8 ms·
Everybody seems so happy about this, here on HN and on Twitter. But wouldn't this allow any law enforcement or bad actor to circumvent any device protections? G
by rahkiin 7y ago
Everybody seems so happy about this, here on HN and on Twitter. But wouldn't this allow any law enforcement or bad actor to circumvent any device protections? Get the phone, do whatever you want with it without anything blocking you.
Am I missing something or are all these device secure enclaves and fingerprint protection or key protection now moot?
- rescbr 7y agoAs far as I understand it, user data is still encrypted and the key is protected by the Secure Enclave, which is not affected. This exploit allows flashing unsigned firmware, so by stealing the phone the attackers won’t be able to decrypt your data, but an evil maid attack is now (or will be) feasible. Also, stolen iPhones are now more valuable, as you will be able to bypass iCloud Lock.
- rahkiin 7y agoSo this might increase theft, as it is more valuable than a mere brick now. I hope we get some word from Apple about this.
- mschuster91 7y ago> So this might increase theft, as it is more valuable than a mere brick now. Only for older models, the newest series is not vulnerable.
- oliveshell 7y agoThe vast majority of iPhones currently in use are “older models“ [1]. Only A12 and A13 devices are unaffected (XS/XR, 11). [1]: https://deviceatlas.com/blog/most-popular-iphones https://deviceatlas.com/blog/most-popular-iphones
- btbuilder 7y agoI don’t have deep knowledge of the security architecture here but, in general the key doesn’t need to be compromised to retrieve data in secure systems. What prevents unauthorized firmware from requesting that the Secure Enclave decrypt all data? Similar to having control over an HSM - you can’t extract the key but you can perform cryptographic operations.
- mschuster91 7y agoThe SE will still require a password or other authentication data (e.g. iris/finger print, biometric measurements) until it will use its key to decrypt the data. The only ways around this are: * physical extraction of the embedded memory in the SE (I'm not sure if this is actually feasible, it's certainly a destructive attack) * "updating" the SE firmware - this is what the FBI wanted Apple to do in that terrorism case, that Apple develop a SE firmware that leaks the secret key * exploiting bugs in the SE firmware - this is what the FBI ended up doing by hiring either Cellebrite or some anonymous hackers (depending on which source one believes).
- btbuilder 7y agoI see. Hence evil maid attack. If someone has temporary physical access they could install malware that captures data when the device is unlocked. Chargers as an attack vector seem more likely, if more mundane.
- als0 7y agoIn the case of malicious chargers I believe Apple already authenticates peripherals to make data capture more difficult. If you’re unauthenticated then you will not be able to do much unless explicitly authorised. Of course, none of that matters if you can reflash the device or exploit the boot ROM.
- tgragnato 7y ago> exploiting bugs in the SE firmware / "updating" the SE firmware why not both?
- ehsankia 7y agoSo if I understand, just losing your phone is safe, but if you find it again after losing it, you basically shouldn't keep using the phone before completely reflashing the device?
- Wowfunhappy 7y agoAny modifications won’t survive a reboot (this is a “tethered” exploit), so if you’re concerned just turn the phone off and on again. Honestly, I find the malicious attack scenarios for this pretty far fetched.
- topranks 7y agoWell it won’t come back on in that case (the modified firmware will fail signature check.). But as you say you are still safe, just don’t unlock the device before reboot.
- Wowfunhappy 7y agoI think that depends on how it's set up, right? I rememember on my old iPod Touch with a tethered bootrom exploit, you could reboot without a computer but it would start up in non-Jailbreak mode. If you wanted to boot Jaillbroken, you had to find a computer. (This was the origin of the term "semi-tethered Jailbreak").
- tinus_hn 7y agoAny special abilities you may get disappear on reboot, so this isn’t a very practical activation lock bypass.
- deleted 7y ago[deleted]
- XJ6 7y agoI don't see a claim that this circumvents secure enclave or device encryption, so I don't think it's possible to "do anything" to an already locked and encrypted device?
- amiga-workbench 7y agoIf Apple gave authorised owners a way to sign and boot their own code there wouldn't be as much of a necessity for people to go hunting for these exploits.
- alias_neo 7y agoChange Apple to Google, then wait 10 years _after_ Google do it. Android devices could allow you to do this out of the box if Google allowed you to upload your own keys and sign your own boot image by providing the tools to developers / power users. They haven't and they won't. Sadly that means Apple is unlikely to do it either given how much more strict they are on these things.
- eptcyka 7y agoPixel devices allow you to upload your own keys.
- ntauthority 7y agoEven then that's only for the boot chain after the application boot loader - you for example can't run custom UEFI apps in the Qualcomm eXtensible Boot Loader (let alone custom TrustZone applets or Hexagon DSP firmware) as those are still locked down to Google's RKH, and similarly Google also (unlike a number of Chinese vendors) does not offer their-signed firehose emergency recovery blobs in case of a hard user brick (say, erasing the GPT on the flash).
- amiga-workbench 7y agoAny kind of code signing that forces the end user to trust a third party and restricts how a person may use their own property needs to go. The security benefits are real, but the implementations are poor. On Android devices, a locked bootloader guarantees your device will be e-waste within 2 years.
- ehsankia 7y agoThe way Google does it seems fine to me. You have to explicitly unlock the bootloader, which wipes all the data. As an extra, if you want to use the phone after wiping, you need to have the auth of the last user (to avoid reselling of stolen phones). Once you unlock the bootloader, you can do whatever, but the phone explicitly shows that it's unlocked on boot so you know that you know your bootloader is no longer safe. These seem like a fair compromise.
- deleted 7y ago[deleted]
- lern_too_spel 7y agoYes, it's all moot if you use a short numeric pin. The attacker can make their own brute-forcing build instead of having to ask Apple to sign one.
- Lammy 7y agoWe should all be happy for the public release of this exploit more than happy it exists. The alternative is that law enforcement and other bad actors might have knowledge of this exploit that the public doesn’t.