Slashdot Mirror


Have Your iPhone 6 Repaired, Only To Get It Bricked By Apple (theguardian.com)

New submitter Nemosoft Unv. writes: In case you had a problem with the fingerprint sensor or some other small defect on your iPhone 6 and had it repaired by a non-official (read: cheaper) shop, you may be in for a nasty surprise: error 53. What happens is that during an OS update or re-install the software checks the internal hardware and if it detects a non-Apple component, it will display an error 53 and brick your phone. Any photos or other data held on the handset is lost – and irretrievable. Thousands of people have flocked to forums to express their dismay at this. What's more insiduous is that the error may only appear weeks or months after the repair. Incredibly, Apple says this cannot be fixed by any hard- or software update, while it is clearly their software that causes the problem in the first place. And then you thought FTDI was being nasty ...

77 of 410 comments (clear)

  1. Solution! by Anonymous Coward · · Score: 5, Insightful

    Sell your bricked piece of shit and buy an Android phone, which does not have this problem.

    Solved.

    1. Re:Solution! by oh_my_080980980 · · Score: 5, Insightful

      RTFA ass-hole:

      “I was in the Balkans covering the refugee crisis in September when I dropped my phone. Because I desperately needed it for work I got it fixed at a local shop, as there are no Apple stores in Macedonia. They repaired the screen and home button, and it worked perfectly.”

    2. Re:Solution! by Penguinisto · · Score: 2, Insightful

      Dude in the Balkans could have his phone repaired at an Apple shop when he got home, right?

      Not trying to be a dick or anything, but honestly - using a gray-market security-related part *should* get that result. If my device is stolen, I'd want that to happen - if only to prevent some schmuck from plugging in something with hacked firmware to bypass the fingerprint sensor.

      --
      Quo usque tandem abutere, Nimbus, patientia nostra?
    3. Re:Solution! by Maritz · · Score: 5, Funny

      Go back and complain to the company that botched the repair and stop complaining about the company that made your OS more secure.

      Yeah. A phone that won't boot is pretty fucking secure.

      --
      I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.
    4. Re:Solution! by Penguinisto · · Score: 2, Informative

      False analogy: Lotus didn't exploit security vulns to run. The dodgy fingerprint sensor did.

      --
      Quo usque tandem abutere, Nimbus, patientia nostra?
    5. Re:Solution! by Anonymous Coward · · Score: 3, Insightful

      a phone that wont boot when a different fingerprint device is installed is working properly

    6. Re:Solution! by Anonymous Coward · · Score: 5, Insightful

      This should have failed gracefully. The phone should have de-functioned the fingerprint scanner to just a home button, and asked for a PIN/password, which all iPhones pre-5S have been able to do without issue. Forcing the device to an inoperative state because one component was replaced is not ethical, nor needed.

    7. Re:Solution! by Anonymous Coward · · Score: 4, Interesting

      Just to let you know... as someone IN the advertising industry targeting these devices. iOS sends consistently more data than android. Android is kindof hit or miss on data depending on where its coming from. iOS doesn't miss all that often.

    8. Re:Solution! by l.a.rossmann · · Score: 5, Informative

      I had someone email me about this nine months ago, and I suggested he go to an Apple Authorized service facility.

      He replied and said the nearest one is a six hour, $1200 flight away.

      No home button for him I guess.

    9. Re:Solution! by AmiMoJo · · Score: 2

      Even if it's a genuine Apple fingerprint sensor, the phone still bricks itself. The sensor has a code, and if it changes your phone becomes a paperweight unless Apple waves its magic wand over it.

      In other words, fail to pay Apple for the repair and your expensive phone commits suicide.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    10. Re:Solution! by Darinbob · · Score: 2

      Undoubtedly this was not done for security reasons, but to ensure their control over the phones and to make sure the "geniuses" keep their job.

    11. Re:Solution! by superdave80 · · Score: 2

      So, why couldn't it just disable the fingerprint input and require the backup passcode? Why brick the whole damn thing? Oh, right, Apple wants even MORE of your money...

    12. Re: Solution! by TheReaperD · · Score: 2, Insightful

      When I worked at Apple, I was astonished at what they charged for parts, a motherboard that I could have gotten an equivalent (but, not compatible) board brand new from ASUS for around $60-90 Apple was charging $695 for a refurbished board! Apple was charging a $600 premium for the part because they knew you couldn't get it anywhere else. Fuck you Steve Jobs!

      --
      "Be particularly skeptical when presented with evidence confirming what you already believe." -
    13. Re: Solution! by NicBenjamin · · Score: 2, Insightful

      Have you ever worked outside the desktop computer industry? Like, at all? Computer parts tend to be incredibly cheap because the Chinese are competing with the Koreans to make an extremely standard part for as little money as physically possible.

      Everywhere else this is not the case. Either you have to pay for your own manufacturing plant to get the correct part, or you have to cannibalize it from something that used that exact part. The manufacturer will always charge you the "I just spent $500 million setting up a plant in Sichuan" price even if they are cannibalizing.

