FBI Should Try To Unlock iPhone Without Apple's Help, Lawmaker Says (csoonline.com)

itwbennett writes: Representative Darrell Issa, a California Republican and former car-alarm entrepreneur, has suggested that the FBI try unlocking mass shooter Syed Rizwan Farook by copying the hard drive and running password attempts until they find the correct password. Bruce Sewell, Apple's senior vice president and general counsel, said during a congressional hearing that, although the company doesn't know the condition of the shooter's iPhone, Issa's approach may work.

Comments

yes they should

[hypergreatthing]

and watch the phone format itself after they fail.

Re:yes they should

[Anonymous Coward]

But, so what if that happens? Nobody really believes there's anything useful on the phone anyway.

Re:yes they should

[theCzechGuy]

Have you even read the summary? How would the iPhone do that if they make binary image of the storage? Can it magically format other storage devices as well?

Re:yes they should

[Himmy32]

That's the whole point of the hard drive copy. Who cares if it deletes a copy. Make another try again.

This plus write-blocking, welcome to modern disk forensics.

Re:yes they should

[Anonymous Coward]

How would the phone format itself? The summary speaks of unlocking Farook, not his phone.

Re:yes they should

[Anonymous Coward]

The problem is that taking a disk image gets them to "break raw AES-256". The key is stored in a specialized device that they'd have to directly access the silicon to do the equivalent of "take an image" for, which has a very high failure rate for to apply to a unique evidence object.

Re:yes they should

[operagost]

That isn't the problem, but the real problem is that the private key is kept in NAND memory, not the flash memory (what they're calling the "hard drive"). The FBI isn't already doing this because it's really hard... mathematically hard. As in, unless they have quantum computers we don't know about, they won't be able to figure out what's on that phone for eons. And without the private key, it would be hard to even know the difference between the encrypted gobbledygook and the unencrypted data if you crack it.

I maintain that they are pretty sure that there's nothing of value on that phone, and that this whole exercise was a ruse to gain government backdoors to encryption because, terrorism.

Re:yes they should

[Thanshin]

and watch the phone format itself after they fail.

Ladies and Gentlemen, the answer from a 6 digit Slashdot member. It manages an almost perfect balance between trollish and imbecilic, while leaving no doubt about the fact he didn't RTFA.

At 5 digits, his reply would be a dupe of a previous one, and you'd understand he doesn't even understand the concept of the article.

At 4, the comment would just be an anagram of both "first post" and a bodily fluid.

Reading a 3 digits comment would be akin to hearing the voice of God.

At 2 digits, the words shape the chaos into reality.

Not even Gods speak about single digit comments. And when they do it's in weakly whispers. For such power is better to leave asleep.

Re:yes they should

[MachineShedFred]

No, not on the iPhone 5C it isn't.

The 'Secure Enclave' is 5S, 6, 6+, 6S, and 6S+.

Re:yes they should

[MachineShedFred]

7-digit ID talking shit about 6-digit IDs. Now I've seen it all.

Re:yes they should

[bleh-of-the-huns]

This is incorrect. The phone does not store the key anywhere. The key is made up of the phones unique identifier value, and your pin, combined to make the key. What they can do is use acid, high powered visual equipment and lasers to try to determine the unique identifier from the iPhones CPU, and then try to brute force that with various pin numbers.

Re:yes they should

[jandrese]

Low UIDs aren't that uncommon. There are 899 three digit UIDs. That would be a pantheon dwarfing even the Greek gods of old.

Re:yes they should

[Martin Blank]

From my understanding, even if they do have quantum computers, it may still take eons. Quantum computers don't solve things instantly, and while they're faster against AES, they reduce the bit strength by about half, leaving 256-bit AES the equivalent of about 128 bit, still likely strong enough to withstand any reasonable amount of brute forcing. Depending on the speed of the quantum computer, even if going up against AES-128, the 64-bit equivalent may still be unbreakable for years.

Re:yes they should

[Anonymous Coward]

That isn't the problem, but the real problem is that the private key is kept in NAND memory, not the flash memory (what they're calling the "hard drive"). The FBI isn't already doing this because it's really hard... mathematically hard. As in, unless they have quantum computers we don't know about, they won't be able to figure out what's on that phone for eons.

Quantum computers if they did exist still wouldn't be able to do jack against a symmetric AES key.

Re:yes they should

[Impy the Impiuos Imp]

Why don't they do this? It's not like they have more money than NASA and some of the best scienti...

n/m

Re: yes they should

[Anonymous Coward]

Most of them left the site in disgust years ago though

Re:yes they should

[bleh-of-the-huns]

My guess would be... you don't get a second chance.. if you fuckup.. it's dead. And acid is not exactly the most predictable thing to work with.

