Judge forces Apple to unlock iPhone

[lopri]

http://nyti.ms/1XZ3tLn
US says it has unlocked iPhone in question and is ending the lawsuit.

You have to wonder if this is an elaborate scheme devised by the White House and Apple in order to give Apple a cover. (v. China, EU, etc.)

 

[ImpulsE69]

Oh...but it gets better

iphone worthless after FBI spills glass of water on it (fake )

http://www.newyorker.com/humor/boro...hless-after-f-b-i-spills-glass-of-water-on-it

FBI conspiracy? I think so.

By the way, can Apple sue the government due to bypassing DRM? Isn't that a law that we all get threatened with regularly?

 

[Fanatical Meat]

nm

 

[Subyman]

Maybe it has been mentioned, but I wouldn't be surprised if the FBI didn't crack the phone at all. They may have not wanted to go to court because there is a chance that Apple could set a huge precedent. So, if they say they cracked it on their own then it would both make the FBI look like a technical powerhouse and eliminates a potentially damaging case. Apple, in turn, looks bad because it creates the narrative that their OS was cracked without their help.

I'd think the FBI would be touting some kind of information they found on the phone that could have been useful if they had actually cracked it, regardless of how insignificant the information was.

 

[Darwin333]

As I said last month:

Is there a way to make a phone in which an attack like that is impossible?

 

[CZroe]

Oh...but it gets better

iphone worthless after FBI spills glass of water on it (fake )

http://www.newyorker.com/humor/boro...hless-after-f-b-i-spills-glass-of-water-on-it

FBI conspiracy? I think so.

By the way, can Apple sue the government due to bypassing DRM? Isn't that a law that we all get threatened with regularly?

In case you missed it: "satire"

 

[UglyCasanova]

Maybe it has been mentioned, but I wouldn't be surprised if the FBI didn't crack the phone at all. They may have not wanted to go to court because there is a chance that Apple could set a huge precedent. So, if they say they cracked it on their own then it would both make the FBI look like a technical powerhouse and eliminates a potentially damaging case. Apple, in turn, looks bad because it creates the narrative that their OS was cracked without their help.

I'd think the FBI would be touting some kind of information they found on the phone that could have been useful if they had actually cracked it, regardless of how insignificant the information was.

I haven't thought of that but hell who knows. Surely the FBI wouldn't purposefully damage the reputation of a us company out of spite though? I would hope anyways...

 

[Darwin333]

Choosing a long alphanumeric passcode is still your best chance against this and any other brute force attack.

That is serious pain in the ass on a phone which most people unlock quite often everyday but I guess if you are a terrorist or criminal it's well worth the effort.

 

[Paratus]

Is there a way to make a phone in which an attack like that is impossible?

From reading on line it looks like the newer SOCs, A7 and up, with the secure enclave are hardened against NAND mirroring attacks. The encrypted key is stored in the secure enclave which the chip will erase if it recieves to many incorrect PINs.

Even if you do desolder the SOC you can't directly copy the encrypted key like you can from the older SOCs that store the key in NAND.

In that case you would need an Apple signed firmware update to the SOC to disable the key erasure. Hence the request from the FBI.

That is serious pain in the ass on a phone which most people unlock quite often everyday but I guess if you are a terrorist or criminal it's well worth the effort.

Well that's why they added they added the fingerprint scanner. You can have a complex passcode but not have to use it daily.

Of course that means if you are arrested they can just put your finger on the scanner if the phone hasn't been rebooted, the battery hasn't died and it's been less than 48 hours since you unlocked it.

I'd say, the newest iPhones are pretty secure with reasonable trade offs between usability and security. The only real change I could see them make is to prevent any firmware updates without unlocking the phone and maybe using coatings on the chips to make desoldering more difficult.

 

[CZroe]

Choosing a long alphanumeric passcode is still your best chance against this and any other brute force attack.

That is serious pain in the ass on a phone which most people unlock quite often everyday but I guess if you are a terrorist or criminal it's well worth the effort.

You are forgetting something: It's only a PITA if you aren't using TouchID. It's the fall-back that they'd have to break. Of course, if the shooters HAD been using TouchID on a TouchID-capable phone then the FBI would have been in a long time ago (we have their fingerprints) but someone with the phone or phone's data alone in another situation with the owner unknown/at large would be less likely to have that. Good thing phone screens are also fingerprint-magnets!

 

[Paratus]

You are forgetting something: It's only a PITA if you aren't using TouchID. It's the fall-back that they'd have to break. Of course, if the shooters HAD been using TouchID on a TouchID-capable phone then the FBI would have been in a long time ago (we have their fingerprints) but someone with the phone or phone's data alone in another situation with the owner unknown/at large would be less likely to have that. Good thing phone screens are also fingerprint-magnets!

As I alluded to above, the fingerprint reader only works if the phone hasn't been turned off or rebooted and its been less than 48 hours since the last time it was unlocked. So it depends on the situation. Supposedly it also requires a live finger. Hackers have demonstrated lifting a print from the phone and making a latex copy that fits on a finger that will unlock the phone in less than a day.

For this particular case they would have had to find the phone and made the correct print within 48 hours of the last time he unlocked the phone. So it's a possible but not certain way to hack a Touch ID enabled phone.

Interestingly a judge can order you to unlock a phone with you finger but not compel you to provide a PIN. The 5th amendment only protects the latter case.

 

[fskimospy]

As I alluded to above, the fingerprint reader only works if the phone hasn't been turned off or rebooted and its been less than 48 hours since the last time it was unlocked. So it depends on the situation. Supposedly it also requires a live finger. Hackers have demonstrated lifting a print from the phone and making a latex copy that fits on a finger that will unlock the phone in less than a day.