      Cars, laptops, cell phones all work that way. The parts are worth much more then the entire product, particularly at the manufacturer's price. OTOH, it's almost always possible to make the same desktop Dell is selling for less then Dell is charging by using commodity desktop parts.

  2. Maybe a good thing by Anonymous Coward · · Score: 3, Insightful

    Probably to prevent hardware attacks on phone encryption

    1. Re:Maybe a good thing by Anonymous Coward · · Score: 4, Insightful

      I did some reading, and it appears to be the fingerprint sensor. The sensor itself has an encrypted channel to the mainboard. If the cable is damaged or the sensor is replaced/not working, it doesn't sync up properly.

      So it makes sense to refuse to work with a different sensor. Else, someone could unlock your phone by simply bypassing the sensor.

      OTOH, this appears to still happen if the phone itself is reset to a factory image. It doesn't seem to be that much of a security risk if instead of refusing to work, the phone, after being reset, would renegotiate encryption with the sensor. There's no data to be stolen in that scenario. And there's other mechanisms to prevent a stolen phone from having resale value.

    2. Re:Maybe a good thing by Anonymous Coward · · Score: 5, Insightful

      So just disable the fingerprint part of the button, no need to brick a device.

    3. Re:Maybe a good thing by AmiMoJo · · Score: 5, Insightful

      Makes no sense. The flash memory is encrypted and the key is stored in a secure area of the CPU. The CPU is hardened so that you can't exact the key with an electron microscope or by de-capping it. It might be possible to get that key, but only with specialist equipment and unpublished vulnerabilities.

      Replacing the fingerprint sensor won't get you anywhere. To unlock the phone after boot you need the passcode. Okay, say you keep it powered up while replacing the sensor. So what, you still need to send the phone the fingerprint data that matches the owner's finger, so it got you nothing.

      We I were being generous I'd suggest that Apple just screwed up and made the list of "panic, erase key!" events a bit too long. More likely they just want to discourage people from getting third party repairs, because they know you have money and they want it.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    4. Re:Maybe a good thing by cyn1c77 · · Score: 4, Insightful

      OTOH, this appears to still happen if the phone itself is reset to a factory image. It doesn't seem to be that much of a security risk if instead of refusing to work, the phone, after being reset, would renegotiate encryption with the sensor. There's no data to be stolen in that scenario. And there's other mechanisms to prevent a stolen phone from having resale value.

      It's still a security risk. You could imaging intercepting new iPhones, replacing the fingerprint sensor with a compromised one containing a backdoor, then reimaging the phones, putting them back in the box, and selling them to your target. After your target loads their sensitive data on to them, you could then retrieve it using the compromised sensor.

      I agree this is somewhat contrived and Apple is likely just looking to block third party repairs, but it still is a valid security risk.

    5. Re:Maybe a good thing by alvinrod · · Score: 2

      Still presents a security vulnerability in that someone who thinks their device is secure may be under false assumptions due to a sensor that is doing nefarious things. Slip someone a phone with a sensor that will function as normal, but also has the ability to store a print (or the input data to simulate one) and bypass the regular encryption methods later on command.

      It's shitty that Apple hordes the parts and requires you to go through them for repairs, but even if they didn't, I can see why third party hardware would be outright rejected.

    6. Re:Maybe a good thing by The+Rizz · · Score: 5, Insightful

      I did some reading, and it appears to be the fingerprint sensor. The sensor itself has an encrypted channel to the mainboard. If the cable is damaged or the sensor is replaced/not working, it doesn't sync up properly.

      So it makes sense to refuse to work with a different sensor. Else, someone could unlock your phone by simply bypassing the sensor.

      No. Refusing all access to your device because one small component is damaged does not make sense. Not using that component to do the unlock - and making you use the non-fingerprint method - is what would make sense.

    7. Re:Maybe a good thing by dkman · · Score: 3, Insightful

      Seems to me that of the phone doesn't like the sensor instead of bricking itself it should disable the sensor and move on, so you can type in your passcode and use the phone. I know that so 2007, but it's better than having a fancy paperweight.

      --
      I refuse to sign
    8. Re:Maybe a good thing by Anonymous Coward · · Score: 2, Insightful

      1. Steal phone.
      2. Replace the fingerprint sensor with one that stores the fingerprint data.
      3. Return phone.
      4. Wait for user to swipe.
      5. Steal phone again.

    9. Re:Maybe a good thing by david_thornley · · Score: 2, Insightful

      Good security sometimes makes no sense to the casual observer. Security is hard to do right and easy to screw up. I'd want to find out why the feature is there in detail and from a security person who knows what he or she is talking about before jumping to conclusions.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    10. Re: Maybe a good thing by Anonymous Coward · · Score: 2, Informative

      Good luck decrypting it without the keys from the secure enclave, skippy.

    11. Re:Maybe a good thing by Tharkkun · · Score: 2

      OTOH, this appears to still happen if the phone itself is reset to a factory image. It doesn't seem to be that much of a security risk if instead of refusing to work, the phone, after being reset, would renegotiate encryption with the sensor. There's no data to be stolen in that scenario. And there's other mechanisms to prevent a stolen phone from having resale value.

