Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

motherboard.vice.com

Post reply on HN
Print view View original

11–20 of 49 posts

Re: Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

#11

Post by evolvedcleaning »

Despegar wrote: post #6

>In 2017, however, Solnik was hired by Apple to work on its security team, specifically on the so-called red team, which audits and hacks the company’s products. His talk at Black Hat had apparently impressed the folks at Cupertino. A few weeks later, however, he abruptly left the company, according to multiple sources. >The full story of Solnik’s short stint at Apple is a closely-guarded secret. Motherboard spoke to…

Money talks, if they paid him enough they could buy his loyalty

Similar parallels exist in many walks of life. Those guarding assets need incentives to be loyal

In a case of a potentially bad actor/blackest hat, you make them an offer they can’t refuse. Take lots of money and stay quiet, or we will unleash our government pit bulls.

Re: Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

#12

Post by jd20 »

> The phone boots into an operating system known as “Switchboard,” which has a no-nonsense black background and is intended for testing different functionalities on the phone.

I think the article confuses the meaning of "dev-fused" hardware, with what OS is actually installed on the phone. When I used to work at Apple, I always understood "dev-fused" to mean a device on which you could install unsigned builds of iOS.

Internally, Apple puts out new builds of iOS daily. The engineers building features on top of iOS need to install these builds, to do their work. A normal iPhone from a store won't take these unsigned builds, hence the need for these dev-fused devices. There are regular builds like what a customer would get, debug builds with lots of logging and debugging checks enabled, and even bare-bones builds like switchboard, for employees who are not UI-disclosed or work in factories. As someone building higher-level iOS features, all my dev-fused devices just ran a normal looking iOS, unlike what the article describes.

> Two people showed Motherboard how to get root access on the phone we used; it was a trivial process that required using the login: “root” and a default password: “alpine.”

Oh boy, that sure brings back memories!

Re: Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

#13

Post by mikepurvis »

Mathew Solnik is not impressed, full text:

"The article that has been published regarding me is a complete hit piece. It provides no hard evidence and is based on pure rumor. It’s sad to see the publication stope to such levels. This is not worth any further response and will get none. End of Story."

https://twitter.com/msolnik/status/1103395763068043264

Re: Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

#14

Post by saagarjha »

jd20 wrote: post #12

> The phone boots into an operating system known as “Switchboard,” which has a no-nonsense black background and is intended for testing different functionalities on the phone. I think the article confuses the meaning of "dev-fused" hardware, with what OS is actually installed on the phone. When I used to work at Apple, I always understood "dev-fused" to mean a device on which you could install unsigned builds of iOS.…

Specifically, developer-fused hardware allows for stuff like setting boot arguments and having them actually get passed to the kernel. Basically, it lets you get in the way of and modify the "chain of trust" that the bootloader → kernel → userland processes normally ensures.

Re: Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

#15

Post by jd20 »

saagarjha wrote: post #14
jd20 wrote: post #12

> The phone boots into an operating system known as “Switchboard,” which has a no-nonsense black background and is intended for testing different functionalities on the phone. I think the article confuses the meaning of "dev-fused" hardware, with what OS is actually installed on the phone. When I used to work at Apple, I always understood "dev-fused" to mean a device on which you could install unsigned builds of iOS.…

Specifically, developer-fused hardware allows for stuff like setting boot arguments and having them actually get passed to the kernel. Basically, it lets you get in the way of and modify the "chain of trust" that the bootloader → kernel → userland processes normally ensures.

Thanks for clarifying, I figured I was generalizing it a bit.

Re: Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

#16

Post by Someone1234 »

gruez wrote: post #5

>He’s defensive when I ask how he got the phones. >“Well, I didn’t steal any device. I actually paid for them,” Sounds like the "it fell off a truck" excuse.

It could be more nuanced than that.

Some Chinese manufacturers have been known to have a "night shift." Which is to say that during the day they produce a manufacturer's products, and during the night they produce an off-label or unauthorised version. These phones all had Foxconn labels on them, there was no Apple branding or logos. It is possible they were unauthorized but not "stolen." As I said, it is a nuance, and one I imagine Apple's legal team wouldn't be distracted by.

PS - I am in no way defending anything. Just simply explaining there's other possible explanations for how unauthorised devices exist.

Re: Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

#17

Post by earenndil »

abalone wrote: post #2

Is there any info on how GrayKey worked? My understanding is that in recent models the SEP was supposed to prevent that kind of brute forcing of passcodes at the hardware level — and also enforce a secure boot chain that prevents loading hostile firmware (which it looks like GrayKey did based on screen shots). This would seem to involve an exploit of the SEP which is very serious... or was there some simpler exploit?…

I believe that graykey was able to try passcodes at a faster-than-should-be-allowed rate, which does indicate a flaw but not a serious one.

Re: Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

#18

Post by yborg »

mikepurvis wrote: post #13

Mathew Solnik is not impressed, full text: "The article that has been published regarding me is a complete hit piece. It provides no hard evidence and is based on pure rumor. It’s sad to see the publication stope to such levels. This is not worth any further response and will get none. End of Story." https://twitter.com/msolnik/status/1103395763068043264

I notice he didn't deny the use of dev mode debug devices. I personally don't see what the big deal is apart from implying magical hacker skills - reverse engineering even from a debug device is still impressive work.

Re: Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

#19

Post by saagarjha »

earenndil wrote: post #17
abalone wrote: post #2

Is there any info on how GrayKey worked? My understanding is that in recent models the SEP was supposed to prevent that kind of brute forcing of passcodes at the hardware level — and also enforce a secure boot chain that prevents loading hostile firmware (which it looks like GrayKey did based on screen shots). This would seem to involve an exploit of the SEP which is very serious... or was there some simpler exploit?…

I believe that graykey was able to try passcodes at a faster-than-should-be-allowed rate, which does indicate a flaw but not a serious one.

That sounds plenty serious to me.

Re: Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

#20

Post by roywiggins »

mikepurvis wrote: post #13

Mathew Solnik is not impressed, full text: "The article that has been published regarding me is a complete hit piece. It provides no hard evidence and is based on pure rumor. It’s sad to see the publication stope to such levels. This is not worth any further response and will get none. End of Story." https://twitter.com/msolnik/status/1103395763068043264

A pretty classic non-denial denial. "No hard evidence" and "pure rumor" is not technically a denial- he's not saying the story is false.
Post reply on HN