Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cellebrite claims it can unlock any iPhone, many new Android phones for police

wired.com

Post reply on HN
Print view View original

11–20 of 90 posts

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#11

Post by eridius »

gruez wrote: post #6
jMyles wrote: post #3

First of all, to give words to the obvious question here: what leads a group of people to flaunt their insanely unethical desire to profit from ? They are literally trumpeting the ability for their clients to forcibly copy data without the permission of the owner of the device in question. Is it just money? Is it that simple? Annnyway, more importantly: are there any details about how their claims are even possible?…

>isn't this a solved problem? It’s only a solved problem if you’re using high entropy passwords (6 digit pins are not). Otherwise you’re relying on some sort of anti-hammering/auto erase to make up for it.

iPhones have anti-hammering already. The Secure Enclave counts password attempts and enforced a lockout period (and wipes the keys after 10 attempts if configured to do so).

There was an attack years ago, where you could kill power to the device after failing the attempt but before it incremented the attempt counter, but they fixed that, and that may have predated the Secure Enclave anyway (and required taking apart the phone, which I assume this on-premises device doesn’t do).

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#12

Post by hueving »

jMyles wrote: post #3

First of all, to give words to the obvious question here: what leads a group of people to flaunt their insanely unethical desire to profit from ? They are literally trumpeting the ability for their clients to forcibly copy data without the permission of the owner of the device in question. Is it just money? Is it that simple? Annnyway, more importantly: are there any details about how their claims are even possible?…

Are you seriously shocked that there are people out there that would be willing to assist law enforcement? It's not like they are advertising this service for anyone to drop by with any arbitrary phone to unlock.

They are no worse than locksmiths advertising the ability to crack safes.

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#13

Post by gruez »

eridius wrote: post #11
gruez wrote: post #6

Earlier quoted context omitted.

>isn't this a solved problem? It’s only a solved problem if you’re using high entropy passwords (6 digit pins are not). Otherwise you’re relying on some sort of anti-hammering/auto erase to make up for it.

iPhones have anti-hammering already. The Secure Enclave counts password attempts and enforced a lockout period (and wipes the keys after 10 attempts if configured to do so). There was an attack years ago, where you could kill power to the device after failing the attempt but before it incremented the attempt counter, but they fixed that, and that may have predated the Secure Enclave anyway (and required taking apart…

Right, they have it, but whether it's secure/bug free is uncertain. Much more uncertain than say, wether AES-CBC is secure/bug free.

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#14

Post by speedplane »

hueving wrote: post #12
jMyles wrote: post #3

First of all, to give words to the obvious question here: what leads a group of people to flaunt their insanely unethical desire to profit from ? They are literally trumpeting the ability for their clients to forcibly copy data without the permission of the owner of the device in question. Is it just money? Is it that simple? Annnyway, more importantly: are there any details about how their claims are even possible?…

Are you seriously shocked that there are people out there that would be willing to assist law enforcement? It's not like they are advertising this service for anyone to drop by with any arbitrary phone to unlock. They are no worse than locksmiths advertising the ability to crack safes.

> Are you seriously shocked that there are people out there that would be willing to assist law enforcement? ... They are no worse than locksmiths advertising the ability to crack safes.

It's more like a locksmith advertising the ability to break anyone's safe that contains details on every place you've ever been, purchase you've ever made, and person you've ever communicated with. Phones are far more ubiquitous and contain far more information than any family safe. Not a fair comparison.

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#15

Post by puzzledobserver »

Wouldn't such an ability, by virtue of having been tested at least once, run afoul of the DMCA? Of course, it is an Israeli company and not an American one, and we have no proof that they have the ability or have ever exercised it, and IANAL, but I am curious.

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#16

Post by mullingitover »

Interesting that this company is able to do this without threat of being sued into a smoking crater by Apple. They'd have to use Apple's software to build their product, and to do that they'd be bound by the license agreement. Apple could forbid the research in the license.

Oracle created the DeWitt Clause that forbids researchers from publishinging benchmarks for their products, and this apparently stands up in court. I have to imagine Apple could forbid researching and building exploit tools just as easily.

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#17

Post by _kbh_ »

eridius wrote: post #9
_kbh_ wrote: post #8

It is much more likely imo, that they have zero day exploits for something that does not require the phone to be unlocked, eg wireless, 3g/4g, bluetooth, or via the lightning connector. If they are not doing that one of the only other options i can see is if they can clone the phone and perform a offline brute force against the pin code but my understanding is that the secure enclave is meant to prevent attacks like…

How would an exploit in wireless, 3g/4g, etc lead to a full compromise of the device? These components don’t have full access to the device to begin with, and definitely don’t have access to the disk encryption keys. And yeah, you can’t clone an iPhone and get anything usable. The pin is entangled with a secret that never leaves the Secure Enclave, so an offline attack would be an attack on the full encryption key, n…

The radio interfaces do not have total access to the device but they have enough that it is feasible to compromise a device via a compromise of a radio component.

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#18

Post by earenndil »

Most users have 4-digit or 6-digit numeric passwords, which can be trivially brute-forced. The only reason they can't generally is that SEP rate-limits decryption attempts. They probably have a way around the rate-limit. Meaning: if you use an alphanumeric password, you're fine.

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#19

Post by earenndil »

This is almost certainly a way to brute-force passwords without the rate limit which is enforced by default. The only reason passwords can be brute-forced is that they're numeric and have few digits. If you use an alphanumeric passcode with at least 8-10 digits, you're fine.

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#20

Post by jMyles »

_kbh_ wrote: post #17
eridius wrote: post #9

Earlier quoted context omitted.

How would an exploit in wireless, 3g/4g, etc lead to a full compromise of the device? These components don’t have full access to the device to begin with, and definitely don’t have access to the disk encryption keys. And yeah, you can’t clone an iPhone and get anything usable. The pin is entangled with a secret that never leaves the Secure Enclave, so an offline attack would be an attack on the full encryption key, n…

The radio interfaces do not have total access to the device but they have enough that it is feasible to compromise a device via a compromise of a radio component.

Can you be more specific about the nature of the exploit you are imagining?

For example, how can a radio interface have "enough" access to facilitate decryption of an encrypted volume?

Post reply on HN