Slashdot Mirror
DOJ Says iPhone Is So Secure They Can't Crack It
zacharye writes "In the five years since Apple launched the iPhone, the popular device has gone from a malicious hacker's dream to law enforcement's worst nightmare. As recounted by the Massachusetts Institute of Technology's Technology Review blog, a Justice Department official recently took the stage at the DFRWS computer forensics conference in Washington, D.C. and told attendees that the beefed up security in iOS is now so good that it has become a nightmare for law enforcement."
I've never been too impressed with government agencies and their knowledge of computing.
Gee. The government can't spy on you using your own hardware?
This is truly frightening.
XKCD:Xeric Knowledge Comically Dispen
I believe, as of iPhone 3GS, it does.. but I'm too lazy to google and confirm.
(also article is a little too breathlessly enamored of apple: PR astroturf?)
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
It's a start.
...I've got some "moon" rocks I'd like to sell you.
Honestly, this seems like a way to trick dumb criminals into thinking their information is secure just because they use an iPhone. If this were truly the case, and the DOJ does really have problems in dealing with iOS devices, I'd expect them to remain tight lipped about it.
How long until they just resort to this?
Well, yes, that's what they'd like you to believe, isn't it?
That video is over 2 years old. Re-read TFS.
It seems you are right. I'm impressed.
As an iPhone user since the first model, I've never been penetrated through my back door... willingly or otherwise.
iCloud Supoena.
So, the "remote control" is uncrackable? iCloud and Siri and "location awareness" with GSM, WiFi and GPS make the security of the actual device nearly an orthoganal proposition to any enforceable protection for the user or data.
When this is so clearly a form of misdirection, I can't help but wonder the purpose of a DOJ statement like his being made public. Which perception and behaviour are they trying to influence, and by whom?
"Flyin' in just a sweet place,
Never been known to fail..."
The iPhone sports a master encryption key and DOJ has access to it.
Wrong.
It uses full disk encryption. However, that can be circumvented quite easily with a jailbreak (if one exists).
However, there is a second encryption system. This system derives the keys from your passcode and a key that is stored within a secure element on the iPhone. Thus, you need to know the Passcode of the iPhone in order to decrypt those files. Since, the key derivation function is tied to the passcode and the key within the secure element you cannot offload the brute-force attack to external machines, you need to do it on the iPhone. This means that a brute-force attack on a 4-digit PIN takes about 20 minutes (ok, that's not much), but when you consider complex PINs with 5 or more characters you are soon at 50 days (don't have the exact numbers in my mind right now, but there is a good presentation on that).
Downturn: You must rely on the app developer to chose the right protection class for the files. If he doesn't then you are down to the rather insecure full-disk-encryption, and you need to chose a longer Passcode...
> "As far as I know the iphone doesn't use full disk encryption."
And because you don't know if it does that means it doesn't, right?
http://support.apple.com/kb/HT4175
Full device encryption has been available since the 3GS, when they added in hardware encryption support to their iOS products.
Before speaking on a subject you know absolutely nothing about you should do a little research on it first.
Just ask Apple the password they'll give it to you : http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/
Yeah, totally. I hacked a Gibson with side channel "emmisions" once. I used a Pac-man virus.
by Mike Buddha -- Someday the mountain might get him, but the law never will.
5 minutes ago I knew nothing of Apples full disk encryption. Now I find an article that states:
http://anthonyvance.com/blog/forensics/ios4_data_protection/
So I'd say I'm just VERY skeptical that the DOJ can't crack something that wasn't really designed with any security in mind in the first place. Either that, or the DOJ has nobody with any skills whatsoever.
AccountKiller
TFA and TFS should be modded +5 Funny.
One suspects that there are back doors all over the iPhone, in addition to the various apps that have access to remarkable amounts of stored material and regularly send it home (or elsewhere). Otherwise its alleged impenetrability would hardly be promoted by law enforcement. It's like Brer Rabbit pleading "please don't throw me in the briar patch".
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
I look forward to Ovie Carroll's next few breathless announcements:
"Hooh, boy, that YouTube is soooo secure, a person could sign up for an account using their real name and home address, then post videos of them committing crimes online and law enforcement would never ever be able to track them! Honest!"
"You know where the safest place to hide stuff is? Underneath the welcome mat at 950 Pennsylvania Avenue, NW in Washington, DC. Really! We did a study and figured out that once that mat is pushed down on top of something, whether it's drugs, cash or big file folders full of industrial secrets, there's NO way that any one can get into it."
"My biggest nightmare is someone committing a crime, then emailing a detailed confession to ovie.carroll@usdoj.gov. Once something gets into those email tubes it's IMPOSSIBLE to get it back out and figure out what happened. Really. You can trust me. I'm with the government."
According to TFA, encryption and decryption is now available and built in in the hardware even. So it's become computationally cheap. The AES key is also burned in silicon, making it impossible to get to.
But as usual the weakest link is the user's password, in this case a PIN. A typical 4-digit PIN can be cracked (using special software to prevent phone from wiping itself after ten failed attempts) in a matter of minutes; one needs an 8-digit PIN to be reasonably secure (average 15 years for a brute-force attack).
This is only if you have a passcode on the device. Not to mention that you need to encrypt your backups, or they can just pull your iPhone's data right off your iTunes backup.
As I have commented above, this is only the case when you have a passcode enabled. And your files are not encrypted in backups, either. Plus when your phone is unlocked, any exploit that allows you to leave the sandbox would let you access any encrypted files. This means that if that one company still has the software that breaks the iPhone's passcode by using a USB bruteforce (bypassing the lock screen's security), you're out of luck!
DOJ Says iPhone Is So Secure They Can't Crack It
I dropped mine off the balcony to the pavement below. It seems that it is very easy to crack an iPhone.
