Slashdot Mirror
Judge Tells Apple To Help FBI Access San Bernardino Shooters' iPhone (engadget.com)
An anonymous reader writes: After a couple shot 14 people in San Bernardino, CA before being killed themselves on December 2nd, the authorities recovered a locked iPhone. Since then, the FBI has complained it is unable to break the device's encryption, in a case that it has implied supports its desire for tech companies to make sure it can always have a way in. Today the Associated Press reports that a US magistrate judge has directed Apple to help the FBI find a way in. According to NBC News, the model in question is an iPhone 5c, but Apple has said that at least as of iOS 8 it does not have a way to bypass the passcode on a locked phone.
"Judge orders arsonist to unburn-down house"
Good luck with that.
There's no word on exactly which model of iPhone was recovered
Huh? The article clearly states a model:
According to NBC News, the model in question is an iPhone 5c
I wouldn't be surprised if this was nothing more than a joint PR stunt to mislead people into assuming privacy on their cellphone so they wouldn't be afraid to use it for sensitive information. Government has nothing to win by disclosing they have a backdoor, neither does the cellphone manufacturer. Even thinking lo-fi decryption, how long must the passcode be before brute-forcing gets more inconvenient for the government than for the user?
to revive the dead people.
Unlock code: 072 (Virgins)
All you gotta do is put the password here and it opens right up. What's that? You don't know the password? Neither do we.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
Is it contempt of court to refuse to try and do something that one already knows they cannot possibly do?
File under 'M' for 'Manic ranting'
It stands to reason that the purpose of trying to decrypt the phone after the event, and after the death of the perpetrators, is to see if there might be any information that might implicate other individuals as accomplices or sympathizers, so that those individuals can be investigated. But if it is not possible for Apple to decrypt the phone, then other avenues of investigation will need to be considered.
Of course, mathematics being what it is, and lawyers and judges being who they are, it is not the least bit surprising that the latter should be ignorant of the former. It's a unique form of hubris to think that one can somehow circumvent a secure cryptographic system by the mere force of law, as if jurisprudence supersedes mathematical truth.
They can be set so 10 failed tries wipes the phone. They can also set larger passwords than 4 digits.
Maybe they should ask one of the 5,000,000 various reporters, journalists, and random people eating popsicles if they saw what looked like an iPhone passcode written down somewhere in their house while it was being ransacked live on television a day or two after the attack.
I assume they would image the drive first...
“He’s not deformed, he’s just drunk!”
Or you know the FBI can look through all the phone records and use their other sources of information. These people had twitter, they know that, they can also easily find their email accounts.
It's the FBI being whiney.
Do not look at laser with remaining good eye.
The problem is that cryptography is mathematics and doesn't know the difference between criminals and innocent people.
It also doesn't know the difference between law enforcement requests to unlock the phone and criminal requests.
If they can get into a criminal's phone, they can get into anybody's phone. If they can get into anybody's phone, any criminal who gets the key can get into anybody's phone. As to "how likely is it for the criminals to get the keys?"... well, pretty much every system (FBI, DHS, Apple, etc) that could theoretically hold the keys has been breached at some point. Holding that capability also makes a huge target. So "Very Likely", even to the point that when things were previously unlockable, hackers were doing so already.
Thus it comes down to "Do you want to allow criminals to access your iPhone so that law enforcement can also access a criminal's iPhone?" at that level. And in the event that a smart criminal had an indication that Apple could defeat the encryption and lockout, they'd just store the important data in a place that no company controlled or had access to.
@Whee
No problem. 0000. Nope. 0001. Nope. 0002. Nope...
0009. Too many invalid password attempts. Full disk encryption key has been erased. Initiating factory reset of device...
> Except for the Criminal Rights crowd
You mean like the Son's of Liberty? THAT "criminal rights" crowd.
You're such an ignorant moron.
A Pirate and a Puritan look the same on a balance sheet.
Just so that the debate here is a little more well-informed:
The government is not asking that Apple give out the user's password, or decrypt the phone, both of which they cannot just do (i.e. are incapable of performing). The request is that Apple produce a piece of iOS software or boot image (as I understand it), that would:
1) Disable the auto-erase feature
2) Allow the FBI to brute force submit password guesses to the phone, and
3) Disable or reduce the increasing-delay-between-guesses feature of the passcode lock.
I would be curious to know whether for this iPhone 5c (with iOS 9) this is even possible for Apple to do.
You can see why Apple wanted to get very far away from the business of being in a position to be asked constantly by law enforcement to help decrypt its phones, just for the sheer volume of requests that will be coming if they do....
The right to encryption and by extension privacy is more important than any one crime. The State has to accept its limitations, not wail and moan about how its 'not fair' they cant have absolute control over humans. Some things are beyond government's reach, accept it.
Good-bye
What could be learned from that phone that could not be collected from all the other electronics the couple owned and used?
Without accessing that phone the govt could find who the couple have called and texted, subpena social media sites for their exchanges, and collect who knows how much information under an NSL from Internet Service Providers.
I find it difficult to believe that something so nefarious or so important exists on that phone and that phone alone that can't be gathered elsewhere through other fashions.