      It's still a security risk. You could imaging intercepting new iPhones, replacing the fingerprint sensor with a compromised one containing a backdoor, then reimaging the phones, putting them back in the box, and selling them to your target. After your target loads their sensitive data on to them, you could then retrieve it using the compromised sensor.

      I agree this is somewhat contrived and Apple is likely just looking to block third party repairs, but it still is a valid security risk.

      So the solution is to permanently brick the phone? Gimme a break. You generate a warning on the phone to let the user know. Better yet, brick the phone and charge to repair it correctly. You don't screw your customers out of a perfectly good phone.

    12. Re:Maybe a good thing by Tharkkun · · Score: 3, Interesting

      The sensor does not do the decryption or authentication. The attack vector would be a sensor that has been replaced with a mechanism that replays a snapshot of the phone owner's fingerprint and sends that down the wire to the mainboard. Apple is attempting to curtail that type of attack by authenticating the physical sensor to the mainboard.

      So disable the sensor if it's found to be invalid. You don't destroy a $500 phone. What if the sensor goes bad? New phone? Seriously people.

    13. Re:Maybe a good thing by Man+On+Pink+Corner · · Score: 2

      Making thousands of legitimate customers suffer because of the mere possibility of an attack that obscure isn't "security," or even "security theatre." It's just plain malice.

    14. Re:Maybe a good thing by MrKrillls · · Score: 2

      "...Apple is attempting to curtail that type of attack by authenticating the physical sensor to the mainboard..."

      No, Apple is trying to squash independent repair shops. Security is just the excuse.

      They can drive business to their own repair shops with the bricking threat. There could have been other far better responses to a potential security issue. This kind of heavy handed behavior is one reason my next phone will not be an Apple.

      --
      Don't step on the baby.
    15. Re:Maybe a good thing by shawn2772 · · Score: 3, Interesting

      1. Steal phone.
      2. Lift owner's print from the phone.
      3. Replace sensor with device that sends data of your choice.
      3. Feed fingerprint image to unlock device.

      The owner's fingerprints are generally all over a phone.

    16. Re:Maybe a good thing by KGIII · · Score: 2

      I've done a bit of reading and, by lack of anything major in my life, I've recently taken a look at some more modern security practices and, while this seems rough, this seems almost legit.

      If I'd my druthers and control, I'd have *disabled* the device, entirely, until a functional, vetted, hardware component was repaired - I may even make sure that hardware replacement is *also* signed and needs to authenticate with the device before it burns out a fuse in the hardware to actually enable the device to function.

      I'm *still* probably missing something. I'd have not bricked the device. I'd have shown a hardware error warning and (possibly) allowed limited function like making phone calls and texts with a temp user account until authorized repairs could be made.

      I'll also stress that I'm not an expert. That's actually why I started this post. It was to point out, this is Slashdot! We're *all* experts here, on everything. Hell, I've had people tell me that I'm wrong when it comes to traffic engineering or modeling. No, I wasn't wrong, but they were a self-avowed expert. We regularly sit here and say how wrong the experts are - it's what we do! ;-)

      At any rate, unless I'm missing something, I'd have simply had it detect non-authorized hardware (a variety of ways to do that) and give limited functionality and no retrieval, use, or access to any local storage until an authorized repair had been performed. When the new device, the authorized device, has been inserted and the hardware checks out, it can burn itself so that it locks to a single phone. There are smart people, make it happen!

      They could still use the phone to make calls and send texts. Hell, let 'em have a "guest" account on it and use appropriate file permissions or even a physically separate bit of storage. Then, when they can get a real repair done and the hardware's authenticated (they must have some system in place for this or this wouldn't be happening) they can get full functionality back. The repaired part can even lock itself to the phone.

      --
      "So long and thanks for all the fish."
  3. Getting away with it? by Z00L00K · · Score: 5, Insightful

    If Apple gets away with this we may see more vendors doing the same thing to the stuff we own.

    --
    If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
    1. Re:Getting away with it? by gstoddart · · Score: 5, Insightful

      You don't own it, and you know you don't own it. You merely paid money for the right to use the hardware under the terms of their license.

      Your ownership of these things ended some years ago as far as they're concerned.

      This is no different from Microsoft deciding it's their computer, and they'll do whatever the fuck they want with it.

      Consumers have more or less had the concept of ownership yanked out from underneath them, and had it replaced with a licensing agreement which the company can change at will.

      --
      Lost at C:>. Found at C.
    2. Re:Getting away with it? by mrchaotica · · Score: 3, Informative

      We have a law like that in the US too (and for all products -- which should include iPhones -- not just cars): the Magnuson-Moss Warranty Act.

      --

      "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

    3. Re:Getting away with it? by Jason+Levine · · Score: 4, Insightful

      Can't find the right moderation. Where's "+1 Shaking My Head Sadly At The State Of The Tech World"?

      --
      My sci-fi novel, Ghost Thief, is now available from Amazon.com.
    4. Re:Getting away with it? by Penguinisto · · Score: 3, Informative

      It's not a question of ownership. It's a question of warranty. He still owns his (now-bricked) phone.

