3 ms·

It's a pity that we (likely including the journalist) don't know more about how the cops got access to the iPhone beyond cloud backups: the one thing I'm taking

It's a pity that we (likely including the journalist) don't know more about how the cops got access to the iPhone beyond cloud backups: the one thing I'm taking away from this article is that passcodes can still be brute forced.

worthless-trash 2y ago
I think that bruteforcing the passcode is an unlikely attack vector, if they do "brute force it" it likely wont be with apples OS running, it would be some kind of custom attack.
- blitzar 2y ago
  Image device -> run image in emulator -> try 5 passcodes -> get blocked -> reload image -> try 5 passcodes -> get blocked -> ... -> try 5 passcodes -> unlock phone.
  - sidoshi 2y ago
    How do you Image an iphone device?
    - filoleg 2y ago
      Yeah, I had the same question. Because the grandparent comment explanation felt very much like the “…and then draw the rest of the owl” joke.
    - einsteinx2 2y ago
      I assume you can desolder the flash chip and directly dump its contents. Not trivial, but not too difficult for someone with the right skills.
      - kalleboo 2y ago
        That won't give you the encryption keys, which are stored in the Secure Enclave.
        aziaziazi 2y ago
        Isn’t the Secure Enclave another separate flash chip?
        wkat4242 2y ago
        Yes but with the controller built in and hardware hardening. They are designed precisely to prevent this kind of attack. I bet most of the exploits used by these boxes have nothing to do with the secure element but just bypass security using exploits in standard system or USB code. Most phones will be captured with the OS running but just the UI locked, with all encrypted volumes already mounted.
        neuralRiot 2y ago
        If they can access the iCloud account then the phone can be backed up remotely then read the backup.
        wkat4242 2y ago
        True but only if the user actually uses iCloud backup of course. I never did when I had an iPhone, for that reason, I don't want all my personal stuff in the cloud. But this is not how cellebrite boxes work anyway. They focus on the device.
        kalleboo 2y ago
        Assuming the user hasn't enabled end-to-end encrypted backups (which is an option, not the default)
  - kalleboo 2y ago
    That's the point of the Secure Enclave, where the password keys are stored. It's designed to be impossible to image. Early attacks relied on pulling the power to the chip after it sent a failure message but before it updated the attempt counter, this is fixed on newer revisions to happen the other way around.
    - Am4TIfIsER0ppos 2y ago
      Are you a hardware engineer at apple speaking in official capacity? Not that I would believe that even you were. Of course the government can read their surveillance device.
      - deleted 2y ago
        [deleted]
Terretta 2y ago
Well, look what vectors Apple thinks are used (most while you keep using it, some physical): https://support.apple.com/en-us/105120 https://support.apple.com/en-us/105120

worthless-trash 2y ago

I think that bruteforcing the passcode is an unlikely attack vector, if they do "brute force it" it likely wont be with apples OS running, it would be some kind of custom attack.

blitzar 2y ago
Image device -> run image in emulator -> try 5 passcodes -> get blocked -> reload image -> try 5 passcodes -> get blocked -> ... -> try 5 passcodes -> unlock phone.
- sidoshi 2y ago
  How do you Image an iphone device?
  - filoleg 2y ago
    Yeah, I had the same question. Because the grandparent comment explanation felt very much like the “…and then draw the rest of the owl” joke.
  - einsteinx2 2y ago
    I assume you can desolder the flash chip and directly dump its contents. Not trivial, but not too difficult for someone with the right skills.
    - kalleboo 2y ago
      That won't give you the encryption keys, which are stored in the Secure Enclave.
      - aziaziazi 2y ago
        Isn’t the Secure Enclave another separate flash chip?
        wkat4242 2y ago
        Yes but with the controller built in and hardware hardening. They are designed precisely to prevent this kind of attack. I bet most of the exploits used by these boxes have nothing to do with the secure element but just bypass security using exploits in standard system or USB code. Most phones will be captured with the OS running but just the UI locked, with all encrypted volumes already mounted.
        neuralRiot 2y ago
        If they can access the iCloud account then the phone can be backed up remotely then read the backup.
        wkat4242 2y ago
        True but only if the user actually uses iCloud backup of course. I never did when I had an iPhone, for that reason, I don't want all my personal stuff in the cloud. But this is not how cellebrite boxes work anyway. They focus on the device.
        kalleboo 2y ago
        Assuming the user hasn't enabled end-to-end encrypted backups (which is an option, not the default)
- kalleboo 2y ago
  That's the point of the Secure Enclave, where the password keys are stored. It's designed to be impossible to image. Early attacks relied on pulling the power to the chip after it sent a failure message but before it updated the attempt counter, this is fixed on newer revisions to happen the other way around.
  - Am4TIfIsER0ppos 2y ago
    Are you a hardware engineer at apple speaking in official capacity? Not that I would believe that even you were. Of course the government can read their surveillance device.
    - deleted 2y ago
      [deleted]

Terretta 2y ago

Well, look what vectors Apple thinks are used (most while you keep using it, some physical): https://support.apple.com/en-us/105120 https://support.apple.com/en-us/105120