4 ms·

Isn't the issues that Corellium allows you to side step the passcode brute force lockout? aka...... https://www.aclu.org/news/privacy-technology/the-fbi-is-se

by viro 6y ago

Isn't the issues that Corellium allows you to side step the passcode brute force lockout? aka...... https://www.aclu.org/news/privacy-technology/the-fbi-is-secretly-breaking-into-encrypted-devices-were-suing/ https://www.aclu.org/news/privacy-technology/the-fbi-is-secr...

g_p 6y ago
Not really, by my understanding. Corellium is effectively providing a hosted virtual machine, presumably running on their own custom hypervisor, with their own management stack to give a convenient user experience. You "spin up" VM-based instances of emulated devices (i.e. booting an emulator from a filesystem image), and can then research vulnerabilities and explore, and downgrade/upgrade iOS versions rapidly, like you can with VMs. Real devices are fused to prevent downgrades. Side-stepping brute force lockouts on passcode would be irrelevant, since that's enforced on physical devices via the Secure Enclave - even if you dumped the flash from a real device, you'd not be any further forward as you would need the enclave's contents to derive the correct keys to do anything.
- CamJN 6y ago
  > Real devices are fused to prevent downgrades. Not quite, to install a version of iOS it must be signed by Apple, and Apple stops signing old versions soon after releasing a new one. Further you need to put the phone in recovery mode to install a lower version because the UI simply won't do it. You may be thinking of game consoles, which use fuses to prevent downgrades.
  - g_p 6y ago
    Thanks, I was thinking of the server-side AP Token system (i.e. the signed per-device authentication tags that confirm the firmware is up to date and able to be installed), but then ended up describing the Nintendo Switch fuse system. Indeed, in the past I believe people have used SHSH blobs to successfully downgrade, and also if Apple misconfigured their signing server to approve older versions, people have successfully downgraded during the window created due to the misconfiguration.
    - saagarjha 6y ago
      Apple's devices have fuses, too, but they ensure that you boot something signed by them.
ajconway 6y ago
Actually, it can be used to prevent that from happening in the future through facilitating security research that is not restricted to Apple-approved parties.
zorgmonkey 6y ago
It is much more likely that this is based on the secure enclave vulnerability that was found earlier this year and affects devices with a A7 through A11 chip.
- _kbh_ 6y ago
  I initially thought as such too, but on a previous discussion about this exact issue on hacker news I was linked to this https://securephones.io/main.pdf https://securephones.io/main.pdf. Which pretty much says that a lot of your data is just stored unencrypted entirely on the phone, so the FBI is probably just dumping the info without even needing a exploit.

by viro 6y ago

g_p 6y ago

Not really, by my understanding. Corellium is effectively providing a hosted virtual machine, presumably running on their own custom hypervisor, with their own management stack to give a convenient user experience. You "spin up" VM-based instances of emulated devices (i.e. booting an emulator from a filesystem image), and can then research vulnerabilities and explore, and downgrade/upgrade iOS versions rapidly, like you can with VMs. Real devices are fused to prevent downgrades. Side-stepping brute force lockouts on passcode would be irrelevant, since that's enforced on physical devices via the Secure Enclave - even if you dumped the flash from a real device, you'd not be any further forward as you would need the enclave's contents to derive the correct keys to do anything.

CamJN 6y ago
> Real devices are fused to prevent downgrades. Not quite, to install a version of iOS it must be signed by Apple, and Apple stops signing old versions soon after releasing a new one. Further you need to put the phone in recovery mode to install a lower version because the UI simply won't do it. You may be thinking of game consoles, which use fuses to prevent downgrades.
- g_p 6y ago
  Thanks, I was thinking of the server-side AP Token system (i.e. the signed per-device authentication tags that confirm the firmware is up to date and able to be installed), but then ended up describing the Nintendo Switch fuse system. Indeed, in the past I believe people have used SHSH blobs to successfully downgrade, and also if Apple misconfigured their signing server to approve older versions, people have successfully downgraded during the window created due to the misconfiguration.
  - saagarjha 6y ago
    Apple's devices have fuses, too, but they ensure that you boot something signed by them.

ajconway 6y ago

Actually, it can be used to prevent that from happening in the future through facilitating security research that is not restricted to Apple-approved parties.

zorgmonkey 6y ago

It is much more likely that this is based on the secure enclave vulnerability that was found earlier this year and affects devices with a A7 through A11 chip.

_kbh_ 6y ago
I initially thought as such too, but on a previous discussion about this exact issue on hacker news I was linked to this https://securephones.io/main.pdf https://securephones.io/main.pdf. Which pretty much says that a lot of your data is just stored unencrypted entirely on the phone, so the FBI is probably just dumping the info without even needing a exploit.