Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The bumpy road towards iPhone 5c NAND mirroring

arxiv.org

Post reply on HN
Print view View original

21–30 of 69 posts

Re: The bumpy road towards iPhone 5c NAND mirroring

#21

Post by Sanddancer »

xt00 wrote: post #10
CGamesPlay wrote: post #5

Probably useful to mention this in the comments here: this works for the 5c, but not the 6 and beyond, due to the addition of the Secure Enclave.

So the secure enclave must have an embedded flash inside the processor that includes the pin code attempt counter -- meaning that writing to the external flash would not happen at all right?

From what Apple's released on how iPhone security works [1], it sounds like such keys are still written to external flash, just in a much more low-level way. So there may be a theoretical way to do this attack on a more recent iphone, but you'd have to do a lot more reverse engineering to figure out a few layers of undocumented proprietary protocols.

[1] https://www.apple.com/business/docs/iOS_Security_Guide.pdf

Re: The bumpy road towards iPhone 5c NAND mirroring

#22

Post by sigmar »

CGamesPlay wrote: post #5

Probably useful to mention this in the comments here: this works for the 5c, but not the 6 and beyond, due to the addition of the Secure Enclave.

This is contradicted within the linked research:

>The same approach could be applied to the newer models of iPhone. The same type of LGA60 NAND chips are used up to the iPhone 6 Plus. Any attacker with sufficient technical skills could repeat the experiments. Newer iPhones will require more sophisticated equipment and FPGA test board

Re: The bumpy road towards iPhone 5c NAND mirroring

#25

Post by sigmar »

dogma1138 wrote: post #7
dmitrygr wrote: post #3

Earlier quoted context omitted.

< $50 in parts (just a PIC24)

There are quite more parts to that, as well as the scope, logic analyzers and quite a few other components. It doesn't end up to 1M$ but it's also not 50$.

It's stated in the end of the paper. Less than $100

Re: The bumpy road towards iPhone 5c NAND mirroring

#26

Post by [deleted] »

boxfire wrote: post #17
Sniffnoy wrote: post #8

A note -- if you're linking to arXiv, it's better to link to the abstract ( https://arxiv.org/abs/1609.04327 ) rather than directly to the PDF. From the abstract, one can easily click through to the PDF; not so the reverse. And the abstract allows one to do things like see different versions of the paper, search for other things by the same authors, etc. Thank you!

This is a new result published yesterday, with no revisions. A direct link is extremely preferable to those of us who are interested in actually reading the paper. If you are doing homework, you can search the paper title.

[deleted]

Re: The bumpy road towards iPhone 5c NAND mirroring

#27

Post by xmodem »

sigmar wrote: post #22
CGamesPlay wrote: post #5

Probably useful to mention this in the comments here: this works for the 5c, but not the 6 and beyond, due to the addition of the Secure Enclave.

This is contradicted within the linked research: >The same approach could be applied to the newer models of iPhone. The same type of LGA60 NAND chips are used up to the iPhone 6 Plus. Any attacker with sufficient technical skills could repeat the experiments. Newer iPhones will require more sophisticated equipment and FPGA test board

The iOS security guide would appear to contradict this:

https://www.apple.com/business/docs/iOS_Security_Guide.pdf

> On devices with an A7 or later A-series processor, the delays are enforced by the Secure Enclave. If the device is restarted during a timed delay, the delay is still enforced, with the timer starting over for the current period.

This is not super specific, but would imply that the secure enclave has its own storage.

Re: The bumpy road towards iPhone 5c NAND mirroring

#28

Post by dogma1138 »

sigmar wrote: post #25
dogma1138 wrote: post #7

Earlier quoted context omitted.

There are quite more parts to that, as well as the scope, logic analyzers and quite a few other components. It doesn't end up to 1M$ but it's also not 50$.

It's stated in the end of the paper. Less than $100

With access to a research facility quality electronics lab, and they still haven't managed to create a functional backup on a new NAND chip.

"Unfortunately, the 1:1 backup copy did not work in the iPhone 5c. Even the boot Apple logo did not appear on the power up. There were some references to hidden partitions used in iPhone NAND storage which makes cloning a challenging task."

Re: The bumpy road towards iPhone 5c NAND mirroring

#29

Post by abalone »

sigmar wrote: post #22
CGamesPlay wrote: post #5

Probably useful to mention this in the comments here: this works for the 5c, but not the 6 and beyond, due to the addition of the Secure Enclave.

This is contradicted within the linked research: >The same approach could be applied to the newer models of iPhone. The same type of LGA60 NAND chips are used up to the iPhone 6 Plus. Any attacker with sufficient technical skills could repeat the experiments. Newer iPhones will require more sophisticated equipment and FPGA test board

They are wrong. The A7 added a hardware passcode attempt counter that would defeat their method.[1]

And that's not all. With the introduction of Touch ID, Apple has shifted to 6 digit passcodes as the standard. The authors note that their method would not work so well, even if they had infinite time:

"Given six attempts per each rewrite this method would require at most 1667 rewrites to find a 4-digit passcode. For a 6-digit passcode it would require over 160 thousand rewrites and will very likely damage the Flash memory storage."

If you want to decrypt the modern iPhone you'd probably have to try to poke inside of the secure enclave with an SEM or something. And then you're getting into the realm of hardware defenses against this kind of intrusion, like physical self-destruction when probed.. not sure if Apple's doing anything there but it's crazy stuff.

[1] https://www.apple.com/business/docs/iOS_Security_Guide.pdf (page 12)

Re: The bumpy road towards iPhone 5c NAND mirroring

#30

Post by ramblenode »

Sniffnoy wrote: post #8

A note -- if you're linking to arXiv, it's better to link to the abstract ( https://arxiv.org/abs/1609.04327 ) rather than directly to the PDF. From the abstract, one can easily click through to the PDF; not so the reverse. And the abstract allows one to do things like see different versions of the paper, search for other things by the same authors, etc. Thank you!

For those who don't have a PDF viewer in their browser it's also quite annoying to have to download the paper just to see what it's about.
Post reply on HN