Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

motherboard.vice.com

Post reply on HN
Print view View original

21–30 of 49 posts

Re: Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

#21

Post by wmf »

Someone1234 wrote: post #16
gruez wrote: post #5

>He’s defensive when I ask how he got the phones. >“Well, I didn’t steal any device. I actually paid for them,” Sounds like the "it fell off a truck" excuse.

It could be more nuanced than that. Some Chinese manufacturers have been known to have a "night shift." Which is to say that during the day they produce a manufacturer's products, and during the night they produce an off-label or unauthorised version. These phones all had Foxconn labels on them, there was no Apple branding or logos. It is possible they were unauthorized but not "stolen." As I said, it is a nuance, an…

That doesn't really work for Apple products because they require unique components (like the SoC) that can't be bought anywhere and presumably the inventory is tracked carefully (e.g. 10,000 A12s go into the factory and ~10,000 iPhones go out).

Re: Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

#23

Post by thisacctforreal »

saagarjha wrote: post #19
earenndil wrote: post #17

Earlier quoted context omitted.

I believe that graykey was able to try passcodes at a faster-than-should-be-allowed rate, which does indicate a flaw but not a serious one.

That sounds plenty serious to me.

There is a hard limit of 80ms per attempt, from the number of PBKDF2 iterations tuned for the secure enclave.

Re: Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

#24

Post by saagarjha »

jd20 wrote: post #15
saagarjha wrote: post #14

Earlier quoted context omitted.

Specifically, developer-fused hardware allows for stuff like setting boot arguments and having them actually get passed to the kernel. Basically, it lets you get in the way of and modify the "chain of trust" that the bootloader → kernel → userland processes normally ensures.

Thanks for clarifying, I figured I was generalizing it a bit.

To be honest, I think the daily builds are signed by B&I as well, so you can install them on production hardware provided you have valid AppleConnect credentials (which I think just authorizes the install). You just won't be able to debug the kernel, etc.

Re: Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

#25

Post by saagarjha »

thisacctforreal wrote: post #23
saagarjha wrote: post #19

Earlier quoted context omitted.

That sounds plenty serious to me.

There is a hard limit of 80ms per attempt, from the number of PBKDF2 iterations tuned for the secure enclave.

Which means that it can get through the entire six digit password keyspace in under a day.

Re: Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

#27

Post by abalone »

thisacctforreal wrote: post #23
saagarjha wrote: post #19

Earlier quoted context omitted.

That sounds plenty serious to me.

There is a hard limit of 80ms per attempt, from the number of PBKDF2 iterations tuned for the secure enclave.

It's much more than that. According to Apple's iOS security whitepaper, the SEP is supposed to enforce escalating time delays in between attempts -- up to one hour after the 9th attempt. And survive restarts.

It certainly seems like GrayKey bypassed a fundamental SEP protection, which would constitute a very serious flaw. The SEP protections are supposed to be a whole 'nother level (which is what this article gets at.. it's Hard to even get at the firmware).

If that aspect of the SEP is compromised, what else about it is? This is extra disturbing because Apple's "fix" was to disconnect unauthorized peripherals -- not, apparently, a fix to the SEP itself. This is why I am stunned there was not more coverage of this. It's smoke that indicates a really fundamental flaw in the SEP.

[1] https://www.apple.com/business/site/docs/iOS_Security_Guide.... (page 18)

Re: Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

#28

Post by therein »

jd20 wrote: post #12

> The phone boots into an operating system known as “Switchboard,” which has a no-nonsense black background and is intended for testing different functionalities on the phone. I think the article confuses the meaning of "dev-fused" hardware, with what OS is actually installed on the phone. When I used to work at Apple, I always understood "dev-fused" to mean a device on which you could install unsigned builds of iOS.…

How about PurpleRestore? :)

I binge-read all of luna and the "other" internal wiki back in the day. :)

Re: Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

#29

Post by lawnchair_larry »

mikepurvis wrote: post #13

Mathew Solnik is not impressed, full text: "The article that has been published regarding me is a complete hit piece. It provides no hard evidence and is based on pure rumor. It’s sad to see the publication stope to such levels. This is not worth any further response and will get none. End of Story." https://twitter.com/msolnik/status/1103395763068043264

No hard evidence of what exactly? His reply doesn’t make much sense. Other than maybe he doesn’t think it looks flattering when you’re abruptly let go from 2 jobs and your consulting venture doesn’t pan out.

Re: Prototype iPhones That Hackers Use to Research Apple’s Most Sensitive Code

#30

Post by saagarjha »

therein wrote: post #28
jd20 wrote: post #12

> The phone boots into an operating system known as “Switchboard,” which has a no-nonsense black background and is intended for testing different functionalities on the phone. I think the article confuses the meaning of "dev-fused" hardware, with what OS is actually installed on the phone. When I used to work at Apple, I always understood "dev-fused" to mean a device on which you could install unsigned builds of iOS.…

How about PurpleRestore? :) I binge-read all of luna and the "other" internal wiki back in the day. :)

PurpleRestore will refuse to work unless you have valid AppleConnect credentials, AFAIK.
Post reply on HN