4 ms·

One possible attack would be to replace the sensor with one that records the fingerprint the next time you authenticate. And then in the future it could “replay

One possible attack would be to replace the sensor with one that records the fingerprint the next time you authenticate. And then in the future it could “replay” the fingerprint image to the SEP (secure coprocessor). If it were really Apple’s intention to prevent you from servicing your device, would they only disable the Touch ID sensor? Why wouldn’t they make the whole device inoperable, rather than make you suffer a minor inconvenience by having to use a passcode? The less exciting answer is that the sensor was designed to certain security parameters and modifying it invalidates those. Yes, the threat model includes nation-state actors. Disabling the sensor preserves system security; designing for a potentially adversarial sensor is difficult and increases risk.

AnthonyMouse 7y ago
What installing a malicious fingerprint scanner buys you is that you can unlock the phone. Which means all you have to do is require the user to unlock the phone (e.g. with a PIN) to activate the new fingerprint scanner. That protects the data that was already on the phone when the new fingerprint scanner is installed. And as for future use of the phone, that's already hopeless, because if you have the capability to fabricate a rogue fingerprint scanner, install it in the phone and unlock the phone to activate it, you could just keep the original phone and replace it with a fully rogue phone that you've copied the original data to.
- rgovostes 7y ago
  I am not sure I follow. (Edit: there is more to the threat model than the scenario that the device is being broken into outside of your possession. Consider just a fake part that pretends to authenticate you but sends a fixed fingerprint image or embedding or whatever to your SEP. You wouldn’t know but someone else could get into your device.) But each device has a unique encryption key that is implemented in hardware. The flash storage cannot simply be moved to a new device. Cloning the storage and the hardware key is assumed to be significantly harder (and more costly) than replacing the sensor with something similar-looking (see any number of Chinese knockoffs).
  - AnthonyMouse 7y ago
    > Consider just a fake part that pretends to authenticate you but sends a fixed fingerprint image or embedding or whatever to your SEP. You wouldn’t know but someone else could get into your device. Which was the second point. They can replace the whole phone and you're in the same situation. Having two components authenticate each other just requires them to replace both. > The flash storage cannot simply be moved to a new device. Not the way they've designed it, but there is no security reason not to allow that once the phone has already been unlocked.
- saagarjha 7y ago
  > replace it with a fully rogue phone that you've copied the original data to How? This would require decrypting the data, wouldn't it?
  - AnthonyMouse 7y ago
    But you just unlocked it. That's the point. If you can unlock the phone without it then you might as well accept the fingerprint reader.
    - saagarjha 7y ago
      Maybe I'm not understanding your "attack": are you not saying that the repair shop can replace your phone with a malicious one with your data on it?
      - AnthonyMouse 7y ago
        You give them your phone and and the ability to unlock it, now they can copy all your stuff. The phone they give you back isn't yours, you have been pwned.
        saagarjha 7y ago
        > the ability to unlock it Why would I give them that? I'm handing the phone over powered-down and without revealing my passcode.
        AnthonyMouse 7y ago
        > Why would I give them that? So they can repair your phone. And they get the same thing when they give you the rogue phone back and you try to unlock it, at which point it sends the PIN to them and they can use it to unlock your original phone and then mount it over the network to display the same data until they've finished copying it.
        7y ago
saagarjha 7y ago
> Why wouldn’t they make the whole device inoperable, rather than make you suffer a minor inconvenience by having to use a passcode? They did by mistake: https://support.apple.com/en-us/HT205628 https://support.apple.com/en-us/HT205628

AnthonyMouse 7y ago

What installing a malicious fingerprint scanner buys you is that you can unlock the phone. Which means all you have to do is require the user to unlock the phone (e.g. with a PIN) to activate the new fingerprint scanner. That protects the data that was already on the phone when the new fingerprint scanner is installed. And as for future use of the phone, that's already hopeless, because if you have the capability to fabricate a rogue fingerprint scanner, install it in the phone and unlock the phone to activate it, you could just keep the original phone and replace it with a fully rogue phone that you've copied the original data to.

rgovostes 7y ago
I am not sure I follow. (Edit: there is more to the threat model than the scenario that the device is being broken into outside of your possession. Consider just a fake part that pretends to authenticate you but sends a fixed fingerprint image or embedding or whatever to your SEP. You wouldn’t know but someone else could get into your device.) But each device has a unique encryption key that is implemented in hardware. The flash storage cannot simply be moved to a new device. Cloning the storage and the hardware key is assumed to be significantly harder (and more costly) than replacing the sensor with something similar-looking (see any number of Chinese knockoffs).
- AnthonyMouse 7y ago
  > Consider just a fake part that pretends to authenticate you but sends a fixed fingerprint image or embedding or whatever to your SEP. You wouldn’t know but someone else could get into your device. Which was the second point. They can replace the whole phone and you're in the same situation. Having two components authenticate each other just requires them to replace both. > The flash storage cannot simply be moved to a new device. Not the way they've designed it, but there is no security reason not to allow that once the phone has already been unlocked.
saagarjha 7y ago
> replace it with a fully rogue phone that you've copied the original data to How? This would require decrypting the data, wouldn't it?
- AnthonyMouse 7y ago
  But you just unlocked it. That's the point. If you can unlock the phone without it then you might as well accept the fingerprint reader.
  - saagarjha 7y ago
    Maybe I'm not understanding your "attack": are you not saying that the repair shop can replace your phone with a malicious one with your data on it?
    - AnthonyMouse 7y ago
      You give them your phone and and the ability to unlock it, now they can copy all your stuff. The phone they give you back isn't yours, you have been pwned.
      - saagarjha 7y ago
        > the ability to unlock it Why would I give them that? I'm handing the phone over powered-down and without revealing my passcode.
        AnthonyMouse 7y ago
        > Why would I give them that? So they can repair your phone. And they get the same thing when they give you the rogue phone back and you try to unlock it, at which point it sends the PIN to them and they can use it to unlock your original phone and then mount it over the network to display the same data until they've finished copying it.
        7y ago

saagarjha 7y ago

> Why wouldn’t they make the whole device inoperable, rather than make you suffer a minor inconvenience by having to use a passcode? They did by mistake: https://support.apple.com/en-us/HT205628 https://support.apple.com/en-us/HT205628