Slashdot Mirror
John McAfee Offers To Decrypt San Bernardino iPhone For the FBI and Save America (hothardware.com)
MojoKid writes: Wondering what John McAfee is up to these days? It's not sniffing bath salts nor is he fleeing foreign countries as a person of interest in a murder investigation and faking heart attacks (been there, done all that) ; instead, he's on a mission to save America. How so? By cracking the code on the San Bernardino iPhone that's causing such a ruckus. McAfee didn't just criticize the FBI; instead he offered a potential solution. Let him and his team of hackers break into the iPhone without any help from Apple. "With all due respect to Tim Cook and Apple, I work with a team of the best hackers on the planet. These hackers attend Defcon in Las Vegas, and they are legends in their local hacking groups, such as HackMiami. They are all prodigies, with talents that defy normal human comprehension," McAfee said. Eccentric rant aside, McAfee's offer is simple - give him three weeks and he will, "free of charge, decrypt the information on the San Bernardino phone" with his team of hackers. He'll do it using mostly social engineering.
McAfee is clearly off his rocker. The only person or persons who he could expect to socially engineer his way through are dead.
Hasn't that ship kind of sailed? I mean, it's like trying to find unbiased jurors for a murder case when the defendant is a famous athlete or musician.
Gamingmuseum.com: Give your 3D accelerator a rest.
They must be pretty good if they attend Defcon in Las Vegas!
The suspects are dead. Are they going to attempt a seance?
Who better to break into a system that's nearly impossible to get into than the man responsible for software that's nearly impossible to get rid of?
--
What happens when an unstoppable force meets an irremovable object?
http://xkcd.com/538/
"Mostly social engineering"
Regards, Phil
How hard is it to image the entire storage area on iPhone? Like, a bit for bit copy of everything on it? And then.. just load the image into a vm and brute force the PIN, while leaving the original device intact?
If you were me, you'd be good lookin'. - six string samurai
You're supposed to be running for president!
A Trump / McAfee ticket is the closest thing we can get to having President Dwayne Elizondo Mountain Dew Herbert Camacho in real life.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
If only they would take him up on his offer. The first thing that came to mind was Kip driving over the plastic bowl with the camper van.
Dang it!
"Eat at Luigi's!"
Easy, if you have a time machine.
Or think you do.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Can't they just open the device, dump the data & OS and try to bruteforce that without using the iphone passcode system ?
He's good at that.
>He'll do it using mostly social engineering.
It seems like we (or the source) got this stuff a little hot, maybe from a handmade audio transcript. Over at Ars their take was
> About 75% [of the associates] are social engineers. The remainder are hardcore coders.
Plus the eating his shoe thing. Sensationalism or not I'm surprised that's not mentioned in TFA.
I am pretty certain Mcafee is working some amnesty angle here.
This is pretty much completely the opposite of the sort of thing he usually claims to be in favor of. I was thinking about probably not registering to vote so I could vote for him. What the shit?
"Knock Yo'se'f out!"
If he doesn't tweet this soon, he should.
The shooters are dead. How exactly is social engineering going to work against them?
>> He'll do it using mostly social engineering
"No problem. Just gimme the phone number, the address and the bank of the guy who owns the phone. I'll have him giving up the code by Sunday."
>> He's dead.
"F***!"
By "social engineering", I take it he's not planning to directly attack the hardware of the phone, which means he's planning to use the only other logical approach to breaking into this phone (and to me the only obvious attack vector open to him or anyone else as long as Apple stand their ground [correctly]).
Because this phone has a four digit passphrase, this means that the owner of the phone has hit the same four sections of screen at least hundreds, and more likely thousands of times. Maybe it is possible using very delicate and incredibly accurate equipment to detect some sort of impact print on the screen where it has been used in those four spots repeatedly. If it is possible to do this, then you have cut down the number of password from 10,000 to 24 different possibilities. From here you need to check everything you know about the phone owner to see if any of those combinations are personally significant in any way - even if the combination is entirely random, you'll still have a 41.5% to break the password with 10 attempts...
Meh - then again I'm not a half-million dollar a year hacker, so what do I know?
-- Pete.
Monochrome - Probably the UK's largest internet BBS
The whole thing is bullshit-on-hold. I already know the narrative; I've modeled the current government in abstract from bits and pieces I've picked up while not really paying attention.
You want to know how it plays out?
The government cracks the phone. It finds evidence of the shooting on there--possibly explicit, possibly vague. Regardless, it's evidence. They hold up this evidence and say, "If this hadn't been encrypted, we could have stopped this shooting!"
That's contingent on them actually cracking the phone, but it's the direction they're going. Notice the huge flaw in logic: They weren't in possession of the phone pre-shooting, and any software on the phone would be able to bypass the encryption. Network monitoring would have given them any unencrypted information. Encrypted messaging is a different facility, and any systems to look for certain key words would face both an incredible wall of false positives and misdirection by simple codes ("did you remember to pick up eggs?" "I'll buy them tonight around 8." Shooting is at 8pm). Doesn't matter; the narrative is swallowed by the masses, because people in groups don't think.