Re: yes they should

[Midnight Thunder]

It is hard, but between the NSA and the FBI they should be working hard to develop new techniques. Maybe the military could even chip in, if it really is an issue of national defence, as is the case in the IS argument? Wasn't the NSA meant to be the brain that could crack anything?

One benefit of having techniques that only governments can afford and have access to, is that the methods would be hard for a 'script kiddie' to reproduce.

One thing is that the encryption is probably hard, but probably predictable in some form, since the phone needs to be able to access the stored data rapidly and without taxing the processor too hard, since otherwise performance and battery would take a noticeable hit.

Re:yes they should

[Anonymous Coward]

But, assuming a four-digit pin, there are only 10,000 possible password combinations. They should be able to brute force that rather quickly.

Re:yes they should

[Bookworm09]

Ha. I wish I had mod points.

Re:yes they should

[Anonymous Coward]

My understanding was the pin unlocks (deciphers) a much larger intermediary key which then unlocks/pairs the unique device key etched in silicone on the SOC. Are you sure about the key being a combination of the unlock pin and the unique device key? I'm not so sure, and if I'm right they can attempt to get the intermediary key, but without the pin it's still scrambled which leaves the unique key on the SOC still protected.

Re:yes they should

[Anonymous Coward]

My guess would be... you don't get a second chance.. if you fuckup.. it's dead. And acid is not exactly the most predictable thing to work with.

The technique is not exactly untried; it's a well known method for starting the reverse engineering of a chip or just getting access to its guts.

Andrew "bunnie" Huang, a well known engineer who's been featured on /. before, has an example of the process on his page: http://www.bunniestudios.com/blog/?page_id=40

Re: yes they should

[Anonymous Coward]

They have physical access to the device and a huge, modern forensics lab. This is the attack everyb

Re: yes they should

[gtall]

Err...the NSA is part of the military. And they do not like to play nice with the civilian authorities because any whizzy things they let out of their labs could find its way into a lawsuit and then public domain. And the NSA is not the brain that can crack anything, that only comes from TV. NSA is actually quite circumspect in any promises to technical virility. The woman professor, Landau, on the panel in yesterday's Inquisition more or less told the representatives that the FBI was behind the times technically and in terms of mindset. Too bad Comey was on the earlier panel, I'd have like to see her tell that to his face, and she certainly seemed prepared to do it.

Issa is generally a dolt about most things. His understanding of tech is at least 20 years old.

What was really entertaining was watching Trey Gowdy act like a chicken with his hair on fire and being very angry about it. One expected him to cross the streams and blame Benghazi on Apple. Sensenbrenner from Wisconsin was similarly brain-dead asking why Apple didn't come to the hearing with a bill or a list of fixes for Congress to implement, Gowdy seemed incensed about this as well but one got the impression anything to get incensed about would do, he isn't particular. Me thinks he'll be running for President on the Eejit Ticket next go 'round. Comey came across as lame technically, the NYC district attorney, Cyrus Vance Jr., was more or less ready to run any civil liberties under the bus and didn't think there was any issue as long as he could throw someone in the klink if they got in his way.

Re:yes they should

[Anonymous Coward]

Standard forensic procedure is to remove the storage from the phone, and make a forensic image of it (similar to a ZIP file), then all attempts to crack it are done on a forensic machine that is not running the safety software you described. The original storage is put back in the phone, then the phone is put in a evidence locker and usually not touched again.

Re:yes they should

[unrtst]

That's the whole point of the hard drive copy. Who cares if it deletes a copy. Make another try again.

Apparently, there are multiple parts to the key.
1. the pin number (probably just 4 digits)
2. the unique identifier burned into the silicon (impossible to recover without taking apart the chip with acid and stuff and looking at it with microscopes, and you may not get it right if you do that)
3. a long random number stored in NAND

All of that is combined and then used as a symmetric AES key to encrypt the data on the flash.

The "phone wipes the drive" is not accurate. When the phone wipes the drive, it actually just wipes #3 (and maybe some other stuff after that wipe is completed).

AFAIK, they can't (easily) copy the NAND nor #2.
They can copy the flash and try a bajillion keys, but that will take eons.
They can copy the flash, try via the phone, fail, and the phone will wipe #3, and then they're SOL - restoring the data to flash will not help at all.

There may be other techniques they can use, but it's not as simple as backup/restore the flash.

Re: yes they should

[Anonymous Coward]

Err...the NSA is part of the military.

Umm, no. They are not part of the DoD. Granted, they do work closely with them, but they are most certainly not part of the military.

Re:yes they should

[rotorbudd]

Its "Spooky Action at a Distance" for large objects!

Re:yes they should

[rch7]

How about just booting existing OS and reading/writing the RAM if you have hardware access?
It is assumed that Apple already has backdoor to disable unlock attempt counter, so it should be possible for everybody if you can skip Apple signature requirement for new code.

