3 ms·

> This seems to be a software exploit... Yes but it certainly is exploiting a major hardware(?) flaw in the Secure Enclave Processor and/or the secure boot cha

> This seems to be a software exploit... Yes but it certainly is exploiting a major hardware(?) flaw in the Secure Enclave Processor and/or the secure boot chain. The SEP is supposed to hold the decryption key, seeded at manufacturing time and unreadable at a hardware level, and block brute forcing with a chip-enforced time delay. And the whole system including the SEP is supposed to have a secure boot chain so only Apple can authorize new firmware.[1] The FBI could break into the 5c because the brute forcing was only a weaker software limitation at that point. But since the A7 the SEP was supposed to handle it. [1] https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf

atonse 9y ago
Wow so how is it possible for them to do a hardware exploit by just exposing the lightning cable? From the look of this device, you just plug in the lightning cable and never open up the phone.
- abalone 9y ago
  Well, it's technically a software exploit. They are clearly loading custom firmware onto the phone which the secure boot chain is supposed to prevent. On top of that the SEP coprocessor has its own secure boot chain and is supposed to be even more locked down. I guess I can't speak to how the SEP implements its security features, i.e. which pieces are physically burned into hardware or just implemented in firmware with a secure boot chain. But either way this exploit points to a major flaw in the SEP, bigger than your average OS vuln.
  - deleted 9y ago
    [deleted]
- ubernostrum 9y ago
  Based on the reported time-to-unlock it's pretty clear they're brute-forcing the passcode. The phone has an escalating lockout time after failed attempts, so they must have some way of evading that. I've read a few theories of how that might work, from timing attacks to carefully-sequenced reboots of the phone to try to confuse the lockout mechanism.
  - abalone 9y ago
    That worked in the past but Apple got hip to it and specfically note that the SEP delay counter survives reboots. Maybe they missed something again but it seems less likely. My money is on a set of vulns similar to what CTS-Labs found in AMD’s secure coprocessors last month.[1][2] [1] https://thehackernews.com/2018/03/amd-processor-vulnerabilities.html https://thehackernews.com/2018/03/amd-processor-vulnerabilit... [2] https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/ https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-...

atonse 9y ago

Wow so how is it possible for them to do a hardware exploit by just exposing the lightning cable? From the look of this device, you just plug in the lightning cable and never open up the phone.

abalone 9y ago
Well, it's technically a software exploit. They are clearly loading custom firmware onto the phone which the secure boot chain is supposed to prevent. On top of that the SEP coprocessor has its own secure boot chain and is supposed to be even more locked down. I guess I can't speak to how the SEP implements its security features, i.e. which pieces are physically burned into hardware or just implemented in firmware with a secure boot chain. But either way this exploit points to a major flaw in the SEP, bigger than your average OS vuln.
- deleted 9y ago
  [deleted]
ubernostrum 9y ago
Based on the reported time-to-unlock it's pretty clear they're brute-forcing the passcode. The phone has an escalating lockout time after failed attempts, so they must have some way of evading that. I've read a few theories of how that might work, from timing attacks to carefully-sequenced reboots of the phone to try to confuse the lockout mechanism.
- abalone 9y ago
  That worked in the past but Apple got hip to it and specfically note that the SEP delay counter survives reboots. Maybe they missed something again but it seems less likely. My money is on a set of vulns similar to what CTS-Labs found in AMD’s secure coprocessors last month.[1][2] [1] https://thehackernews.com/2018/03/amd-processor-vulnerabilities.html https://thehackernews.com/2018/03/amd-processor-vulnerabilit... [2] https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/ https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-...