I doubt they'll fabricate evidence and claim they broke the encryption. They may be using this case as pressure, hoping to bring multiple such cases forward and continuously claim people are dying because of encryption. That's more conjecture; I'm pretty firm on their political play at the masses, but not on the power buildup via repeated demands for backdoor decryption capabilities through multiple tragedies. My models give me movie plots, but not firm projections; more data will elevate some of those movie plots to firm projections.
Just watch when they *do* break someone's encryption in one of these cases. Watch what they say after. They'll spin a narrative about how the encryption allowed the crime to occur, about how they could have stopped it if only there was an encryption back door.
Support my political activism on Patreon.
Yo Timmy, can you have them write me some firmware? I forgot my password.
I highly recommend some of you read this paper: http://www.apple.com/business/...
-- these are only opinions and they might not be mine.
You have to wonder why they even need Apple to decrypt the device. There probably isn't anything of interest on the iPhone that isn't already in iCloud or Gmail/Google Contacts and all that can be obtained using normal court orders. Smartphones today have a massive attack surface - why aren't they just using normal attacks to root the device, like the well-known SMS/iMessage with composed Unicode characters on text wrapping points, etc.? This whole debacle just smells like a giant smear campaign to get Apple, Google and friends to back off from strong encryption. Which is odd, because on the government's other hand the FCC is mandating code-signing and encryption controls on anything with a Wi-Fi radio. WTF?
A big one too! But first I'm going to tell the whole fucking internet!
Brought to you by Carl's Junior.
Forgot about this, but CRI might have some tricks up their sleeve. They MIGHT have the ability to DPA the AES engine if Apple didn't license their countermeasures - http://www.rambus.com/security...
retrorocket.o not found, launch anyway?
The fact of the matter is that
I don;t think that means what you think it means.
Your wild-ass and misguided assumptions are not facts.
Maybe McAfee is trolling. Maybe he's hoping someone will be dumb enough to go by pure name recognition, and let him at the phone. At which point, he will type in 10 wrong passwords and return the phone to starting state, ending this whole mess. I mean, think about it, does he have anything to lose at this point? "Oops. Sorry Feds. I thought we had it for a second there. Live and learn, right? *wanders off whistling to himself*"
McAfee's software, which comes loaded by default on millions of PCs, has been instrumental in making OS X more popular.
If your like me and had no idea wtf this article is talking about, apparently it was used in an american mass shooting:
https://en.wikipedia.org/wiki/...
Funny they are so concerned with gaining access to this stupid phone when the real weapons used to commit the crime are sold almost everywhere in america.
As a potential lottery winner, I totally support tax cuts for the wealthy
I see that Tashfeen used Facebook on her cell phone. Anyone who has read the things that the Facebook app has access to... would seem you could power it up, and have the facebook app probe the phone for useful information. Contact, messages, pictures, phone numbers etc. Who needs apple?
Time for a new Political party in the US (or two!) One is off the rails Other cant pony up a leader.
It would be ashamed if something happened to it. *wink wink
BS. If they were so confident they could do it, they wouldn't have to do it with THAT phone. They could decrypt the phone of some independent 3rd party willing to arbiter the contest. The judge didn't order decryption of THAT phone. It ordered Apple to surrender information sufficient to give FBI ability to decrypt ANY phone. And I believe (could be wrong on that) Apple's position is that it's not able to do it under the current encryption scheme (even if did it in the past, it may not be able to do it now). Here's http://crypto.stackexchange.co... a discussion of someone trying to understand why brute force isn't possible even if they take apart the phone.
Any guest worker system is indistinguishable from indentured servitude.
if it is a 4 digit passcode, I just don't understand why we can't clone the phone and try all 10,000 in moments?
How does having a separate "encryption chip" prevent cloning what is stored on the drives and chips?
I don't know if you can clone the memory, but it's 256bit AES encrypted, you're not going to brute fore that.
The encryption uses the (probably) 4 character (maybe digit only) passcode. There is a chip that takes this and the info to encrypt/decrypt and outputs the opposite. The chip is unique to each device and the unique AES key is burned into it by destroying some of its transistors (or something like that). The key itself is never exposed.
Both the memory and the chip probably have tamper protection to avoid what you're proposing. Apple engineers have assisted the FBI, so probably they don't know how and if this can be done.
The FBI is further limited by the system wiping itself after 10 failed attempts, and making you wait longer and longer after each try. What they are now asking Apple is to circumvent those. The iPhone under investigation is a 5C, where the 10 failed attempts and the timeout are still done by the OS. From the 5S and never those are part of the same chip that does the AES key and not even Apple could conceivably help them.
Apple doesn't want to make a version of iOS that could be loaded on the 5C and disable the 10 failed attempts and the timeout for two reasons:
- Once it's out there, any other law enforcement or government could ask for it, and/or criminals could steal it. China could be interested.
- To do this they need to expose some kind of "Apple master key" to force the iOS update onto the phone. This could then be used to force malware onto other iPhones if it got out.