This feels like the govt trying to flex its muscle using a high profile case in order to persuade public opinion regarding encryption and back doors.
Remember folks: a backdoor for one is a backdoor for all. And who cares about a back door when you have an intelligence agency monitoring all the comings and goings of the front door.
"If it ain't broke, it doesn't have enough features yet"
Apple devices from the iPhone 5s and onward use a "Secure Enclave" which is basically tamper-proof hardware key management.
This phone in question is the 5c, so Apple might actually be able to attack it. Unfortunately, this will make the judge think any iPhone can be attacked by Apple.
Although, I'm really not clear under what authority the Judge believes he has the power to compel Apple to do all this work against their business interests. It used to be they'd have to threaten, in secret, to put the CEO in prison to get this kind of cooperation. Now a judge just commands it? #ussa
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Comment removed based on user account deletion
Well, your honor, we tried.
The perpetrators are contained. Finding out why they did it has time and can be done slowly and the old-fashioned way. The only thing they are doing here is to push (again) stupidly for a thing that makes everybody much less safe: backdoors. They must not be allowed to make the current global computing infrastructure even less secure as it is today, just to cater to their laziness. These people are more of a threat than any criminal could ever be.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Brute forcing BPKDF2 is easy in comparison to what he wants. This is about breaking a secure microcontroller. A few orders of magnitude harder and pure software-attacks will very likely not work.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
After reading Apple's iOS Security Guide white paper, it is doubtful that Apple can write any kind of software to load onto the device to permit any of those options. This is because once the device is locked, it will not install any updates to the operating system. The boot firmware is already installed and automatically runs when the device is turned on. Updating the operating system requires the device password. These functions are cryptographically secured. See the section "Keybags," subsection "Escrow Keybag" in the paper. The auto-erase and time delay features are enforced by the Secure Enclave in hardware, and cannot be circumvented.
why? guilt is not in question. It's just a precedent thing. fbi is overfunded and now they have something to do. Why don't they use these resources on future crimes unrealated? I'll tell you why. because it's easier and more fun to tinker with this. fuck the fbi, do something useful for us.
From one point of view, it could be said that I did not say the encryption scheme would be broken in that case. It would be the misappropriation of "legitimate" keys used to access the back door of the encryption system.
From another point of view, if the point of the encryption is to prevent any but explicitly-authorized entities - as defined by the data holder and assumed to not include the pool of "and whoever has backdoor keys to the encryption system" - from accessing the data, the very existence of a backdoor breaks the encryption scheme (though not the cipher-generation algorithm) to a degree as it both creates an unknown third party "authorized entity" and a larger attack surface against which a successful attack can compromise the security of your data.
The encryption scheme, taken as a whole, is the entirety of everything from the key storage to (in)secure hardware to the strength of the key against various attacks to the cipher algorithm and stuff in between and around. So the algorithm that generates the encrypted result and reverses that process may be "very secure", but the scheme as a whole can have other faults. Like "password written on a post it note and stuck to the back" or "intercept the self-destruct process to be allowed to brute-force 10,000 4-digit possibilities" to "offload the stored key and use knowledge of the pin-to-key process to extract the key by brute force on an external system".
Encryption cipher algorithms as we know them today is not "unbreakable". It's just "currently so hard to break that it cannot feasibly be assumed to be doable in a useful time period." But a sticky note with the password renders even an "unbreakable" quantum cipher useless in short order. So you protect the key.
If you are the only one in control of the key, you can make your own choices (within some limitations) on where that key exists and who/what has access to it. The moment there is a back door, you no longer have control over the fully-inclusive key set to your data and the people who do have proven that there is a strong potential for their backdoor key to become compromised, thus compromising the security of your data.
@Whee
NO!
If he had it on icloud, Apple could turn it over. The icloud backups are encrypted BY APPLE.
Check page 4:
www.apple.com/privacy/docs/legal-process-guidelines-us.pdf
Here's some guidelines:
http://manhattanda.org/sites/d...
There's a part where the document sort of complains that users aren't required to back everything up to icloud, because they can just ask for anything in icloud at all and get it in plaintext immediately (as documented by the first link).
If you promise to encrypt "hunter2" your end with AES-256, is it encrypted? Sure, but it's also here on plaintext, in transit, and if asked, you could certainly retrieve it. Even though it's clearly my password that you can't see :P
If the iPhone 5c had Touch ID this wouldn't be a problem, they could just use the persons finger to unlock the device. This illustrates why Touch ID is a bad idea if you care about your privacy. Since we only have ten fingers and the auto erase doesn't activate until after 10 failed attempts, the only thing needed to get into a Touch ID phone is a court order. The Fifth Amendment protection against self incrimination only applies to the contents of your mind, it's established precedent that it doesn't apply to your body (i.g. blood, DNA, finger prints, etc.) or property.
No, they want Apple to create a "one-off" insecure version of iOS. Source: I was personally told this by Tim Cook.
Well, OK, he wrote me a letter.
Well, OK, he wrote a lot of people that same letter and has probably never heard of me or had me in mind when writing it. But he is a person, and he did tell me this via said open letter, so that counts as being personally told this by Tim Cook right?
You are not alone. This is not normal. None of this is normal.