      In this case, the dude dropped his phone, gets it repaired at some no-name shop with dodgy parts, then complains when the security loophole the dodgy parts used got closed. If anything, the fault lies with the shop that did the repair.

      Hell, Apple told him they'd do out-of-warranty replacement for it (not sure what that costs, but likely still less than full price), and that's because the problems began when he dropped it (which is not covered under warranty anyway, though some 3rd-party sellers do offer such warranty protection for a nominal fee).

      Fair warning: If I bought anything from any other OEM and went through the same rigamarole, I'm certain that I'd get the same (or worse) treatment from the OEM... so this isn't just an Apple thing.

      (...and this boys and girls, is why I buy just-behind-bleeding-edge Android stuff, so a total loss of the phone is only like $200, not $600 or more).

      --
      Quo usque tandem abutere, Nimbus, patientia nostra?
    5. Re:Getting away with it? by pak9rabid · · Score: 4, Informative
      Here's the relevant part of the Magnuson-Moss Warranty Act:

      Warrantors cannot require that only branded parts be used with the product in order to retain the warranty.[7] This is commonly referred to as the "tie-in sales" provisions,[8] and is frequently mentioned in the context of third-party computer parts, such as memory and hard drives.

    6. Re:Getting away with it? by ericloewe · · Score: 2

      Sure, but bricking the phone instead of just disabling the sensor is quite evil.

    7. Re:Getting away with it? by jmac_the_man · · Score: 2

      Are you sure this happened? At least from the 360 era on, MS bans modded consoles from Xbox Live, but otherwise leaves them alone. And given that XBMC was a thing you could run on original Xbox at the time, I don't think MS bricked consoles then either.

  4. Damned if you do, damned if you don't by Anonymous Coward · · Score: 4, Insightful

    It sounds like Apple fixed a security bug in an SU, closing a hole which allowed attackers to replace the touch ID sensor to gain access to user data. Had Apple not made this move, we'd instead be seeing an article about how Apple products are insecure and the NSA could get access to your secure date just by replacing some hardware components. Then everyone would be up in arms, demanding this exact software change, and complaining about how Apple is reactionary and not proactive in fixing security issues.

    Of course, "Apple fixes vulnerabilities in iOS 9" is not really a catchy flambait title for an article.

    1. Re:Damned if you do, damned if you don't by ledow · · Score: 2

      Why should the touch ID sensor need to, or be actually doing, store any data or provide authentication?

      What you're saying is that you can replace the fingerprint sensor and thus fool the device into thinking you provided ANY fingerprint, without any knowledge of that fingerprint? Sound inherently INSECURE to me. I could steal Barack Obama's iPad, change the sensor, and order a coffee on his credit card without having to enter a single credential or knowing what his fingerprint looks like.

      Compare and contrast to "it's just a fingerprint reader that provides a hash of the offered finger, which the OS compares to a list of known hashes of valid users", for instance. Unless you know what the fingerprint looks like, or can read the original hash and generate hashes of any possible combination you want, you shouldn't be able to do that. And if you did it properly, only Apple would know what the hash was on a remote server, and the entire conversation between reader and end-server would be encrypted and nonced to prevent replay attacks.

    2. Re:Damned if you do, damned if you don't by Anonymous Coward · · Score: 5, Insightful

      Or instead of Error 53 they could just disable Touch ID and require you to enter you PIN code.

      Which would make sense since you need the PIN to enable Touch ID in the first place, as it's automatically turned off when the phone first starts and if the phone isn't unlocked for over 48 hours.

      No, this is solely to brick the phone if you dare not pay for overpriced Apple repairs.

    3. Re:Damned if you do, damned if you don't by Austerity+Empowers · · Score: 4, Insightful

      You could replace the fingerprint sensor with something that could provide arbitrary fingerprints, possibly based on a collection you have made of them. Then use your collection to buy stuff. Requires no memory in the sensor at all. This is much faster than creating molds of fingerprints and applying them to the sensor. I can see Apple not wanting to tolerate replacing things tied in to your CC #.

      Replacing a battery seems less defensible to me, if that aspect is true. It's hard to argue this is tied in to any trust chain.

    4. Re:Damned if you do, damned if you don't by adamstew · · Score: 5, Informative

      It's not the fingerprint sensor itself that decides. The fingerprint sensor sends an image of the fingerprint to the Secure Enclave, which is a chip on the device that handles all of the encryption. The secure enclave itself does the analysis and makes the decision. This line of communication between the fingerprint sensor and the secure enclave is encrypted with a key exchange between the sensor and the secure enclave. This pairs your specific secure enclave with the Touch ID sensor. There is anti-replay techniques involved here as well.

      The point of pairing the sensor to the secure enclave is so that someone can't open up the phone, install a sniffer on the bus between the secure enclave and the sensor to then collect the fingerprint data for later collection and replay it to the secure enclave to get it to unlock. It also prevents someone from just replacing the touch ID sensor to provide a known good fingerprint to the secure enclave via a hardware hack. You have to, in theory, have an authorized finger pressed up against a trusted sensor.