Next to that is the good encryption and privacy protection one of the things they have done better than their competitors and this would thus result in bad press and a competitive disadvantage. Their bottom line would get hurt.
RogerWilco the Adventurous Janitor
Comment removed based on user account deletion
Reality:
Your ad here. Ask me how!
Per the infamous DMCA, isn't it illegal to circumvent such a protection mechanism? Could Apple make the case that this would violate its copyright on its software?
This guy is on a limb for ANY attention these days. Everything I've heard him talk about the last few years (portable private networks etc) Ive yet to see any follow through. *...a strong smell of desperation lingers in the air
All 20 of you guys posting this same question could just scroll to a random point in this comment thread, read for 2 minutes, and hit a comment explaining why not.
Unity? Screw that: XFCE. Slashdot Beta? Screw that: SoylentNews. Australis? Screw that: Pale Moon. UX developers DIAF
Its clear that the FBI want a precedent so they can get any data off any phone using a tool supplied by Apple. They can already get the data off the phone, but they want Apple to provide the tool to do it and this would be their ticket to gaining such a tool. John McAfee is bypassing their legal process making their request invalid and undermining the need for Apple to provide such a tool. Well played John.
Easy, if you have a time machine.
That ride sucks.
sub f{($f)=@_;print"$f(q{$f});";}f(q{sub f{($f)=@_;print"$f(q{$f});";}f});
"You've been abducted. Of course you need crepes!"
Don't you have an appointment with the police in Belize to deal with? Something about you being a suspect in a murder?
Seven puppies were harmed during the making of this post.
Please mod up as Insightfully Informative!
The governments position: I bet you'll come up with a better way to tear down that cement wall if I give you a court order to break it down with your forehead.
Does AES burned into CPU apply to the affected phone, an iP5C ? Also, it was county property (perp received with job), so they may have a key somewhere. If so, then just clone, brute-force read the full AES and read the rest.
If not, then it may be impossible. No judge can order other designs, that is clearly _ultra_vires_ and squarely "legislating from the bench".
So the FBI asked a couple of field agents --guys who have many years playing video games as kids-- and who in their own estimation are 'pewter savvy', and they haven't been able to break into the iPhone without everything getting wiped. And so now they are saying "we need national legislation to force back doors so that we can go on fishing trips all day long".
Wow. Hand in your nerd card you are too stupid to be here...
Notice the huge flaw in logic:
Yes, yes we did. It's called a Strawman, and you are making the FBI look smart right now...
I love this post! WTF indeed!
It's not unlike DoD (years ago, for you youngsters) implementing GPS with Selective Availability so they could de-accurize it in times of war, only to have the Coast Guard develop and install a network of differential correction transmitters (aka differential GPS). And today we have WAAS (equivalent of USCG's differential GPS, but I guess better?). But the "de-accurize" genie is way out of the bottle, btw. I'm just using this as an example as to how government left-hand doesn't know what government right-hand is doing.
AES256. That is all.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
The real government plan was to do something provocative that they knew would be in the headlines and get all the tech geeks excited so that enough of them would eventually be so curious about how to actually crack into the phone they would eventually start to formulate and eventually post an answer in online forums, long before the issue was ever resolved in court.
Its a clever way of crowd sourcing via social engineering.
These hackers attend Defcon in Las Vegas
Wow okay like only 20,000 people did that last year alone. Its amazing he has put together such a group of rare a leet individuals. To think I have been leaving that off my CV all these years. Having attended let alone spoken at DefCon 20 years ago might be impressive, but now its pretty much meh. To be honest even getting to be a presenter in many cases is as much who you know as having something really cool to show off.
That said I have no problem with McAfee doing this. I object to the idea that the government can compel a vendor to weaken the security of their product before or after the fact let alone back door it. I think Apple has a clear business interest in not doing so and its a basic question of freedom that we should not force a manufacturer to assist in the investigation of a crime they were not involved in. It would be like if someone had something locked in a safe, and the government could demand the safe manufacturer drop whatever they were doing and take whatever steps are required to crack it. That precedent would essentially turn anyone who manufactures or sells anything into a potential conscript at any time.
I also think an individual or company ought to have the right not sell to or provide the government with services and equipment if they don't want to. I for one would make the same choice Tim Cook has in this case. The Three Letters and even local law enforcement have proven they can't follow the rules, give them something like a stingray and they will abuse it. God only knows what they might do with a zero day if you provided something like that to them. IMHO they have treated us citizens like the enemy and therefore can no longer expect cooperation. I wish we lived in a nation where LEO's followed our laws and if they came to me or Apple, or anyone else and asked for help catching a crook or investigating a crime we could do so freely and comfortably knowing any tools and techniques would not be abused or used to violate peoples rights but we don't live in that nation. Its sad.
Still I expect the FBI to do its job and try to get into that phone. If they can fine, but they have no right to make demands on Apple. If McAfee wants to help fine, that is his choice. If he can charge them a few 100,000K good for him.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
administration is any less a public enemy than the Bush administration was...
And when are we going to have enough of the lying tyrants ?
Comment removed based on user account deletion