Apple vs. the Right To Repair (bloombergview.com)

retroworks writes: Bloomberg columnist Adam Minter takes on Apple's "Error 53 Code" and the precedents being challenged by the Right To Repair movement. Apple claims that bricking the phone if it's repaired by a non-Apple certified repair shop protects you from tampering with, say, the fingerprint scanner. But the column documents how the number of "certified" repair shops is under attack. If you can't open it, do you really own it?

Comments

It really is about security, not repair

[Anonymous Coward]

But then again, anyone could have told you that including biometric security on a smartphone was just inviting this kind of hardware signing.

Where outside of China are you going to find the components and the equipment to repair any of these electronics, anyway? Everything's microsoldered to a circuit board the size of a credit card, and the tiniest slip of your all-too-human hands and you've ruined a trace on a different circuit.

Re:It really is about security, not repair

[mrex]

If you could replace the touch ID sensor with any old thing, then they'd publish about "SECURITY FLAWS IN TOUCH ID ARCHITECTURE DISCOVERED" instead.

Re:It really is about security, not repair

[mrchaotica]

It shouldn't even matter! The CPU should be doing the authentication anyway, with the sensor simply sending the bitmap (or whatever) to it. Having the sensor be a "trusted" part of the authentication system is just as stupid as requiring a "trusted" keyboard for putting in passwords would be.*

(* Yeah, yeah, keyloggers -- but don't even try arguing that angle, because anybody who cared about that wouldn't have chosen to have their phone repaired with un-vetted parts in the first place.)

Re:It really is about security, not repair

[sjames]

OTOH, instead of locking up the whole phone, they could just have it refuse to accept the fingerprint ID and let you continue to use other authentication methods.

Re:It really is about security, not repair

[Maritz]

Plus as I understand it, PIN entry is required for setting up TouchID, which strongly suggests that falling back to PIN when TouchID has a problem would be completely reasonable. Apple obviously disagree and instead prefer to brick the phone, whether that is a commendable position in terms of security or a cynical way of selling another phone depends on what you think about Apple I suppose. Personally I'd say it's overzealous...

Re:It really is about security, not repair

[tlhIngan]

It shouldn't even matter! The CPU should be doing the authentication anyway, with the sensor simply sending the bitmap (or whatever) to it. Having the sensor be a "trusted" part of the authentication system is just as stupid as requiring a "trusted" keyboard for putting in passwords would be.*

That IS what is happening.

But the CPU and sensor are paired up because you don't want to send the sensor data unencrypted across the bus where it's then subject to spoofing attacks. It may seem silly, but it's already been proven on Android phones where a good majority of the sensors do NOT protect the sensor data they send the CPU.

The CPU gets this data and decrypts it. However, to prevent access from user-level software or even kernel level (via privilege escalation techniques - the kernel is just an untrustworthy), the CPU enters a special trusted secure mode which is completely inaccessible to the kernel and userland software. Here your image data is processed, analyzed and a final determination done when the data is compared against the secure memory storage area (secure enclave - which because it is only accessible in secure mode is completely inaccessible to normal software).

The problem happens when you replace the sensor which breaks the pairing and encryption keys. Now you have to decide what to do.

A basic software engineer will say "we'll just re-pair the sensors". Which is great, until you realize you just created a security hole - what if what you just attached wasn't a sensor, but something more sophisticated? Perhaps it's something that pretends it's a sensor, but is really an attack device.

Said attack device can try to feed specially doctored bitmaps to the secure enclave and do power monitoring and other things to try to divulge secret encryption keys used to access main storage or other things. Or perhaps feed in invalid images meant to crash the CPU in secure mode in such a way as to be able to run arbitrary code.

Since this mode is superior to kernel mode, it will be completely invisible to the main OS and can spy on everything (think Intel Management Engine, or System Management Mode (SMM) on x86 - the software runs independently of the OS).

So re-pairing the sensor is a bad idea unless you're in a controlled situation.

Instead, Apple aborts the complete OS with error 53 - the sensor pairing data is mismatched, and the system is no longer trustable. To protect user data, it would be preferable to simply erase the encryption keys so user data cannot be compromised (think of it this way - the people who can carry out the attack would likely be state actors). Because while 99.999% of the time, the sensor will just be another sensor, who's to tell it isn't a sensor designed to hack the system and spy on its user with the ultimate spyware?

This is one of those security balances that has to be worked out - do you try to protect user data against state sponsored attacks that have been proven to occur, or do you try to give the user the ability to fix it, at the risk of completely compromising your security?

Apple chose the former - if the sensor isn't trustable, then the secure enclave is no longer trustable - malware could easily be running and private user data could be sniffed and uploaded for later analysis. So instead, when Apple detects the phone's software may have been compromised, they shut down with error 53.