    5. Re:Damned if you do, damned if you don't by Anonymous Coward · · Score: 4, Informative

      Apple already treats the PIN as more secure than Touch ID. If you find an iPhone with the fingerprint reader, try opening it with your finger. After a while the phone will lock into "Touch ID disabled" state and require the PIN. At this point the only way to reenable Touch ID is with the PIN.

    6. Re:Damned if you do, damned if you don't by sims+2 · · Score: 2

      Well If I broke my keyboard I wouldn't be able to login to my computer either... But I've got more than a half dozen spare keyboards on hand so that's not an issue. Not being able to use a another keyboard because the original had a security key set by MomCorp would be awful.

      Someone could place a sniffer in the device. Seriously? Now tell me if its so secure why is it that apple itself can replace the part when no one else can.

      --
      Minimum threshold fixed. Thanks!
    7. Re:Damned if you do, damned if you don't by tlambert · · Score: 4, Informative

      Why should the touch ID sensor need to, or be actually doing, store any data or provide authentication?

      Because the encryption key for the device is stored in an NVRAM knapsack in the touch sensor. The CPU uses a public key to establish an encrypted connection via the bus which connects it to the touch sensor, and then sends a block down to decrypt the contents of the knapsack, and then uses that to decrypt the user data key that's stored in the NVRAM attached to the CPU, and then uses that to decrypt the user data.

      By forcing a pairing of the touch sensor with the CPU, it means you can not do a two stage attack by topping just one chip, you'd have to top both chips, and if you did that, your half-of-a-key-pair that you obtained wouldn't work with another device.

      The way Apple handles this in the repair cases is it just replaces your device guts with completely new device guts (so that your cheesy engraving is not taken away -- and neither are your scratches in non-critical areas), and pops a new sensor chip (with an uninitialized PROM) into the device, and sends those guts to someone else as a refurbish.

      But that does mean that third party repair for either of the two components is theoretically possible, but practically speaking, Apple will not sell you the chip you need to replace to do the same repair that an authorized service center would do. On the other hand... it means that Apple won't get the blame if you put in some third party battery or charging circuitry, and burn down your damn house because you wanted to save $5 or whatever.

    8. Re:Damned if you do, damned if you don't by ericloewe · · Score: 2

      Or just do whatever they are doing now, but don't accept fingerprint input from compromised readers - instead of bricking the whole phone.

  5. Context On the Issue by Galaga88 · · Score: 5, Informative

    This error occurs if the repair involves the TouchID sensor. Sense this stores data required for the fingerprint authentication, the device will refuse to function for security reasons if it thinks it's been tampered with, which seems to be a reasonable precaution for a device component that can authenticate you across the device and also external services including financial transactions.

    A better option would be to instead disable TouchID if tampering is suspected, but this isn't a case of Apple just arbitrarily making iPhones not work if you get a third-party repair like the story suggests.

    1. Re:Context On the Issue by pushing-robot · · Score: 5, Informative

      Apple's response, by way of MacRumors:

      An Apple spokeswoman commented on the issue, referring to protective security features intended to prevent "malicious" third-party components from potentially compromising a user's iPhone as the main reason for the "error 53" message.

      We protect fingerprint data using a secure enclave, which is uniquely paired to the touch ID sensor. When iPhone is serviced by an authorised Apple service provider or Apple retail store for changes that affect the touch ID sensor, the pairing is re-validated. This check ensures the device and the iOS features related to touch ID remain secure. Without this unique pairing, a malicious touch ID sensor could be substituted, thereby gaining access to the secure enclave. When iOS detects that the pairing fails, touch ID, including Apple Pay, is disabled so the device remains secure.”

      She adds: “When an iPhone is serviced by an unauthorized repair provider, faulty screens or other invalid components that affect the touch ID sensor could cause the check to fail if the pairing cannot be validated. With a subsequent update or restore, additional security checks result in an ‘error 53’ being displayed If a customer encounters an unrecoverable error 53, we recommend contacting Apple support.

      --
      How can I believe you when you tell me what I don't want to hear?
    2. Re:Context On the Issue by OverlordQ · · Score: 2

      > Sense this stores data required for the fingerprint authentication, the device will refuse to function for security reasons if it thinks it's been tampered with

      Bullshit. Why would it only 'break' after an iOS update instead of the next time you used it?

      --
      Your hair look like poop, Bob! - Wanker.
    3. Re:Context On the Issue by retchdog · · Score: 2

      the detection is part of iOS 9. it detects the change once you install iOS 9. this could happen days or "weeks or months" or years after the repair, but that's a kind of silly and misleading way to describe it.

      --
      "They were pure niggers." – Noam Chomsky
    4. Re:Context On the Issue by adamstew · · Score: 4, Interesting

      Because there was a flaw in the security before the update that allowed you to swap out the Touch ID sensor. The update patched a flaw and then the phone noticed a problem with the trust of the hardware.

    5. Re:Context On the Issue by Kohath · · Score: 2, Insightful

      Fiendish villainy! How should we punish these monsters!!!? Won't someone think of the children!!!??

      Also, I have this 14-step procedure that they should have thought of in advance to avoid this problem....of enabling 3rd party "repairs". Because why wouldn't a company want to spend a huge amount of time to enable their competitors? Because they're monsters. That's the only explanation.

