7 ms·
My guess is that Apple will find a way to secure their own copy of GrayKey using a shell company and reverse engineer the exploit. Like others have said, it's a
by atonse 9y ago
My guess is that Apple will find a way to secure their own copy of GrayKey using a shell company and reverse engineer the exploit. Like others have said, it's a cat and mouse game.
This seems to be a software exploit if it requires not opening up the iPhone. There are more sophisticated hardware techniques (one was "decapping" the chip and reading the data out so you can try passcodes elsewhere), but I believe Apple's also finding mitigations for those as well.
- abalone 9y ago> This seems to be a software exploit... Yes but it certainly is exploiting a major hardware(?) flaw in the Secure Enclave Processor and/or the secure boot chain. The SEP is supposed to hold the decryption key, seeded at manufacturing time and unreadable at a hardware level, and block brute forcing with a chip-enforced time delay. And the whole system including the SEP is supposed to have a secure boot chain so only Apple can authorize new firmware.[1] The FBI could break into the 5c because the brute forcing was only a weaker software limitation at that point. But since the A7 the SEP was supposed to handle it. [1] https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
- atonse 9y agoWow so how is it possible for them to do a hardware exploit by just exposing the lightning cable? From the look of this device, you just plug in the lightning cable and never open up the phone.
- abalone 9y agoWell, it's technically a software exploit. They are clearly loading custom firmware onto the phone which the secure boot chain is supposed to prevent. On top of that the SEP coprocessor has its own secure boot chain and is supposed to be even more locked down. I guess I can't speak to how the SEP implements its security features, i.e. which pieces are physically burned into hardware or just implemented in firmware with a secure boot chain. But either way this exploit points to a major flaw in the SEP, bigger than your average OS vuln.
- deleted 9y ago[deleted]
- ubernostrum 9y agoBased on the reported time-to-unlock it's pretty clear they're brute-forcing the passcode. The phone has an escalating lockout time after failed attempts, so they must have some way of evading that. I've read a few theories of how that might work, from timing attacks to carefully-sequenced reboots of the phone to try to confuse the lockout mechanism.
- abalone 9y agoThat worked in the past but Apple got hip to it and specfically note that the SEP delay counter survives reboots. Maybe they missed something again but it seems less likely. My money is on a set of vulns similar to what CTS-Labs found in AMD’s secure coprocessors last month.[1][2] [1] https://thehackernews.com/2018/03/amd-processor-vulnerabilities.html https://thehackernews.com/2018/03/amd-processor-vulnerabilit... [2] https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/ https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-...
- Rebelgecko 9y agoThere are some really interesting noninvasive side channel attacks out there e.g. differential power analysis which is trickier but not impossible with a battery powered device
- developer2 9y agoMost people seem to have missed the reported fact that a security researcher now working as an executive at Grayshift was previously an employee at Apple. The exploit being used in the GrayKey device may have been exported directly from within Apple's walls. Perhaps this man was involved enough with iOS security that he a) built in a backdoor; or b) discovered a vulnerability, and instead of disclosing it, left Apple to profit off the exploit; or c) gained enough knowledge of the systems to be able to reverse engineer an exploit from scratch, after leaving Apple. The fact that the company producing the GreyKey has an executive who is a security researcher and used to work for Apple is such an obvious, damning piece of evidence. I don't understand why this connection hasn't been more widely reported and investigated.
- saagarjha 9y ago> gained enough knowledge of the systems to be able to reverse engineer an exploit from scratch, after leaving Apple While the other two are suspicious, I don't think the last one is. If you're good enough to come up with a clean room implementation than I don't see any foul play here.
- stordoff 9y agoIsn't that by definition _not_ a clean room? You have knowledge about the device that you wouldn't be able to derive just from looking at the device itself.
- scottmf 9y agoWhat was his position at Apple?
- saagarjha 9y agoNo, that's what the other two were. I'm saying that there's the possibility that you got hired at Apple because you were smart, and end up continuing work on iOS even when you leave, but without any sort of knowledge of the internals. For example, say they rewrote some portion of code that you were familiar with: in that case, you should be free to take a look since you no longer have any inside information on it.