Unlike Android (when enabled), it doesn't prompt for the key before booting the OS, so it's only partly encrypted. Yes the OS is mounted read only on iOS (as on Android by default) jailbreaking changes this, as does rooting, but you can't if it's fully encrypted
Now that's funny. I can shatter mine.
“He’s not deformed, he’s just drunk!”
Or, they're cops and they don't want to have to go through the bother of getting a warrant when the phone is 'obviously in plain sight and thus immune to the regular rules of search and siezure'.
Understanding the scope of the problem is the first step on the path to true panic.
You're impressed, that he's too lazy?
If you don't have a passcode enabled on the device then there's not much point in encrypting it, is there?
Can somebody explain how if the iPhone is so uncrackable/breakable that Apple can still export it? I seem to recall some kind of PGP problem where exporting something that was too secure was a violation of US laws. Or maybe I'm mixing reality with a bad Nicholas Cage movie, which is entirely possible.
https://www.accountkiller.com/removal-requested
And you haven't exactly disputed the article either. Just because it's 2 years old doesn't mean it's not accurate.
I have several IOS devices, and the only "password" you can put into it is the simple 4 character unlock code. You should certainly know that all encryption is based on keeping something secret that's very difficult to guess. If the only secret you're keeping is a 4 digit key, you're completely hosed to brute force attacks.
AccountKiller
would that still be a misdirection?
Oh, I see, anything which is said in favor of iPhone security is "reverse psychology", anything critical of iPhone security is "speaking truth to power".
You guys crack me up.
That's because the password-protected encryption doesn't encrypt the whole disk. It encrypts individual files. There is a full-disk encryption key, but its purpose is to make wiping the device a single block write operation (overwrite the key) instead of a complete wipe of tens of gigabytes.
Check out my sci-fi/humor trilogy at PatriotsBooks.
I thought all you had to do was use a little social engineering and you can do what you want with the data. /ducks
Worked for Tasha Yar, anyhow.
So we know it's true.
Last time I checked, the government can't lie. It can only deny.
Sorry, incorrect. Go watch "Don't talk to police" on YouTube. Required viewing for US residency.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Objection!
Amen!
In the US, this is another example of political correctness gone overboard.
What the old saying about people not learning from mistakes in the past are bound to repeat them in the future?
Then again...look at Germany, banning most anything Nazi connected....I believe similar type bans happen in other EU countries too?
But seriously....this is a part of US history, and should not be suppressed. I remember seeing old Bugs Bunny cartoons...people got blown up into 'blackface'....if they even show these episodes on tv, these parts are usually edited...
Why? This is part of history, and people should know what attitudes were publicly held and presented to see how much we've changed over the years.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
LOL Thanks, that was great!
I'm pretty sure the government can only lie. Maybe you are thinking of some government other than the U.S. government?
I'm always logged in as root. I like to live dangerously.
The settlers discovered immortality? Hmm, so that's why everyone goes to Australia.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
You know...myself and anyone my age..grew up with those cartoons...and somehow...we're not all damaged....why would todays kids be any different...are they more stupid now and need to be protected somehow?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Don't talk to police.
sysadmins and parents of newborns get the same amount of sleep.
Okay, can't watch the youtube video(blocked due to limited bandwidth here), but it let me onto the infowars site.
750M rounds is 2.5 rounds per person in the USA, yes. However: Scare tactics are being used.
First, it's for training ammunition - my training/qualification for the year is at well over 500 rounds between pistol and rifle(~half each). I'm not DHS, but it should be a clue as to how many rounds it takes to train&qualify somebody. It's often an annual requirement.
Second - it's a 'purchase UP TO' order, up to 70M rounds/year, between all winning parties, for a 5 year contract. NOT 'planning to buy 750M rounds of ammo'. Going by the contract, that's a MAX of 350M. The minimum order in a year is 1 lot of 1k rounds. In these sorts of contracts they list the maximum possible they expect for each item - for example, a big purchase of .40S&W handguns, a shift to .357 Sig, whatever. .223 is well represented, though I wonder that they aren't shooting NATO 5.56 spec rifles(the difference is about a human hair; doesn't matter much in training I guess). Going by my figure, a max order of 70M rounds would let you dual-qualify ~140k people. Office types trained 'just in case' would use a bit less ammo, SWAT types far more. A quick search shows 160k employees in DHS. Or maybe it's 188k employees AND 200k contractors. Whatever. I doubt they're going to be qualifying EVERYONE anytime soon, and probably don't plan to short of some crazy doomsday scenarios.
Third - "including 357 mag rounds that are able to penetrate walls." - just about ANY handgun self defense caliber is fully capable of penetrating a wall while remaining potentially lethal. It's a simple fact that a human body, which self defense rounds generally have to be able to completely penetrate to be considered effective, is more difficult to penetrate than 2 sheets of drywall. You want to go back to yea old days - when the .357 was developed, the standard was actually penetrating a car windscreen with a maximum deflection such that you'd still hit the driver. 9mm, btw, is 'normally' powerful enough for this, though you might need 2 shots(not as big of a deal for a semi), but this was back when we were still issuing revolvers to police. While we're at it, the contract also lists rifle calibers - .223, .30-06, and .308; all far more powerful than .357.
In other words, it's a big hoopla over just about nothing.
I don't read AC A human right
This means that a brute-force attack on a 4-digit PIN takes about 20 minutes (ok, that's not much), but when you consider complex PINs with 5 or more characters you are soon at 50 days (don't have the exact numbers in my mind right now, but there is a good presentation on that).
Er, no. It means you make a copy of the flash storage, and brute-force it on a "real" computer in a matter of milliseconds.
Comment removed based on user account deletion