      And they're even more villainous for "lying" to everyone. They said only good things about their products. Why didn't they pay for TV advertisements to tell us all the potential bad things that could happen? Because they hate you and your mom and want her phone to fail when rapists are breaking into her house. No way could there be anything else going on.

      The class action lawsuit starts now! No one should ever be allowed to make a secure product like this. Or to say good things about it without imagining and communicating all the possible bad things. Or to ever have one of their products fail in any way, regardless of who opens it up and tinkers with the parts inside.

      The internet has spoken.

    6. Re:Context On the Issue by Maritz · · Score: 3, Insightful

      When iOS detects that the pairing fails, touch ID, including Apple Pay, is disabled so the device remains secure.

      Which is achieved by making the phone completely inoperable? Sounds like overkill, especially if the touch ID itself is configured by first entering the PIN. Sounds like it would be perfectly reasonable for it to fall back to PIN, unless of course the goal is to generate a new sale by bricking the phone.

      --
      I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.
    7. Re:Context On the Issue by tlhIngan · · Score: 2

      This error occurs if the repair involves the TouchID sensor. Sense this stores data required for the fingerprint authentication, the device will refuse to function for security reasons if it thinks it's been tampered with, which seems to be a reasonable precaution for a device component that can authenticate you across the device and also external services including financial transactions.

      A better option would be to instead disable TouchID if tampering is suspected, but this isn't a case of Apple just arbitrarily making iPhones not work if you get a third-party repair like the story suggests.

      And I'd argue Apple did the right thing by bricking the phone - because hardware was tampered with. Who knows what else was modified?

      Perhaps just the sensor was changed, but perhaps it was replaced with something designed to overload the secure enclave and exploit bugs? Once the secure enclave is compromised, the entire device is compromised including all data. By bricking, you ensure the user's data is not accidentally revealed through a hack via a trusted part.

      Basically the trusted part has gone from trusted to untrusted state. The part is no longer trustable, and the secure enclave has some of the highest access available in the system. If the enclave cannot trust the trustable fingerprint reader, it should dump all the system keys to prevent accidental exposure of user data through a bug in the enclave.

      Remember, Apple's doing a privacy thing now - it's the one advantage they have over Google.

    8. Re:Context On the Issue by l.a.rossmann · · Score: 2

      If it's security, then why doesn't the 5S error 53 when you change the button?

      Should the iPhone 5S be recalled **IMMEDIATELY** for being an insecure touchid device?

      If it's a security flaw, recall the 5S. If it's not a security flaw... cut the shit, and stop bricking phones that someone replaced the button on because sweat while they were running and decided to answer a text got into the phone.

      If Apple sees sweat damage in the phone, it's $300 to replace it. Surely the world understands why a customer would opt to spend $50 to have someone else replace the button. It's a button. Not a lightsaber... us mere mortals are actually qualified to work on this stuff.

  6. You think it's YOUR phone? by LynnwoodRooster · · Score: 2, Interesting

    In the Apple world-view - you're just borrowing their property. Never mind you paid for it, it's still theirs and they retain 100% right to do anything to it at any time, and you just have to accept it. Because, you know, It Just Works. For them...

    --
    Browsing at +1 - no ACs, I ignore their posts. So refreshing!
  7. Re:So what? by ledow · · Score: 2

    It doesn't matter.

    Consumer law trumps any EULA, signed consensually or not.

    Apple tried to only give you one year's warranty in the EU, the EU told them that's not how it works. Now everybody gets a "free" 2-year warranty. Amazing, that, given that's its compulsory under EU law on such goods.

    Just because you signed something, just because Apple says something, just because they can point at a line on a piece of paper, does NOT mean that's the end of the matter. By far.

  8. Obvious solution is obvious. by Locke2005 · · Score: 2, Interesting

    Pay the $99/year extortion/insurance that is AppleCare, and always have your phone fixed by Apple under warranty. Then if it gets bricked, it's Apple's fault and you get a new phone. The one thing I've found that Apple does best is customer service.

    --
    I've abandoned my search for truth; now I'm just looking for some useful delusions.
  9. Magnuson Moss Warranty Act? by apenzott · · Score: 4, Insightful
    I would like to see how this squares with the Magnuson Moss Warranty Act.

    The provisions for the FTC and the resultant class action provisions could get expensive.

    --
    The Roman Rule: The one who says it cannot be done shall not interrupt the one who is doing it.
  10. Laugh by koan · · Score: 2

    Never fails to amuse when people "lose all their photos".

    --
    "If any question why we died, Tell them because our fathers lied."
  11. Simple Solution - Stop Trusting Them by Agent0013 · · Score: 2

    Personally, I don't trust the updates that come out for my Samsung phone. My last phone had the GPS functionality reduced by an official upgrade. There were other things after that upgrade that were removed causing me to loose some data. I now will not install the upgrade that has been in the notification bar for the last year. I am planning on putting Cyanogenmod on there because I do trust them to do upgrades that are good for the customer. But the official ones from Sprint and Samsung, no-way. If the Apple fans stopped trusting their beloved company perhaps they would be in a better position. Of course it isn't as easy to mod the Apple and still have access to the apps, so they are more stuck because of their initial decision.