Once the secure enclave is compromised, all bets are off. And Apple cannot tell if the TouchID sensor was replaced because the user changed it, or if was changed because the NSA needed to spy.

Re:It really is about security, not repair

[Anonymous Coward]

But since it doesn't throw the error when the repair is done but months later when an update is applied kinda makes all of this pointless. I could swap the sensor and access all the data I want the way it works now if I was trying to do so and this "security" measure would not stop me since it doesn't kick in at the time of the swap out. The way it stands now its really only enforcing "apple only" repairs and not any form of security.

Re:It really is about security, not repair

[BronsCon]

Falling back to PIN is how I unlock my wife's iPhone 6s Plus when she asks me to change songs or reply to a message on her behalf while she's driving. There's no reason, absolutely none at all, why the Error 53 can't simply be a logged condition that disables the fingerprint reader; Apple should also be able to fix it by pairing the phone and fingerprint scanner.

Popup

[bondsbw]

"Would you like to use this new fingerprint scanner? [Yes] [No]"

Yes -> "Please enter your password."

See that wasn't so hard.

Property

[Anonymous Coward]

Property for peasants is so last century.
Welcome to the 21st century, where property is only for corporations, copyright is eternal and everything is under license.

EULAs ...

[gstoddart]

We pretty much lost this fight when judges upheld the right of corporations to make EULAs binding, including the ability of corporations to change them as they see fit.

Combine this with the DMCA, and the rest of the copyright/IP bullshit, and, no, you don't own it any more ... you have the right to use it according to their terms, but in no way do you own it in terms of being able to take it apart, modify it, fix it, repair it, or otherwise do anything they haven't licensed you to do.

This is the direction corporations want to go, and they've been getting lawmakers to enable them.

You, the consumer? You have no rights other than what they've chosen to give you.

Until we see lawmakers shift the other way (and they're heavily influenced by lobbying and campaign contributions), you can expect with shit like the TPP and everything else, you'll see less and less "rights" to the products you think you own.

Welcome to the awesome future, in which the corporations hold all the cards.

Your government is untrusted with your data.

[tlambert]

Your government is untrusted with your data.

But escaping that is "fashionably trendy".

Got it.

Re: I hate Apple but they're right

[Anonymous Coward]

No, you do not own the VISA nor the driver's license. They are not your property.

Re:If I can't fix the FPU in my Pentium III...

[drinkypoo]

Are there any tamper-proofing features in the P3 that would prevent you from doing this? Or is your inability simply due to your not having the right tools, not that anyone does?

Re:I hate Apple but they're right

[Anonymous Coward]

Have you read the text on the card, or in the cardholder's agreement you signed on to when you choose to keep and use the card? I believe not, because you'd have come across the text "The card provided is the property of [company] and must be returned or destroyed upon our request." It is literally one of the few things you think you own that you actually don't.

Have you read your statutes regarding your driver's license? I also believe not, because you'd note that most all governments retain the right to revoke the license (at which point, again, return the license or destroy it) and, in fact, in some places, possession of the license after that is illegal (sometimes effectively making you a criminal without your knowledge if they cancel it due to parking tickets while you're driving). The province I live in just fixed that issue last year allowing you to retain your invalid license card on the understanding it is no longer legal for any purpose other than identification. Still, to ensure there's value to the identification, the license is designed to show tampering. Again, one of the few things that it seems like is yours, but by the classical definition of property, really isn't.

Profound misunderstanding of what ownership means

[Brannon]

Ownership means you have every right to tamper with something. It DOES NOT mean that you have any guarantees that the hardware will continue to work if you do so. It never has, EVER, in the history of mankind, EVER meant that.

Microwaves and other electronics will frequently have tamper avoidance measures built into them for safety reasons--does that mean you don't own your microwave? An emissions control system might disable a car or generator if it discovers it's been tampered with, does that mean you don't own your car?

A biometric sensor may be tamper-proofed for security reasons (which is exactly what happened here)--doesn't mean that you don't own it.

Separate issues

[sjbe]

Where outside of China are you going to find the components and the equipment to repair any of these electronics, anyway?

Umm, you can buy things from China. If you need proof of this please visit your local Walmart.

Everything's microsoldered to a circuit board the size of a credit card, and the tiniest slip of your all-too-human hands and you've ruined a trace on a different circuit.

The practicality of actually doing a repair or modification is not relevant to whether or not one should have the right to attempt the repair or modification. Those are separate issues.

Fixed a mistake in the article

[Khashishi]

How can I avoid Error 53?
Don't buy Apple