GrayKey iPhone unlocker poses serious security concerns • Hacker News Board

Re: GrayKey iPhone unlocker poses serious security concerns

#81

Post by 0culus » Sat, Mar 17, 2018, 3:39 PM UTC

jokoon wrote: post #56

I thought iPhone were electronically secure, it seems they are not. I thought the FBI had to just do some Xray of some chip to read some ROM thing. Sometimes I wonder if real security is really and theoretically possible, or if it's just engineers who never manage to achieve it because designers want things to be usable for consumers. What ever happens it doesn't seem really secure, consumer oriented device do exist.…

Yes it is, and has been done. Subject to [edit: a] security policy (NOT defined by implementation) and a meaningful statement of threat (what are you protecting against?)

This paper might prove to be an enlightening read: http://www.mdpi.com/2078-2489/7/2/23

Re: GrayKey iPhone unlocker poses serious security concerns

#82

Post by ErikHuisman » Sat, Mar 17, 2018, 3:53 PM UTC

Mtinie wrote: post #20

jsizzle wrote: post #10

Is it just me or does the price point seem extremely low? They have a device that should be in high demand globally, and maybe one competitor. And they are charging 15-30k, for basically unlimited usage?? You can't tell me federal law enforcement wouldn't pay at minimum ten times that amount for metered usage...

That was my thought, too. Other than this report, has there been verifiable evidence the device even works? The photo stagings remind me of ones I’d use on a pre-release marketing site for a vapor-ware product to test demand and a price point.

same principle https://www.youtube.com/watch?v=IXglwbyMydM

Re: GrayKey iPhone unlocker poses serious security concerns

#83

Post by chiefalchemist » Sat, Mar 17, 2018, 5:26 PM UTC

Twisell wrote: post #67

thisacctforreal wrote: post #3

Passphrases are always going to be the strongest, but you can have more than 6 digits in your pincode. Select "Custom Alphanumeric Code" in Passcode Options[1], but only enter digits using the keyboard. iOS will display a pin pad on the lock screen that will accept any number of digits[2]. I picked this up from the delicious iOS 11 security whitepaper[3]. [1] https://i.imgur.com/KEEC71B.png [2] https://i.imgur.com/Yr…

This is plainly brilliant. Just done that and the interface seems to not give any clue about the expected number of digits. Meaning that an attacker have no mean to even estimat the time needed to unlock. One could only figure out that complexity of password increased after failing all attempts with less digits (which will already take a lot of time). But of course alphanumerical would be even safer.

But why not take it a step further and present the standard KB? That would be a slight inconvenience, with a massive gain in confusion for anyone trying to guess their way in.

Re: GrayKey iPhone unlocker poses serious security concerns

#84

Post by jessedhillon » Sat, Mar 17, 2018, 5:33 PM UTC

coldcode wrote: post #72

saagarjha wrote: post #69

Earlier quoted context omitted.

I believe jailbreaking is a protected category for which an exception is made.

I find it hard to believe the jailbreaking for profit is a protected category.

> (e) Law Enforcement, Intelligence, and Other Government Activities.— This section does not prohibit any lawfully authorized investigative, protective, information security, or intelligence activity of an officer, agent, or employee of the United States, a State, or a political subdivision of a State, or a person acting pursuant to a contract with the United States, a State, or a political subdivision of a State.

Re: GrayKey iPhone unlocker poses serious security concerns

#85

Post by Piskvorrr » Sat, Mar 17, 2018, 6:23 PM UTC

mschuster91 wrote: post #70

I wonder: Apple has hundreds of billions in overseas cash. Why don't they go after Cellebrite and Grayshift and offer the owners something to the tune of 1-2 billion US$ in hard cash? Given the reputation hit once this knowledge becomes widespread, a couple billion dollars are pocket change.

Perhaps this is a viable model for vaporware (or perhaps extortion); not sure how much it matches the present case.

Re: GrayKey iPhone unlocker poses serious security concerns

#86

Post by whyenot » Sat, Mar 17, 2018, 6:37 PM UTC

bufferoverflow wrote: post #54

abalone wrote: post #47

Earlier quoted context omitted.

You misunderstand the SEP. It contains an externally unreadable private key baked in at manufacturing time that encrypts protected data. Your "wires" would read garbage. The iOS security white paper is worth a read. Perhaps a nation-state actor could shave down the processor and read that key with a SEM or some crazy thing, but that's literally how far the design is supposed to have pushed iOS security. Which is what…

SEMs are not that expensive. The cheap ones on eBay are $12-14K. The more expensive Chinese ones are closer to $200K. A security company can easily afford either.