For this particular case they would have had to find the phone and made the correct print within 48 hours of the last time he unlocked the phone. So it's a possible but not certain way to hack a Touch ID enabled phone.

Interestingly a judge can order you to unlock a phone with you finger but not compel you to provide a PIN. The 5th amendment only protects the latter case.

Wait is that for real? Finger but not pin? That's insane.

 

[Paratus]

Wait is that for real? Finger but not pin? That's insane.

At least in one case so far it is.

http://www.macrumors.com/2014/10/31/fingerprints-not-protected-by-fifth-amendment/

 

[Darwin333]

You are forgetting something: It's only a PITA if you aren't using TouchID. It's the fall-back that they'd have to break. Of course, if the shooters HAD been using TouchID on a TouchID-capable phone then the FBI would have been in a long time ago (we have their fingerprints) but someone with the phone or phone's data alone in another situation with the owner unknown/at large would be less likely to have that. Good thing phone screens are also fingerprint-magnets!

I saw something not long ago where they printed copies of fingerprints with a normal inkjet printer and it worked at unlocking phones. I don't remember if it was an iphone or not but I didn't think that consumer level fingerprint scanners on phones were all that secure.

I am hoping Apple's next update makes it to where any forced update without user consent automatically wipes the phone. That would solve this entire problem and the only possible remedy the .gov would have is for Congress to pass a law forbidding manufacturers from making something "too secure" which I don't think will happen but you never know with the .gov.

 

[Darwin333]

Interestingly a judge can order you to unlock a phone with you finger but not compel you to provide a PIN. The 5th amendment only protects the latter case.

Has this actually been settled by the courts? I recall a judge ordering someone to give them a password and the person refusing and being held in contempt of court and jailed until they complied. I don't recall reading how that ended but I do know the person was sent to jail for refusing to provide a pin/password. The judges argument was that it was no different then demanding you turn over a key to your house after a search warrant has been issued.

 

[Darwin333]

Wait is that for real? Finger but not pin? That's insane.

From one of the comments. If they can't compel you to give them the pin because it's in your memory but can compel you to use your finger wouldn't the correct finger also be "in your memory"? So just use the wrong finger 5 times and the phone locks.

 

[Ichinisan]

... the only possible remedy the .gov would have is for Congress to pass a law forbidding manufacturers from making something "too secure" which I don't think will happen but you never know with the .gov.

I fear this will actually happen. That's basically what they were doing in this case.

"YOU ARE ORDERED to neuter your security and let us crack this phone."

 

[Exterous]

So while the FBI dropped its case apparently a third party has helped them out. The FBI has wasted no time in using it's new found abilities to unlock other phones in other cases:

http://bgr.com/2016/03/31/fbi-unlock-iphone-criminal-case/

Appears to only be related to the iPhone 5c but its clear the FBI wants to do be able to do this whenever they want

 

[waggy]

to those saying that it was about just this phone and they NEEDED apples help.. what now?

within days of them losing they have a "crack". It is spreading to other phones.

 

[Humpy]

An interesting internet fueled theory is that it was still Apple that gave access to the phone via a series of iOS updates (9.33 and 9.34), coinciding with the FBI dropping the issue, that first broke older phones and then provided a fix that allowed the phone to be reset without the code.

The entire controversy goes away by disguising the solution as a simple software bug that is quickly fixed.
http://9to5mac.com/2016/03/24/bricked-iphone-5s-5-ipad-2-ios-9-3-fix/

 

[Sonikku]

Don't worry guys, I'm sure if the government gained the ability to crack a phone that they will only ever use it against the terrorists and would never ever possibly dream of doing it to their own citizens. :hmm:

 

[Ichinisan]

An interesting internet fueled theory is that it was still Apple that gave access to the phone via a series of iOS updates (9.33 and 9.34), coinciding with the FBI dropping the issue, that first broke older phones and then provided a fix that allowed the phone to be reset without the code.

The entire controversy goes away by disguising the solution as a simple software bug that is quickly fixed.
http://9to5mac.com/2016/03/24/bricked-iphone-5s-5-ipad-2-ios-9-3-fix/

Software updates require the PIN to be entered.

The iPhone 5c had weaker hardware security than the 5s and everything since. They all have "secure enclave" now.

 

[CZroe]

So while the FBI dropped its case apparently a third party has helped them out. The FBI has wasted no time in using it's new found abilities to unlock other phones in other cases:



http://bgr.com/2016/03/31/fbi-unlock-iphone-criminal-case/



Appears to only be related to the iPhone 5c but its clear the FBI wants to do be able to do this whenever they want

The 6 and 6S had already rendered the technique useless so Apple knew of the potential vulnerability of storing such data on the flash memory instead of the secure enclave in another chip. It wasn't 5C-specific and it isn't some exploit that has to be shared with Apple. They know.

 

[poofyhairguy]

What I love about this whole situation it is shows how uncoordinated different parts of the government are. The FBI knows what they are doing somewhat- this case they dragged out had to do with terrorism (the big scary to most people) and when the public opinion started to go against them they bailed out in a way that made Apple look bad. Overall they handled it like pros.

But then the jokers over at the DOJ decide they want to ride the Feds coattails, and when the Feds back down they still push forward with the WORST case possible for public opinion:

https://www.washingtonpost.com/news...rce-apple-to-help-unlock-iphone-in-drug-case/

In every way that the Feds case works (terrorism, dead suspect, suspect's work phone, etc.) this case doesn't (drug dealer, already admitted guilt, personal phone). They have their heads so far up their asses that they don't understand that drugwar related crap is the EXACT kind police state BS that freaks people out when they think of the cops breaking into our phones. They aren't going to get sympathy from the public on this one, and they will have no clue why. Shows how tone deaf they are and why encryption is important.