Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The bumpy road towards iPhone 5c NAND mirroring

arxiv.org

Post reply on HN
Print view View original

11–20 of 69 posts

Re: The bumpy road towards iPhone 5c NAND mirroring

#11

Post by dogma1138 »

lisper wrote: post #4

Vindicated. https://news.ycombinator.com/item?id=11199093

No one with the slightest technical background thought the phone was uncrackable, maybe not directly by the FBI but by pretty much any 3rd party contractor that does even basic flash data recovery. The FBI was looking to set a precedent in order to be able to gain easy access to phones that could be also used by law enforcement, a local sheriff's department is less likely to be able to contract it out for every case and even if it would be a commodity it would be price prohibitive at scale. Overall probably even iPhones with a secure enclave are not "immune" to physical attacks, not as easy as doing simple nand-mirroring but if can decap the main CPU without destroying it you should be able to directly probe the secure enclave logic.

Also while NAND mirroring does work, there is a good chance it wasn't used in that case, the current "theory" is that one of the patched USB DMA exploits were used to unlock the phone, NAND mirroring was too "risky" for the FBI to consider at the time, and it wasn't forensically secure IIRC one of the reasons for the very high price was the non-physical attack approach that the 3rd party provider they've selected had in their toolkit.

Re: The bumpy road towards iPhone 5c NAND mirroring

#12

Post by gizmo686 »

ganoushoreilly wrote: post #6
dmitrygr wrote: post #3

Earlier quoted context omitted.

< $50 in parts (just a PIC24)

It would have cost the agencies a lot more though (contracting fees), I highly doubt they'd have the technical capabilities to handle this. But it just goes to show that they didn't really reach out and were simply using it as a means to push their backdoor agenda. :(

What worse is that they (or at least Comey) explicitly said that NAND mirroring does not work. When he was testifying before Congress, we was asked by several Congress people about NAND mirroring and (if I remember correctly) said that the technical experts had looked into it. This is either gross incompetence or outright perjury.

Re: The bumpy road towards iPhone 5c NAND mirroring

#13

Post by lisper »

Sniffnoy wrote: post #8

A note -- if you're linking to arXiv, it's better to link to the abstract ( https://arxiv.org/abs/1609.04327 ) rather than directly to the PDF. From the abstract, one can easily click through to the PDF; not so the reverse. And the abstract allows one to do things like see different versions of the paper, search for other things by the same authors, etc. Thank you!

You can also see when the paper was submitted.

Re: The bumpy road towards iPhone 5c NAND mirroring

#14

Post by CPLX »

solipsism wrote: post #9
lisper wrote: post #4

Vindicated. https://news.ycombinator.com/item?id=11199093

I'm sure all the "experts" who were so vocal about how wrong you were will speak up now and admit they were wrong. Happens all the time around here. ;)

Can I come along and note that I was in that thread supporting that guy? Because that would be valuable for my self-esteem.

Re: The bumpy road towards iPhone 5c NAND mirroring

#16

Post by dogma1138 »

gizmo686 wrote: post #12
ganoushoreilly wrote: post #6

Earlier quoted context omitted.

It would have cost the agencies a lot more though (contracting fees), I highly doubt they'd have the technical capabilities to handle this. But it just goes to show that they didn't really reach out and were simply using it as a means to push their backdoor agenda. :(

What worse is that they (or at least Comey) explicitly said that NAND mirroring does not work. When he was testifying before Congress, we was asked by several Congress people about NAND mirroring and (if I remember correctly) said that the technical experts had looked into it. This is either gross incompetence or outright perjury.

Well for the FBI NAND mirroring might not be a solution.

In the article the author mentions that this technique can effectively damage the flash memory because you can get effectively into a state where you are causing wear due to writes.

In theory you can scale this up and copy the contents of memory into an FPGA which emulates NAND (both logically and physically) or just hold multiple copies on different chips but even the initial process is not without risk.

While it's easy to say that the FBI lied or was incompetent because they had a motive to say set a precedent, but given the FBI's own rules for what is a forensically accepted method of extracting data NAND mirroring can easily be considered as something that "doesn't work".

Re: The bumpy road towards iPhone 5c NAND mirroring

#17

Post by boxfire »

Sniffnoy wrote: post #8

A note -- if you're linking to arXiv, it's better to link to the abstract ( https://arxiv.org/abs/1609.04327 ) rather than directly to the PDF. From the abstract, one can easily click through to the PDF; not so the reverse. And the abstract allows one to do things like see different versions of the paper, search for other things by the same authors, etc. Thank you!

This is a new result published yesterday, with no revisions. A direct link is extremely preferable to those of us who are interested in actually reading the paper. If you are doing homework, you can search the paper title.

Re: The bumpy road towards iPhone 5c NAND mirroring

#19

Post by [deleted] »

CPLX wrote: post #14
solipsism wrote: post #9

Earlier quoted context omitted.

I'm sure all the "experts" who were so vocal about how wrong you were will speak up now and admit they were wrong. Happens all the time around here. ;)

Can I come along and note that I was in that thread supporting that guy? Because that would be valuable for my self-esteem.

[deleted]

Re: The bumpy road towards iPhone 5c NAND mirroring

#20

Post by tptacek »

Kinnard wrote: post #18
lisper wrote: post #4

Vindicated. https://news.ycombinator.com/item?id=11199093

I'm surprised the post was not unflagged. HN team wanna ring in?

When posts say "flagged", that means they crossed some threshold of user flags. The moderators didn't flag it.
Post reply on HN