    On a side note, I trust Microsoft even less and never install their updates on my system. I have less fear from viruses and malware than I do from the update coming from Redmond. And with the amount of spying being built into their recent versions of their OS they have become a gaming system only for me. If I want to have a work computer to do things on, it will be Linux. If I want to play games on my big screen tv, I can use Windows. I guess I'm not too worried about them spying on which game I am playing. As the linux gaming environment improves perhaps that will change, but it still seems that the video cards work better and Windows.

    --

    -- ssoorrrryy,, dduupplleexx sswwiittcchh oonn.. -Quote found on actual fortune cookie.
  12. Um.... duh? by ilsaloving · · Score: 4, Insightful

    Apple has made it abundantly clear that they are selling a *secure* device. Always on encryption, etc etc.

    How would you expect such a device to behave when it is compromised with unauthorized components? A phone with 3rd party components could do pretty much *anything*, including sending everything on the device to an unknown third party, without your knowledge or consent.

    Heck, this sort of "problem" just makes me appreciate Apple's commitment to security even more.

    My only complaint is that the phone doesn't brick soon enough. It should brick itself immediately upon the next boot up.

  13. Violation of the Magnuson-Moss Warranty Act by BarbaraHudson · · Score: 4, Informative
    Here you go

    The federal minimum standards for full warranties are waived if the warrantor can show that the problem associated with a warranted consumer product was caused by damage while in the possession of the consumer, or by unreasonable use, including a failure to provide reasonable and necessary maintenance.

    There is clearly an implied warranty that updates won't be malicious, even after the warranty period. The phone wasn't damaged by the consumer - Apple chose to brick it willingly. Even if the phone was out of warranty, they don't have the right to purposefully damage it, any more than a car company can claim lack of responsibility because an oil change was done at a competitor, unless they can show that the product's failure was because of the competitor's actions.

    --
    "Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
  14. Definitely not a violation. by Brannon · · Score: 2

    This was a case of an un-authorized service which creates a security hole.

  15. Re:Yes. Yes MS does brick hardware if you are not by SecurityGuy · · Score: 3, Informative

    That's not bricking. Bricking would be MS rendering components in the computer or the entire computer unusable.

  16. Re:So what? by sexconker · · Score: 2

    RTFA ass-hole. No one serviced the fucking iPhone, it stopped working after the update. Person dropped phone, screen had hairline crack but phone still worked, phone got update, error 53. Phone still under warranty, no one touched it, but Apple will not repair or replace. Some customer service there.

    “I was in the Balkans covering the refugee crisis in September when I dropped my phone. Because I desperately needed it for work I got it fixed at a local shop, as there are no Apple stores in Macedonia. They repaired the screen and home button, and it worked perfectly.”

    Zoom in.

    RTFA ass-hole. No one serviced the fucking iPhone

    I got it fixed at a local shop

    Closer.

    No one serviced the fucking iPhone

    fixed at a local shop

    Pan left on the suspect and zoom again.

    ass-hole

    There we go!

  17. well, screw that by roc97007 · · Score: 2

    First I've heard of this. I have a very small side business replacing batteries, headphone jacks, buttons, screens in mobile devices -- I have the factory tools and know where to get the parts. I don't really make any money off it. I got into it mostly from being offended by the electronic waste these devices represent. A handheld shouldn't become useless just because a $3 part has failed, and the cost to fix through regular channels should not approach 50 - 100% of the replacement cost.

    But if Apple is going to brick the device after I've fixed it, I can't in good faith make the attempt. Instead, I'll have to recommend that the customer buy something else -- something actually repairable.

    --
    Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
  18. Re:Microsoft will generally not brick your compute by ericloewe · · Score: 2

    I must disagree.

    There are two distinct scenarios: upgrades and repairs.

    If you end up replacing every component in your PC over time, it's legitimate to say that it's a new computer. In practice, it's tied to the motherboard.

    On the other hand, if you just replace the motherboard with an identical model (or similar, they don't care about those details), you can speak to a support person and they'll activate the new board for you in a minute.

  19. Re:Microsoft will generally not brick your compute by phantomfive · · Score: 2

    You're still free, however, to either put some of the old components back so that that's no longer the case, or boot Linux on the thing instead.

    Or buy another Windows license, or call Microsoft and tell them what happened......
    There are plenty of options in the Windows case that aren't available in the iOS case.

    --
    "First they came for the slanderers and i said nothing."
  20. Re:Microsoft will generally not brick your compute by CrashNBrn · · Score: 2

    I think you would be really hard-pressed to get a refusal to activate from a MS phone-rep, so long as your license is verifiably valid (and even in some cases when it's not valid, as you got scammed online).

