31–40 of 69 posts
Earlier quoted context omitted.
It's stated in the end of the paper. Less than $100
With access to a research facility quality electronics lab, and they still haven't managed to create a functional backup on a new NAND chip. "Unfortunately, the 1:1 backup copy did not work in the iPhone 5c. Even the boot Apple logo did not appear on the power up. There were some references to hidden partitions used in iPhone NAND storage which makes cloning a challenging task."
Earlier quoted context omitted.
With access to a research facility quality electronics lab, and they still haven't managed to create a functional backup on a new NAND chip. "Unfortunately, the 1:1 backup copy did not work in the iPhone 5c. Even the boot Apple logo did not appear on the power up. There were some references to hidden partitions used in iPhone NAND storage which makes cloning a challenging task."
... keep reading
Edit: You are correct, I've misread it.
A note -- if you're linking to arXiv, it's better to link to the abstract ( https://arxiv.org/abs/1609.04327 ) rather than directly to the PDF. From the abstract, one can easily click through to the PDF; not so the reverse. And the abstract allows one to do things like see different versions of the paper, search for other things by the same authors, etc. Thank you!
You can also see when the paper was submitted.
I do appreciate the authors that put one on there, though. Saves much Googling. :)
I wonder how much the entire rig cost him? Not $1 million, that's for sure!
Vindicated. https://news.ycombinator.com/item?id=11199093
https://news.ycombinator.com/item?id=10906999
Mobile phones aren't secure. Period. Anyone saying otherwise about theirs better provide convincing evidence that they mitigated everything on that non-comprehensive list. Then we talk about what I left off. When FBI said they couldn't get in, I knew they were lying to try to establish a precedent & technical method to increase their convenience. It was also only time Richard Clarke's pronouncement was relieving where he said (paraphrased) "I'd just ask the NSA to break into it." Because they or a contractor could due to risks not mitigated. Obvious.
Honestly not sure if I'll ever trust a tiny, slim smartphone for high-security INFOSEC given the effect of EMSEC on size and hardware POLA on power consumption. If their physical specs are Apple-grade, then they cut corners on INFOSEC and some government hacker has job security.
Earlier quoted context omitted.
You can also see when the paper was submitted.
Oh I find it so aggravating when I don't have a date. It seems like most academic papers I found on interesting security and programming stuff didn't have dates. I had to pull them off Citeseerx or the school's site. You'd think it would be a requirement in the style guides given importance of when something was published for relevance or context. I've never heard an explanation for why this isn't so. I do appreciate…
Papers that aren't published at conferences (preprints, technical reports... etc) don't have any standard format for this. Sometimes (especially for preprints) it's left out in expectation of adding the copyright notice in a future version, sometimes it's left out because the document is in a very preliminary stage and hasn't been officially published and sometimes it's left out because people just didn't think of it and there's no standard format that includes a date for things that aren't published to a specific venue.
Earlier quoted context omitted.
So the secure enclave must have an embedded flash inside the processor that includes the pin code attempt counter -- meaning that writing to the external flash would not happen at all right?
From what Apple's released on how iPhone security works [1], it sounds like such keys are still written to external flash, just in a much more low-level way. So there may be a theoretical way to do this attack on a more recent iphone, but you'd have to do a lot more reverse engineering to figure out a few layers of undocumented proprietary protocols. [1] https://www.apple.com/business/docs/iOS_Security_Guide.pdf
"Each Secure Enclave is provisioned during fabrication with its own UID (Unique ID) that is not accessible to other parts of the system and is not known to Apple. When the device starts up, an ephemeral key is created, entangled with its UID, and used to encrypt the Secure Enclave’s portion of the device’s memory space.
Additionally, data that is saved to the file system by the Secure Enclave is encrypted with a key entangled with the UID and an anti-replay counter. "
This sounds like the secure enclave chip has a secret key, and all of its uses of external memory are encrypted using said key. This sounds like one would either need to break the crypto system itself, or compromise the secure enclave co-processor.
Earlier quoted context omitted.
What worse is that they (or at least Comey) explicitly said that NAND mirroring does not work. When he was testifying before Congress, we was asked by several Congress people about NAND mirroring and (if I remember correctly) said that the technical experts had looked into it. This is either gross incompetence or outright perjury.
Well for the FBI NAND mirroring might not be a solution. In the article the author mentions that this technique can effectively damage the flash memory because you can get effectively into a state where you are causing wear due to writes. In theory you can scale this up and copy the contents of memory into an FPGA which emulates NAND (both logically and physically) or just hold multiple copies on different chips but…
Of course, the FBI director does not need to know this level of detail about every case, but given how much he appears to have known, he should not have been speaking about the case beyond directing people to ask the person in charge of the case.
[0] Although, I would argue, in cases where no alternative exists, if the FBI policies prevent NAND mirroring, they should be revisited. Even if it has the potential to be destructive, they would only be destroying otherwise unusable information.
Vindicated. https://news.ycombinator.com/item?id=11199093
No one with the slightest technical background thought the phone was uncrackable, maybe not directly by the FBI but by pretty much any 3rd party contractor that does even basic flash data recovery. The FBI was looking to set a precedent in order to be able to gain easy access to phones that could be also used by law enforcement, a local sheriff's department is less likely to be able to contract it out for every case…