38 ms·
Normally when you apply an iOS update, you need to enter your pin, but presumably this isn't necessary if the OS hasn't been setup. I wonder what prevents a mal
by PlunderBunny 3y ago
Normally when you apply an iOS update, you need to enter your pin, but presumably this isn't necessary if the OS hasn't been setup. I wonder what prevents a malicious actor from doing the same thing, if they know the 'secret handshake'?
- baggy_trough 3y agoThe signing of the update prevents it.
- selcuka 3y agoCompromised private keys is not uncommon, and in this case it is even more dangerous because you would normally trust that an iPhone in a shrink-wrapped box bought from an Apple store comes directly from the factory.
- userinanother 3y agoBrilliant way to pre compromise a phone. The victim will never suspect a sealed box
- AlotOfReading 3y agoWhen was the last time a large vendor had an HSM compromised directly? Malicious code signed, sure, but I've never heard of keys being leaked from an internal HSM that the attackers didn't have high levels of access to. It seems to me the threat model for consumers is the same either way. The box itself doesn't offer any meaningful tamper-evidence, so a sophisticated attacker would just re-shrinkwrap everything if they couldn't update them this way.
- sweetjuly 3y agoYou know you can also just buy shrinkwrap and heat it with a hairdryer, right? If the people you're up against can steal signing keys, surely they can spend $20 to buy some plastic.
- selcuka 3y agoSure, but this allows doing this inconspicuously, probably by an Apple store employee.
- LocalH 3y agoPretty sure if someone publicly compromised TSS to that degree, people in the jailbreaking scene would be bouncing off the walls.
- kccqzy 3y agoThe signing of an update prevents non-Apple sources to install their software. It doesn't prevent a malicious actor from installing an Apple update. (Suppose a user has a phone with iOS 16 but does not want iOS 17.)
- lbourdages 3y agoThey have an unopened/unsetup phone (I would assume this feature gets disabled once the phone is set up) with iOS 16 that they own, and someone with bad intentions wants to forcibly update it to iOS 17? I mean, technically there is an attack vector there, but it's oddly specific, and since the attacker needs physical access anyways, you've got other problems (i.e. someone got into your home).
- rtpg 3y agoOf course we have signing in general, but my understanding was that inserting the PIN was introduced after the terrorism case so that Apple could not be compelled to hack someone’s phone ever again. Requiring user input for this sort of installation has seemed to be a core part of their security posture. Of course, having phones be updated before users use them is also super important. So maybe what’s going on here is something that only works when a phone hasn’t been associated to a user yet.
- MBCook 3y agoI can’t imagine Apple would leave this enabled once the phone is set up. There’s just no need.
- xyst 3y agoMaybe an attacker triggers this protocol not to install a malicious update but to bypass FaceID/PIN/TouchID and then they can add whatever spyware they want. - Trigger update via "special pad" - Interrupt update process to get access to phone - Wirelessly transmit spyware onto target's phone
- brookst 3y agoThis is for devices before they’re sold. There is no face ID or PIN configured.
- smileybarry 3y agoYou can always clean-install a new iOS update in DFU mode, and in this use case the iPhone isn't configured so preserving any non-existent data isn't necessary. But it also looks like you can always update with data through DFU mode?[1] It doesn't say whether the computer has to be pre-authorized with that iPhone, but it's also DFU mode where authorization matters less, so shrug. 1: https://support.apple.com/en-us/HT201263 https://support.apple.com/en-us/HT201263