11–20 of 35 posts
Earlier quoted context omitted.
Image device -> run image in emulator -> try 5 passcodes -> get blocked -> reload image -> try 5 passcodes -> get blocked -> ... -> try 5 passcodes -> unlock phone.
How do you Image an iphone device?
Earlier quoted context omitted.
I think that bruteforcing the passcode is an unlikely attack vector, if they do "brute force it" it likely wont be with apples OS running, it would be some kind of custom attack.
Image device -> run image in emulator -> try 5 passcodes -> get blocked -> reload image -> try 5 passcodes -> get blocked -> ... -> try 5 passcodes -> unlock phone.
Earlier quoted context omitted.
How do you Image an iphone device?
I assume you can desolder the flash chip and directly dump its contents. Not trivial, but not too difficult for someone with the right skills.
It's a pity that we (likely including the journalist) don't know more about how the cops got access to the iPhone beyond cloud backups: the one thing I'm taking away from this article is that passcodes can still be brute forced.
Does anyone know how much of a black box these cellebrite (or competitor) systems are? Like if we could get some into the hands of the best reverse engineers in software and hardware, how difficult might it be to figure out the methods by which they gain access (aside from standard brute force and the like)? Are these unreleased zero day software exploits? Or something that anyone with enough knowledge of of the hard…
A french youtuber got their hands on one and they say the device itself isn't protected at all ! https://www.youtube.com/watch?v=lVx5auDj7Hs
https://signal.org/blog/cellebrite-vulnerabilities/
https://cyberlaw.stanford.edu/blog/2021/05/i-have-lot-say-ab...
Is there any info yet on what kind of a phone the attacker had? I still cannot find any article about this incident explicitly mentioning not even a specific model, but just whether it was Android or iOS at all. While most of them keep referencing that old San Bernardino story where the attackers had an iPhone with an outdated security model even for the time of the incident (it was iPhone 5c iirc).
The FBI made a note that they accessed the phone, shared widely etc, https://www.fbi.gov/news/press-releases/update-on-the-fbi-in... , there isn't any other information regarding the case.
Earlier quoted context omitted.
I assume you can desolder the flash chip and directly dump its contents. Not trivial, but not too difficult for someone with the right skills.
That won't give you the encryption keys, which are stored in the Secure Enclave.
Earlier quoted context omitted.
Image device -> run image in emulator -> try 5 passcodes -> get blocked -> reload image -> try 5 passcodes -> get blocked -> ... -> try 5 passcodes -> unlock phone.
That's the point of the Secure Enclave, where the password keys are stored. It's designed to be impossible to image. Early attacks relied on pulling the power to the chip after it sent a failure message but before it updated the attempt counter, this is fixed on newer revisions to happen the other way around.
Earlier quoted context omitted.
That won't give you the encryption keys, which are stored in the Secure Enclave.
Isn’t the Secure Enclave another separate flash chip?
They are designed precisely to prevent this kind of attack.
I bet most of the exploits used by these boxes have nothing to do with the secure element but just bypass security using exploits in standard system or USB code. Most phones will be captured with the OS running but just the UI locked, with all encrypted volumes already mounted.