5 ms·

They could also have iOS 11 jailbreak exploits in their possession. iOS 11 was already jailbroken recently and the Project Zero team has also informed Apple of

They could also have iOS 11 jailbreak exploits in their possession. iOS 11 was already jailbroken recently and the Project Zero team has also informed Apple of exploits they discovered.

eridius 9y ago
It's been many years since I've even glanced at an iOS jailbreak, but since when can you jailbreak a locked device?
- bitmapbrother 9y ago
  There's been a number of ways to bypass a locked iOS device throughout the years[1]. This hardware box worked up until iOS 11 beta[2]. I imagine Cellebrite is using something similar, but gets around the fix Apple released. [1]https://www.youtube.com/results?search_query=everything+apple+pro+lock+screen+bypass https://www.youtube.com/results?search_query=everything+appl... [2]https://www.youtube.com/watch?v=IXglwbyMydM https://www.youtube.com/watch?v=IXglwbyMydM
  - tinus_hn 9y ago
    These devices allow you to perform a brute force attack. Jailbreak requires a reboot of the device and after a reboot the encryption key for the useful data on the device is not available. If the device uses a strong passcode (as opposed to a numeric code) it cannot practically be brute forced even if you force the device to allow you to enter many attempts quickly.
    - jsjohnst 9y ago
      This is exactly why I use an XKCD style multi-word password for my phone. TouchID/FaceID keep me from having to enter it a lot and the rapid pressing of the power button to disable it give me convenience without significant compromise.
      - athenot 9y ago
        Good but do throw a random character in there, otherwise your passphrase is essentically a few characters long in a (larger) alphabet—ie, a dictionary sorted by most frequently used words. Or at least use some uncommon words. 70^8 = 576480100000000 // 8 chars of upper/lower case, numbers, symbols 4000^4 = 256000000000000 // 4 words pulled from a vocabulary of 4000 words word rank ------------- ---- correct 1808 horse 1286 battery 3221 staple (not in the first 4000) https://xkcd.com/936/ https://xkcd.com/936/ (For those who were wondering about the context.)
        jsjohnst 9y ago
        > Good but do throw a random character in there There is, but that part isn't the important part. The important part is using a long pass phrase rather than a multi digit number.
tempay 9y ago
Correct me if I’m wrong but this wouldn’t help? “Unlocking” in the context of the FBI and iPhones always seems to be based around making it possible to brute force a device in their posession, which also means strong passphrases will remain secure. This is an incredibly hostile environment to security, the fact that Apple make it as hard as they do is quite impressive.

They could also have iOS 11 jailbreak exploits in their possession. iOS 11 was already jailbroken recently and the Project Zero team has also informed Apple of exploits they discovered.

eridius 9y ago

It's been many years since I've even glanced at an iOS jailbreak, but since when can you jailbreak a locked device?

bitmapbrother 9y ago
There's been a number of ways to bypass a locked iOS device throughout the years[1]. This hardware box worked up until iOS 11 beta[2]. I imagine Cellebrite is using something similar, but gets around the fix Apple released. [1]https://www.youtube.com/results?search_query=everything+apple+pro+lock+screen+bypass https://www.youtube.com/results?search_query=everything+appl... [2]https://www.youtube.com/watch?v=IXglwbyMydM https://www.youtube.com/watch?v=IXglwbyMydM
- tinus_hn 9y ago
  These devices allow you to perform a brute force attack. Jailbreak requires a reboot of the device and after a reboot the encryption key for the useful data on the device is not available. If the device uses a strong passcode (as opposed to a numeric code) it cannot practically be brute forced even if you force the device to allow you to enter many attempts quickly.
  - jsjohnst 9y ago
    This is exactly why I use an XKCD style multi-word password for my phone. TouchID/FaceID keep me from having to enter it a lot and the rapid pressing of the power button to disable it give me convenience without significant compromise.
    - athenot 9y ago
      Good but do throw a random character in there, otherwise your passphrase is essentically a few characters long in a (larger) alphabet—ie, a dictionary sorted by most frequently used words. Or at least use some uncommon words. 70^8 = 576480100000000 // 8 chars of upper/lower case, numbers, symbols 4000^4 = 256000000000000 // 4 words pulled from a vocabulary of 4000 words word rank ------------- ---- correct 1808 horse 1286 battery 3221 staple (not in the first 4000) https://xkcd.com/936/ https://xkcd.com/936/ (For those who were wondering about the context.)
      - jsjohnst 9y ago
        > Good but do throw a random character in there There is, but that part isn't the important part. The important part is using a long pass phrase rather than a multi digit number.

tempay 9y ago

Correct me if I’m wrong but this wouldn’t help? “Unlocking” in the context of the FBI and iPhones always seems to be based around making it possible to brute force a device in their posession, which also means strong passphrases will remain secure. This is an incredibly hostile environment to security, the fact that Apple make it as hard as they do is quite impressive.