3 ms·
Wow so how is it possible for them to do a hardware exploit by just exposing the lightning cable? From the look of this device, you just plug in the lightning
by atonse 9y ago
Wow so how is it possible for them to do a hardware exploit by just exposing the lightning cable?
From the look of this device, you just plug in the lightning cable and never open up the phone.
- abalone 9y agoWell, it's technically a software exploit. They are clearly loading custom firmware onto the phone which the secure boot chain is supposed to prevent. On top of that the SEP coprocessor has its own secure boot chain and is supposed to be even more locked down. I guess I can't speak to how the SEP implements its security features, i.e. which pieces are physically burned into hardware or just implemented in firmware with a secure boot chain. But either way this exploit points to a major flaw in the SEP, bigger than your average OS vuln.
- deleted 9y ago[deleted]
- ubernostrum 9y agoBased on the reported time-to-unlock it's pretty clear they're brute-forcing the passcode. The phone has an escalating lockout time after failed attempts, so they must have some way of evading that. I've read a few theories of how that might work, from timing attacks to carefully-sequenced reboots of the phone to try to confuse the lockout mechanism.
- abalone 9y agoThat worked in the past but Apple got hip to it and specfically note that the SEP delay counter survives reboots. Maybe they missed something again but it seems less likely. My money is on a set of vulns similar to what CTS-Labs found in AMD’s secure coprocessors last month.[1][2] [1] https://thehackernews.com/2018/03/amd-processor-vulnerabilities.html https://thehackernews.com/2018/03/amd-processor-vulnerabilit... [2] https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/ https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-...