3 ms·

This is probably the same exploit used by three letter agencies to get into locked iDevices. It was known long before checkm8 became public.

Xylakant 7y ago
Afaics it doesn’t get you on locked devices. You can install custom firmware, but you’d still need the passcode or face/finger to unlock the actual content.
- vageli 7y ago
  > Afaics it doesn’t get you on locked devices. You can install custom firmware, but you’d still need the passcode or face/finger to unlock the actual content. It opens the door for an evil maid attack though. Replace firmware of target and once unlocked exfil the data. Since most people don't regularly turn off their phones in my experience, this attack would probably be successful against most users.
  - matwood 7y ago
    Let's play out this scenario. Someone has to take your phone without you knowing and load some exfil software. This requires focused targeting of people who are not most users. Heads of state, journalists, etc... would just reboot the phone anytime it leaves their possession. Additionally, those users are who are likely targets would just get a newer phone. The reality is that right now, Checkm8 is great for jailbreakers of older phones and not much else.
    - vageli 7y ago
      Good points. As a complete aside, your comment brought to mind one more group that might benefit: those in a relationship with someone whom they suspect is cheating on them.
- hcs 7y ago
  For older phones it would, though there were maybe other exploits available as well? From the first page of the interview: > Before Apple introduced the Secure Enclave and Touch ID in 2013, you didn't have advanced security protections. So, for example, the [San Bernardino gun man's] phone that was famously unlocked [by the FBI]—the iPhone 5c— that didn't have Secure Enclave. So in that case, this vulnerability would allow you to very quickly get the PIN and get access to all the data. But for pretty much all current phones, from iPhone 6 to iPhone 8, there is a Secure Enclave that protects your data if you don't have the PIN.
j_jochem 7y ago
> * Checkm8 doesn't bypass the protections offered by the Secure Enclave and Touch ID. All of the above means people will be able to use Checkm8 to install malware only under very limited circumstances. > * The above also means that Checkm8 is unlikely to make it easier for people who find, steal or confiscate a vulnerable iPhone, but don't have the unlock PIN, to access the data stored on it. Apparently, this is not the same exploit.

Xylakant 7y ago

Afaics it doesn’t get you on locked devices. You can install custom firmware, but you’d still need the passcode or face/finger to unlock the actual content.

vageli 7y ago
> Afaics it doesn’t get you on locked devices. You can install custom firmware, but you’d still need the passcode or face/finger to unlock the actual content. It opens the door for an evil maid attack though. Replace firmware of target and once unlocked exfil the data. Since most people don't regularly turn off their phones in my experience, this attack would probably be successful against most users.
- matwood 7y ago
  Let's play out this scenario. Someone has to take your phone without you knowing and load some exfil software. This requires focused targeting of people who are not most users. Heads of state, journalists, etc... would just reboot the phone anytime it leaves their possession. Additionally, those users are who are likely targets would just get a newer phone. The reality is that right now, Checkm8 is great for jailbreakers of older phones and not much else.
  - vageli 7y ago
    Good points. As a complete aside, your comment brought to mind one more group that might benefit: those in a relationship with someone whom they suspect is cheating on them.
hcs 7y ago
For older phones it would, though there were maybe other exploits available as well? From the first page of the interview: > Before Apple introduced the Secure Enclave and Touch ID in 2013, you didn't have advanced security protections. So, for example, the [San Bernardino gun man's] phone that was famously unlocked [by the FBI]—the iPhone 5c— that didn't have Secure Enclave. So in that case, this vulnerability would allow you to very quickly get the PIN and get access to all the data. But for pretty much all current phones, from iPhone 6 to iPhone 8, there is a Secure Enclave that protects your data if you don't have the PIN.

j_jochem 7y ago

> * Checkm8 doesn't bypass the protections offered by the Secure Enclave and Touch ID. All of the above means people will be able to use Checkm8 to install malware only under very limited circumstances. > * The above also means that Checkm8 is unlikely to make it easier for people who find, steal or confiscate a vulnerable iPhone, but don't have the unlock PIN, to access the data stored on it. Apparently, this is not the same exploit.