Slashdot Mirror
John McAfee Offers To Decrypt San Bernardino iPhone For the FBI and Save America (hothardware.com)
MojoKid writes: Wondering what John McAfee is up to these days? It's not sniffing bath salts nor is he fleeing foreign countries as a person of interest in a murder investigation and faking heart attacks (been there, done all that) ; instead, he's on a mission to save America. How so? By cracking the code on the San Bernardino iPhone that's causing such a ruckus. McAfee didn't just criticize the FBI; instead he offered a potential solution. Let him and his team of hackers break into the iPhone without any help from Apple. "With all due respect to Tim Cook and Apple, I work with a team of the best hackers on the planet. These hackers attend Defcon in Las Vegas, and they are legends in their local hacking groups, such as HackMiami. They are all prodigies, with talents that defy normal human comprehension," McAfee said. Eccentric rant aside, McAfee's offer is simple - give him three weeks and he will, "free of charge, decrypt the information on the San Bernardino phone" with his team of hackers. He'll do it using mostly social engineering.
McAfee is clearly off his rocker. The only person or persons who he could expect to socially engineer his way through are dead.
They must be pretty good if they attend Defcon in Las Vegas!
The suspects are dead. Are they going to attempt a seance?
Who better to break into a system that's nearly impossible to get into than the man responsible for software that's nearly impossible to get rid of?
--
What happens when an unstoppable force meets an irremovable object?
You're supposed to be running for president!
A Trump / McAfee ticket is the closest thing we can get to having President Dwayne Elizondo Mountain Dew Herbert Camacho in real life.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
If only they would take him up on his offer. The first thing that came to mind was Kip driving over the plastic bowl with the camper van.
Dang it!
The encryption keys and protection mechanism are hardware based, not software based. The bytes in storage are useless without the phone's exact hardware. Unless they try and brute force the encryption. How many millions of years would that take?
You dont get it. This is the FBI's 'Rosa Parks' moment. They are using an incendiary case to force the issue that unbreakable encryption should not be allowed in casual use. They are trying to force the idea that it should be illegal to make an unbreakable lock and they are using this case to ram it home. They dont really give a shit about the data in this case, they want to cow the tech sector into not making their jobs harder.
Good-bye
I am pretty certain Mcafee is working some amnesty angle here.
By "social engineering", I take it he's not planning to directly attack the hardware of the phone, which means he's planning to use the only other logical approach to breaking into this phone (and to me the only obvious attack vector open to him or anyone else as long as Apple stand their ground [correctly]).
Because this phone has a four digit passphrase, this means that the owner of the phone has hit the same four sections of screen at least hundreds, and more likely thousands of times. Maybe it is possible using very delicate and incredibly accurate equipment to detect some sort of impact print on the screen where it has been used in those four spots repeatedly. If it is possible to do this, then you have cut down the number of password from 10,000 to 24 different possibilities. From here you need to check everything you know about the phone owner to see if any of those combinations are personally significant in any way - even if the combination is entirely random, you'll still have a 41.5% to break the password with 10 attempts...
Meh - then again I'm not a half-million dollar a year hacker, so what do I know?
-- Pete.
Monochrome - Probably the UK's largest internet BBS
no, Drink your Ovaltine!
The whole thing is bullshit-on-hold. I already know the narrative; I've modeled the current government in abstract from bits and pieces I've picked up while not really paying attention.
You want to know how it plays out?
The government cracks the phone. It finds evidence of the shooting on there--possibly explicit, possibly vague. Regardless, it's evidence. They hold up this evidence and say, "If this hadn't been encrypted, we could have stopped this shooting!"
That's contingent on them actually cracking the phone, but it's the direction they're going. Notice the huge flaw in logic: They weren't in possession of the phone pre-shooting, and any software on the phone would be able to bypass the encryption. Network monitoring would have given them any unencrypted information. Encrypted messaging is a different facility, and any systems to look for certain key words would face both an incredible wall of false positives and misdirection by simple codes ("did you remember to pick up eggs?" "I'll buy them tonight around 8." Shooting is at 8pm). Doesn't matter; the narrative is swallowed by the masses, because people in groups don't think.
I doubt they'll fabricate evidence and claim they broke the encryption. They may be using this case as pressure, hoping to bring multiple such cases forward and continuously claim people are dying because of encryption. That's more conjecture; I'm pretty firm on their political play at the masses, but not on the power buildup via repeated demands for backdoor decryption capabilities through multiple tragedies. My models give me movie plots, but not firm projections; more data will elevate some of those movie plots to firm projections.
Just watch when they *do* break someone's encryption in one of these cases. Watch what they say after. They'll spin a narrative about how the encryption allowed the crime to occur, about how they could have stopped it if only there was an encryption back door.
Support my political activism on Patreon.
I highly recommend some of you read this paper: http://www.apple.com/business/...
-- these are only opinions and they might not be mine.