  21. Apple always gets away with it. by Ecuador · · Score: 5, Interesting

    Apple always gets away with it and the other vendors don't follow, because they don't have customers who will eat up anything.
    Let me give you an example just from my experience. My 3rd iPhone 4S in a row has failed in the same exact way: wifi/gps disabled. Just do a quick google about the "grayed out wifi" problem, you will find thousands of posts and also a lot of iPhone 4/4S phones on ebay with that fault. Only the first of the 3 failed within warranty in my case and all three where always in an office and used once a week for testing/debugging (that's why I kept replacing it, I test on various devices). People have actually pinpointed the problem: the overheat detection of the wifi/gps module fails and the software disables it. In fact, this disabling was a "feature" introduced with iOS 6 IIRC, so people who had stayed with iOS 5 did not get the issue. For any other company there would have been a recall, since it would have been an easy class action otherwise, and even a software patch would fix it. But apple is happy with customers getting a new phone and their average customer doesn't mind much.
    Ooh, another example, my boss, who you would call a dedicated Apple fan, had bought a mac mini 5-6 years ago. After 6 months it started killing his keyboards. He went through a few expensive/fancy keyboards before figuring out it was the mac mini and so he took it to the Apple store (Manhattan) where they diagnosed a faulty MB and told him it would take a week to have it replaced. He left it there, got a call about a delay and finally went to get it almost two weeks later. Instead of returning a fixed mac mini they told him they had voided the warranty because they found "dust" inside!!! And the only solution they offered was a 10%-off a new mac mini!!! And he took it!!! Bought the same thing, at a 10% discount!!! He didn't even flinch, I mean, I only found out because I asked, he did not find it interesting enough to mention. My jaw dropped when I heard it, I told him there is no such thing as warranty voided because of "dust", that if the device maker thinks they should not have dust they put a little filter in the computer intake (I do that in my custom builds), that a 6-month old mac mini in a no-pet no-smoke office would not have any dust anyway (and even if it did, why would it fail when decade old dusty components work fine). For all my arguments his response was "the apple genius told me my warranty is voided there is nothing I can do". He actually believed they were right. Even after I showed him the warranty which of course does not mentions dust he though they were right somehow...

    --
    Violence is the last refuge of the incompetent. Polar Scope Align for iOS
    1. Re:Apple always gets away with it. by AmiMoJo · · Score: 2

      Just look at the number of people defending Apple here, inventing fanciful excuses for them. Apple loves bricking third party hardware, I mean just look at the decade long war on cheaper cables. Every OS update bricks a few more, forcing you to buy the really expensive Apple ones. Apple laptops like to reject third party chargers...

      The message is clear. Buy our really expensive accessories and servicing, or expect your hardware to be bricked.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
  22. Not defending Apple, but... by the_B0fh · · Score: 2

    There is the possibility that Apple discovered some TLAs have been fucking with their TouchID and using it to steal fingerprints/bypass TouchID.

    Otherwise, Apple typically prefers to have good user interaction rather than bad interaction, and they have to know that if they brick enough people's devices, it's going to be extremely bad press, and reduce the chances of people immediately upgrading when new versions come out - which is a number they really like to keep as high as possible!

    To balance that bad press, against people hacking TouchIDs, and them falling on the "lets keep it secure" side, I can see that happening.

  23. If this is about security, why not on the 5S? by l.a.rossmann · · Score: 2

    The iPhone 5S uses the same concept, of touchID in the home button. However, when you change the button on the 5S, you don't brick the phone.

    Apple has some good concepts, but I've spent nearly ten years driving myself nuts trying to find ways to fix devices that they make difficult to repair for no reason. I document that on a YouTube channel I've been posting starting two years ago. https://www.youtube.com/playli...

    This is the most blatant middle finger to the independent repair community, and the customer who wants to fix their old one vs. buy a new one, that I have ever seen. It makes sense to increase the bottom line by creating devices that brick themselves when common parts are repaired outside of Apple. I get it, there are a lot of shitty iPhone screens out there... and a lot of shitty repair people. I've talked about it for years. The reality is that there would probably be less shitty parts out there if Apple didn't go above and beyond to make it impossible to repair their products. If I told you the crap I had to go through to get anything in good condition that was original to repair their products, you'd laugh... but it's true.

    Buttons break all the time.

  24. Re:This is what real choice looks like by ChumpusRex2003 · · Score: 3, Interesting

    I agree. Think of it this way, Apple are trying to push Apple pay which makes use of the system security provided by the fingerprint scanner (the private keys for apple pay are split between the fingerprint scanner chip and the crypto engine chip on the motherboard, so that compromising one chip doesn't reveal the whole key).

    At present, the OS will disable apple pay when it finds that the finger print scanner fails to negotiate key exchange correctly; this potentially ends up with a tech support call to apple, or a social media posting saying, "why does my apple pay keep screwing up?".

    Now consider what happens when there are a large number of field-repaired phones with knock-off fingerprint scanners. They appear to work fine, but some features are broken in subtle ways. The customer is confused; they may not relate it to the repair they had done; it creates an impression of an unreliable product and an expensive customer support nightmare. Clearly, apple want to stop this before it becomes endemic.

    With the OS doing a full power-on self test on the security infrastructure, such a fault would be detected at the first reboot after the damage occurred, or after a repair using an incorrect part was performed. The security failure can now be easily attributed to the damage/repair, even by users of social media and journalists. This ensures that repairers don't perform half-assed repair jobs which can lead to incomplete or faulty operation (on what is marketed as a premium product).