71–80 of 90 posts
I'm sure a technical deep dive on these vulnerabilities would be an exciting read.
That is terrifying given how the phone is the single key to many people's digital identity and their finances. And that's what scared me into changing my relationship with my phone. I try to treat it as an ephemeral, disposable data terminal in which I have minimal trust. Every few weeks I back it up to the LAN and purge it. If I lose it I revoke its login certificates so that it can't access the mail and chat server…
It is much more likely imo, that they have zero day exploits for something that does not require the phone to be unlocked, eg wireless, 3g/4g, bluetooth, or via the lightning connector. If they are not doing that one of the only other options i can see is if they can clone the phone and perform a offline brute force against the pin code but my understanding is that the secure enclave is meant to prevent attacks like…
How would an exploit in wireless, 3g/4g, etc lead to a full compromise of the device? These components don’t have full access to the device to begin with, and definitely don’t have access to the disk encryption keys. And yeah, you can’t clone an iPhone and get anything usable. The pin is entangled with a secret that never leaves the Secure Enclave, so an offline attack would be an attack on the full encryption key, n…
Earlier quoted context omitted.
No it's not. I'd argue that nobody should help the police as they exist in many modern implementations, because the police as they exist now are often bad actors. But it's not hard to imagine a police force that's held to a higher standard such that they actually are trustworthy. The argument doesn't have to be "police shouldn't exist"--it could be "police should be better".
But since we lack an individually actionable way of making the police better, doesn't the argument reduce to "we should not help the police as they are now"?
My previous post was responding to your claim "But an argument that no-one should help the police is basically an argument the police shouldn't exist", which is incorrect. The two are very different arguments.
Earlier quoted context omitted.
Apple can't patch it. It's a fundamental limitation that, somewhere on the device, is stored a key; if you can extract that key, then you can run brute-force on it as much as you want from a supercomputer. And it has to be extractable because the phone itself has to use it.
The Secure Enclave prevents this
Earlier quoted context omitted.
How would an exploit in wireless, 3g/4g, etc lead to a full compromise of the device? These components don’t have full access to the device to begin with, and definitely don’t have access to the disk encryption keys. And yeah, you can’t clone an iPhone and get anything usable. The pin is entangled with a secret that never leaves the Secure Enclave, so an offline attack would be an attack on the full encryption key, n…
Google Project Zero was able to remotely own devices via a Broadcom vulnerability: https://googleprojectzero.blogspot.com/2017/04/over-air-expl...
Most mobile phones allow the baseband to have full access to the entire device, which is why an exploit of the baseband can turn into a full device compromise, but AIUI iPhones don't do this and keep the baseband as a separate unprivileged component, specifically to defend against this attack vector. So a baseband compromise might get you access to any data going over the baseband (e.g. phone calls, unencrypted data traffic, etc) but shouldn't get you access to the rest of the device.
This is almost certainly a way to brute-force passwords without the rate limit which is enforced by default. The only reason passwords can be brute-forced is that they're numeric and have few digits. If you use an alphanumeric passcode with at least 8-10 digits, you're fine.
Is it certain that they encrypt the symmetric key with a hash derived from the alphanumeric one? It is not inconceivable that they assume the secure enclave is secure and just store the symmetric key verbatim. This seems like the only sensible option for PIN, so if you're already doing that, it is very possible they just use the same scheme for the alphanumeric passwords.
Interesting that this company is able to do this without threat of being sued into a smoking crater by Apple. They'd have to use Apple's software to build their product, and to do that they'd be bound by the license agreement. Apple could forbid the research in the license. Oracle created the DeWitt Clause that forbids researchers from publishinging benchmarks for their products, and this apparently stands up in cour…
The research is mostly in Apple's interest - someone does free work for them. If 'security and privacy' are features you are selling to consumers, 'we sue everyone who fiddles around' is much less convincing messaging than 'we try to make the most secure device we can and if it's compromised, we fix it'.
The Boston bomber had a years old iphone that they eventually got cellebrite to decrypt.
It comes across as LE access by stealth rather than transparently handing over data upon request.
Most users have 4-digit or 6-digit numeric passwords, which can be trivially brute-forced. The only reason they can't generally is that SEP rate-limits decryption attempts. They probably have a way around the rate-limit. Meaning: if you use an alphanumeric password, you're fine.