconvenient at times.
- lb1lf 9y ago-To most users, probably. But if you are a high-ish profile target, the (potential) inconvenience is probably worth the effort for the added peace of mind. After all, when was the last time you spent three days without fondling your phone?
- pdkl95 9y agoAn app would need an environment to run in, but the main CPU/etc may not be available if the recovery process involves removing chips or other hardware modifications. A better idea would be to put an RTC + watchdog timer[1] into the security chip that holds the keys and power it continuously with a small amount of external power. The power must be available and the watchdog timer must have time remaining to disconnect a circuit that pulls the memory holding the keys to ground. More advanced types of tamper resistance and self-destructing chips are possible, but they tend to have significant downsides. [1] https://en.wikipedia.org/wiki/Watchdog_timer https://en.wikipedia.org/wiki/Watchdog_timer
- mcphage 9y agoWhy didn't Forbes send them an iPhone X running iOS 11 to hack, to find out if it's true or not?
- guelo 9y agoI imagine Cellebrite is very picky about who gets to be there customer. Wouldn't want someone sending a trojan device that reveals their secrets.
- mcphage 9y agoI would think Forbes Magazine would be a great customer for them.
- JumpCrisscross 9y ago> I would think Forbes Magazine would be a great customer for them Forbes would unlock one phone and then alert Apple by way of their story. Celebrite’s ideal customer pays for lots of iPhones to be unlocked.
- tedunangst 9y agoGo to Apple store with reporter. Buy phone. Have reporter take selfie and set passcode. Take phone, unlock, show reporter selfie.
- tlrobinson 9y agoWhy would Cellebrite want to do this in the first place?
- tedunangst 9y agoI don't know, but imagine Forbes would convince them. Isn't that what journalism is all about?
- 9y ago
- julianj 9y agoHow is chain of custody maintained if the process is a secret? Couldn't a person argue that the data obtained was planted?
- wmf 9y agoThey'll probably drop the case if the defense points this out (seriously, look at Stingrays).
- Scoundreller 9y agoBut not so much for breathalyzers...
- craftyguy 9y agoBreathalyzers will tell you what's up right on the spot, unless you've come across some that require the cops to collect a jar of your breath for processing at some remote discrete location?
- peterwwillis 9y agoBreathalyzers are easily tampered with by police to provide false readings. One case of this in New Jersey could have potentially thrown out 20,000 DWI cases. But breathalyzer results in cases today are not thrown out after pointing this out.
- craftyguy 9y ago> after pointing this out. What would you say, exactly? If you said: "your honor, breathalyzers can be tampered with to provide false readings" It seems quite easy for anyone to respond with "how so?". Do you refer to "this one time in New Jersey"?
- peterwwillis 9y ago
- exabrial 9y agohttps://xkcd.com/538 https://xkcd.com/538 All I want is my every day encryption to be a big enough pain in the butt to crack that the feds can't break it without spending a medium amount of money. ===Edit HN: Apologies this was lost in my subtlety, but consider the game theory aspects. Your best bet is to _just enough_ of a pain in the butt it's difficult to reach you, but you certainly don't want to be singled out on a national stage either. Maybe I'm the only one that considers this angle?
- letsgetphysITal 9y agoI'm not even on the Fed's radar. I don't want a mugger to send my stolen iDevice up the food chain to a Russian syndicate and have them able to in my Lastpass, internet banking app, live bitcoin wallet until I've had enough time to change all the credentials.
- geuis 9y agoClaims in one hand, shit in the other. Prove yourself. P
- peterjlee 9y agoThis might be a good scenario for Apple. Apple doesn't have to build a backdoor, which is good for PR, and the Feds got what they want to they'll stop bothering Apple. Which is the position Android/Google was in all along.
- ddalex 9y agoSo the tinfoil hat theory here is that Apple itself leaks the cracking tech to Cellobrite to ease the fed pressure, and keep reputation intact? Sorry, I don't buy it.
- chapill 9y agoNo one at Apple would share source code? You never heard of iBoot.
- zbentley 9y agoThat's not really the strongest interpretation of GP's statement. It wasn't implying that nobody would ever share source code for any reason, but that the company would deliberately decide to share source code in order to obtain fly-by-night compliance with government requests while maintaining its public image.
- chapill 9y agoThat happens all the time too, and I'm sure Apple is no exception. Want to score that big NSA storage contract? Pony up your HDD firmware... for "security assurances." Suddenly, NSA has exploits for all 7 major HDD manufacturers. http://www.cbc.ca/news/technology/nsa-hid-spying-software-in-hard-drive-firmware-report-says-1.2959252 http://www.cbc.ca/news/technology/nsa-hid-spying-software-in... Hmm, how did Apple get cleared for DOD use? http://www.zdnet.com/article/iphones-ipads-cleared-for-u-s-military-use-dod-fortifies-cloud/ http://www.zdnet.com/article/iphones-ipads-cleared-for-u-s-m... What process would be required for that? Hmmmm.
- peterjlee 9y ago
- cbrozefsky 9y agoSo they get owned earlier this month, and then a fluff piece appears later this month that doesn't mention any of the findings even tho it calls out the dangers of hoarding vulns. This is a planted marketing/PR piece.