The four digit PIN isn't used to encrypt the device. If it were, the thing would have been decrypted in under a minute. The encryption key is stored in a piece of hardware that takes the PIN and encrypted data as input. It combines those with a key that only the hardware knows to generate some output. If the hardware would make it's key available then it would be trivial to do what you describe. But the hardware is explicitly designed NOT to do that. It can only output the decrypted text. If you pass it the wrong PIN, the output is jibberish. Of course you can still try every combination of PIN but you need the actual hardware. For iPhone 5, if you entered a bad PIN too many times, the OS wiped the device. If you could sabotage the counter or otherwise modify the software you get unlimited tries. That's what the FBI wants here. Starting in iPhone6, the hardware ("secure enclave") will destroy its key if there are ten bad PIN entries in a row. The same hardware is designed such that updating it's software will also destroy the key. So the trick won't work anymore. However, Apple can decrypt an iPhone5. But they have to do it by updating software to not wipe the phone.
The fact of the matter is that
I don;t think that means what you think it means.
Your wild-ass and misguided assumptions are not facts.
McAfee's software, which comes loaded by default on millions of PCs, has been instrumental in making OS X more popular.
The key is a derivative of the PIN that has been encrypted by a device-unique AES key that can be set and erased but NOT read back. The only thing that is wired to that memory cell's outputs is an AES engine's "key" input.
So it's not quite a PUF but it's pretty close.
Best route of attack other than decapping the chip and microprobing it is likely DPA.
retrorocket.o not found, launch anyway?
I'd have to use a "beating a dead horse" analogy here - except that the dead guy was a terrorist, not a horse. Either way though - no amount of whacking the corpse with a $5 wrench (or even one of those $5,000,000 NASA Space-wrenches) will have very much effect here.
www.sjbaker.org
And anybody that knows their stuff just uses a secure passphrase with > 100 bits of entropy and Argon2 and nobody besides them will ever be able to unlock that. Apple only needs the hardware to make it very convenient to get secure crypto. It is entirely possible to do this securely in software only, just requires a user that is willing to remember more than 6 characters and letters.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Oh, simple: He cannot do it. He will not get a chance to try either and he does know that as well.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
If your like me and had no idea wtf this article is talking about, apparently it was used in an american mass shooting:
https://en.wikipedia.org/wiki/...
Funny they are so concerned with gaining access to this stupid phone when the real weapons used to commit the crime are sold almost everywhere in america.
As a potential lottery winner, I totally support tax cuts for the wealthy
BS. If they were so confident they could do it, they wouldn't have to do it with THAT phone. They could decrypt the phone of some independent 3rd party willing to arbiter the contest. The judge didn't order decryption of THAT phone. It ordered Apple to surrender information sufficient to give FBI ability to decrypt ANY phone. And I believe (could be wrong on that) Apple's position is that it's not able to do it under the current encryption scheme (even if did it in the past, it may not be able to do it now). Here's http://crypto.stackexchange.co... a discussion of someone trying to understand why brute force isn't possible even if they take apart the phone.
Any guest worker system is indistinguishable from indentured servitude.
Comment removed based on user account deletion
You dont get it. This is the FBI's 'Rosa Parks' moment. They are using an incendiary case to force the issue that unbreakable encryption should not be allowed in casual use. They are trying to force the idea that it should be illegal to make an unbreakable lock and they are using this case to ram it home. They dont really give a shit about the data in this case, they want to cow the tech sector into not making their jobs harder.
THIS! I wish that I had mod points. You are correct, the case is entirely political. The Guardian has an article that explains in depth what you very succinctly stated. The big takeaway is that the actual data in this case doesn't really matter. However, the feds were fishing for the perfect inflammatory case to establish legal precedent (NPR had a great story on it earlier this week with a legal analyst who said that the Justice Department knew exactly what they were doing when they chose this case). Tim Cook is spot on in fighting this as a precedent matter more than anything else.
-Turkey
Read more history. I dont think the Jews in Germany ever imagined things would ever end up where they did either. Thats not hyperbole or Godwin. History EXPLICITLY AND WITHOUT QUESTION teaches us that these powers can and WILL be abused to hurt and literally enslave people. IF they can do it to 'criminals' they can do it to anyone. Part of you earning and investing is BEING A GODDAMN CITIZEN. You dont get to completely ignore your civic duty. Where did you get that idea that your only function is to be a selfish prick and give nothing back? Paying taxes=!being a citizen or fulfilling your civic duties. Get involved and you will see precisely why people scram about this shit. Did you parents teach you nothing of the sacrifices people made to get us here? Freedom isnt free, it requires an involved and educated citizenry. Be part of that or shut the fuck up. Dont let your apathy strip others of their creator granted rights.,
Good-bye
All 20 of you guys posting this same question could just scroll to a random point in this comment thread, read for 2 minutes, and hit a comment explaining why not.
Unity? Screw that: XFCE. Slashdot Beta? Screw that: SoylentNews. Australis? Screw that: Pale Moon. UX developers DIAF
I'd have to use a "beating a dead horse" analogy here [...] no amount of whacking the corpse with a $5 wrench
Well, there's your problem. If you really want results, you have to beat the correct horse with a battery staple.
Does apple's file system have checksums? If it doesn't then what you've described is fairly easy to break: Just dump the flash, wipe the phone, create dummy file, plop original content into its place, and try it with different PIN numbers until file contains coherent data.
Starting in iPhone6, the hardware ("secure enclave") will destroy its key if there are ten bad PIN entries in a row. The same hardware is designed such that updating it's software will also destroy the key. So the trick won't work anymore.
Apple has already said that they could break an iPhone 6 in a similar manner. So the exact same trick may not work, but there's still a way.