3 ms·

The signing of the update prevents it.

selcuka 3y ago
Compromised private keys is not uncommon, and in this case it is even more dangerous because you would normally trust that an iPhone in a shrink-wrapped box bought from an Apple store comes directly from the factory.
- userinanother 3y ago
  Brilliant way to pre compromise a phone. The victim will never suspect a sealed box
- AlotOfReading 3y ago
  When was the last time a large vendor had an HSM compromised directly? Malicious code signed, sure, but I've never heard of keys being leaked from an internal HSM that the attackers didn't have high levels of access to. It seems to me the threat model for consumers is the same either way. The box itself doesn't offer any meaningful tamper-evidence, so a sophisticated attacker would just re-shrinkwrap everything if they couldn't update them this way.
- sweetjuly 3y ago
  You know you can also just buy shrinkwrap and heat it with a hairdryer, right? If the people you're up against can steal signing keys, surely they can spend $20 to buy some plastic.
  - selcuka 3y ago
    Sure, but this allows doing this inconspicuously, probably by an Apple store employee.
- LocalH 3y ago
  Pretty sure if someone publicly compromised TSS to that degree, people in the jailbreaking scene would be bouncing off the walls.
kccqzy 3y ago
The signing of an update prevents non-Apple sources to install their software. It doesn't prevent a malicious actor from installing an Apple update. (Suppose a user has a phone with iOS 16 but does not want iOS 17.)
- lbourdages 3y ago
  They have an unopened/unsetup phone (I would assume this feature gets disabled once the phone is set up) with iOS 16 that they own, and someone with bad intentions wants to forcibly update it to iOS 17? I mean, technically there is an attack vector there, but it's oddly specific, and since the attacker needs physical access anyways, you've got other problems (i.e. someone got into your home).
rtpg 3y ago
Of course we have signing in general, but my understanding was that inserting the PIN was introduced after the terrorism case so that Apple could not be compelled to hack someone’s phone ever again. Requiring user input for this sort of installation has seemed to be a core part of their security posture. Of course, having phones be updated before users use them is also super important. So maybe what’s going on here is something that only works when a phone hasn’t been associated to a user yet.
- MBCook 3y ago
  I can’t imagine Apple would leave this enabled once the phone is set up. There’s just no need.

Compromised private keys is not uncommon, and in this case it is even more dangerous because you would normally trust that an iPhone in a shrink-wrapped box bought from an Apple store comes directly from the factory.

userinanother 3y ago
Brilliant way to pre compromise a phone. The victim will never suspect a sealed box
AlotOfReading 3y ago
When was the last time a large vendor had an HSM compromised directly? Malicious code signed, sure, but I've never heard of keys being leaked from an internal HSM that the attackers didn't have high levels of access to. It seems to me the threat model for consumers is the same either way. The box itself doesn't offer any meaningful tamper-evidence, so a sophisticated attacker would just re-shrinkwrap everything if they couldn't update them this way.
sweetjuly 3y ago
You know you can also just buy shrinkwrap and heat it with a hairdryer, right? If the people you're up against can steal signing keys, surely they can spend $20 to buy some plastic.
- selcuka 3y ago
  Sure, but this allows doing this inconspicuously, probably by an Apple store employee.
LocalH 3y ago
Pretty sure if someone publicly compromised TSS to that degree, people in the jailbreaking scene would be bouncing off the walls.

kccqzy 3y ago

The signing of an update prevents non-Apple sources to install their software. It doesn't prevent a malicious actor from installing an Apple update. (Suppose a user has a phone with iOS 16 but does not want iOS 17.)

lbourdages 3y ago
They have an unopened/unsetup phone (I would assume this feature gets disabled once the phone is set up) with iOS 16 that they own, and someone with bad intentions wants to forcibly update it to iOS 17? I mean, technically there is an attack vector there, but it's oddly specific, and since the attacker needs physical access anyways, you've got other problems (i.e. someone got into your home).

rtpg 3y ago

Of course we have signing in general, but my understanding was that inserting the PIN was introduced after the terrorism case so that Apple could not be compelled to hack someone’s phone ever again. Requiring user input for this sort of installation has seemed to be a core part of their security posture. Of course, having phones be updated before users use them is also super important. So maybe what’s going on here is something that only works when a phone hasn’t been associated to a user yet.

MBCook 3y ago
I can’t imagine Apple would leave this enabled once the phone is set up. There’s just no need.