Getting a SEM would be the easy part. The hard part would be sample preparation and interpreting the results.

Re: GrayKey iPhone unlocker poses serious security concerns

#87

Post by Rychard » Sat, Mar 17, 2018, 7:42 PM UTC

chiefalchemist wrote: post #83

Twisell wrote: post #67

Earlier quoted context omitted.

This is plainly brilliant. Just done that and the interface seems to not give any clue about the expected number of digits. Meaning that an attacker have no mean to even estimat the time needed to unlock. One could only figure out that complexity of password increased after failing all attempts with less digits (which will already take a lot of time). But of course alphanumerical would be even safer.

But why not take it a step further and present the standard KB? That would be a slight inconvenience, with a massive gain in confusion for anyone trying to guess their way in.

I had a bug recently on my Windows Phone after adding my corporate email account to Outlook. I assume it was some sort of group policy being erroneously applied, but it turned out to be a massive inconvenience.

Mostly because trying to unlock it displayed the standard keyboard[1], but simply wouldn't allow me to create a PIN with anything other than numeric characters[2], so every time I needed to unlock my phone I had to swipe the screen up, then change the keyboard over to the number/symbol mode, and enter my PIN using the small row of numbers there.

In the end, all I had to do was change my pin, and from that moment on, it only ever displayed the standard number pad for unlocking.

[1]: https://i.imgur.com/YENnjtY.png

[2]: https://i.imgur.com/OaSqLYO.png

Re: GrayKey iPhone unlocker poses serious security concerns

#88

Post by dheera » Sat, Mar 17, 2018, 8:18 PM UTC

abalone wrote: post #47

dheera wrote: post #37

Earlier quoted context omitted.

Time delays only provide a false sense of security. In theory I could always cut open the casing and just plug wires straight into the EMMC or whatever you have in there. Your time delay UI is useless if I just bypass your UI and wire straight into the hardware. Of course that's non-trivial EE work, but the point is it's possible, for someone with enough money and the right equipment. What would make it intractable i…

You misunderstand the SEP. It contains an externally unreadable private key baked in at manufacturing time that encrypts protected data. Your "wires" would read garbage. The iOS security white paper is worth a read. Perhaps a nation-state actor could shave down the processor and read that key with a SEM or some crazy thing, but that's literally how far the design is supposed to have pushed iOS security. Which is what…

> Perhaps a nation-state actor could shave down the processor and read that key with a SEM or some crazy thing, but that's literally how far the design is supposed to have pushed iOS security. Which is what makes this hack so embarrassingly bad (if confirmed).

Shaving down the processor is hard but still possible. A government with a billion-dollar budget can probably do it, if they want, including after practicing on a million throwaway phones in the process. Apple's design is also known as security by obscurity (https://en.wikipedia.org/wiki/Security_through_obscurity).

I much prefer an open design and security by high-entropy keys and well-established practices in the cryptography. I'd feel much safer using open cryptography libraries and strong passwords than arbitrarily and blindly trusting some secretive engineers at Apple.

Apple's design is super-hard to break but possible. My Linux laptop, on the other hand -- the hard drive is standard SATA. Have at it. I don't care if you have a billion dollars, you'll have a hard time breaking into my data for a probably at least a few decades.

Re: GrayKey iPhone unlocker poses serious security concerns

#89

Post by [deleted] » Sat, Mar 17, 2018, 8:52 PM UTC

jostylr wrote: post #78

nerdponx wrote: post #74

Earlier quoted context omitted.

I love it, but the XKCD wrench comic is fresh in my mind. When I was mugged, they just made me unlock the phone right there on the street.

It would be nice to have a panic code that one could type in, making it look unlocked, hiding apps a user could mark as secret, and optionally sending a security/tracking alert. This could also thwart a cracking device by making it look cracked at a shorter code, but giving no actually useful info.

[deleted]

Re: GrayKey iPhone unlocker poses serious security concerns

#90

Post by nerdponx » Sat, Mar 17, 2018, 9:46 PM UTC

xoa wrote: post #80

nerdponx wrote: post #74

Earlier quoted context omitted.

I love it, but the XKCD wrench comic is fresh in my mind. When I was mugged, they just made me unlock the phone right there on the street.

That XKCD comic was wrong and one of the rare truly stupid and actively misinformative ones. Security measures are always about responding to threat scenarios and economics, and must in turn be analyzed in context. The general use paradigm for an average device involves many different threats and in turn separate measures for each one. FDE for example is only about protecting from cold attacks, warm/hot ones are just…

Fine, but a wrench, or something analogous, is the most serious threat model for most smartphones. On Apple devices, at least, the Find my iPhone feature mitigates most others.