Re:yes they should

[joshuao3]

I must be missing something obvious. If it's a 4 digit PIN, and they can make a copy of the memory, can't they create a multiple virtual instances of the device and test the 10000 PINs somewhat in parallel? I guess the hard part is "make a copy of the memory". I know the spy movies make it simpler than it is in reality, but it would seem that there must be a way to do that. Even if it's expensive and time consuming to copy the memory, it's got to be cheaper and faster than taking Apple to court.

Re:yes they should

[Nite_Hawk]

Frost spit since I'm from Minnesota you insensitive clod.

Re:yes they should

[Anonymous Coward]

There are 899 three digit UIDs.

Oh look! An off by one error... better correct that comment.

Re:yes they should

[Anonymous Coward]

Me too!

Re: yes they should

[Anonymous Coward]

"....NSA operates under the authority of the Department of Defense."

https://www.nsa.gov/about/faqs/oversight.shtml

Re:yes they should

[Anonymous Coward]

>There are 899 three digit UIDs.

For exceeding large values of 899 that are equal to 900.

Re: yes they should

[Anonymous Coward]

Does the iPhone have a hard drive, anyway? My first gen iPod does, but I don't see how they'd fit one into an iPhone. I guess hard drives have gotten really thin.

Re:yes they should

[GameboyRMH]

You're missing that the mechanism which unlocks the actual encryption key based on the PIN is not software but a tamperproof chip.

Re:yes they should

[orgelspieler]

God? Is that you?

Re:yes they should

[the_Bionic_lemming]

(yawn) you weren't part of the first half million....

Re: yes they should

[TWX]

Now you're just being pedantic.

The FBI should copy the contents of the storage medium to another storage medium and attempt to brute-force it. That's what the lawmaker is saying in a nutshell. This lawmaker is actually making our case, that it's not Apple or any other vendor's job to break their own security, that it's the investigating agency's job to essentially prove its case by doing that work itself. Stop attacking the person actually trying to help by nitpicking what they say.

Re:yes they should

[Mars Saxman]

I missed that golden threshold, alas, but can I still have demigod status?

Re:yes they should

[amicusNYCL]

Low UIDs aren't that uncommon. There are 899 three digit UIDs.

That represents about 0.02% of the Slashdot user base, give or take, and they aren't all active.

Re:yes they should

[Just Some Guy]

If I can, you probably can. And oh, do I ever.

Re:yes they should

[smartr]

The attack makes sense. The filesystem key is not related to the UID, and the filesystem key is what is erased to prevent brute-forcing, not the encrypted file system on the SSD itself. If you get a copy of the eh, erasable memory (which may or may not be stored on the SSD), then you have the filesystem key. Be it that Apple is very mum about what actually talks to the devices, I don't know where that part of the memory is. Be it that the 5C doesn't even have a security enclave, I don't understand why you wouldn't be able to just find the key and plug in the algorithm. With the security enclave, the phones would be vulnerable to the same attack, but they'd be rate limited by the security enclave meaning a small alphanumeric code could make it impossibly long to get into - but the self destruct system is bypassable.

Re:yes they should

[Anonymous Coward]

Neither his people part of Mayflower batch.
Story of his live. Too late at the party.

Re:yes they should

[sudon't]

That's what I've been wondering - what's stopping them from pulling the hard drive (or whatever) and copying it? I think the FBI is just being lazy. Then there's the question of what they think they even need from the phone. After all, it's a network device, and most of what it does happens across the network. They have all that data already - phones calls, web activity, GPS, etc. Greedy and lazy.

Re:yes they should

[Anonymous Coward]

This is incorrect. The phone does not store the key anywhere. The key is made up of the phones unique identifier value, and your pin, combined to make the key. What they can do is use acid, high powered visual equipment and lasers to try to determine the unique identifier from the iPhones CPU, and then try to brute force that with various pin numbers.

Of course if there is data on the phone that you may want to use as evidence, you are not allowed to destroy the phone to get at it. The defendant is allowed the original device in its original state. OTOH, if you aren't planning to prosecute anybody from any data found on it, then go for it.

Re:yes they should

[smartr]

Just because something is encrypted, doesn't mean you can't copy it. What's your source on this unreadable uncopyable "NAND" memory? Even if the filesystem key is stored encrypted by the UID and pin, if you can make a single copy of that encrypted block (and then repeatedly copy from that) - the complexity becomes a matter of brute forcing the pin (not the stronger UID or filesystem key). So, what's the story on this?

Re:yes they should

[hey!]

How many years have we been reading about security researchers mounting clever side channel attacks on things like smart cards? Has everyone here forgotten about Tempest already? So how likely is it that the NSA can't read a phone's hardware UID without acid-etching the CPU, either directly or by recovering the contents of memory? It could be simple as entering a PIN and observing what (wrong) encryption key the CPU generates.

But there are some really good reasons (from the FBI's standpoint) for compelling Apples' cooperation. First, they'd like the legal precedent that manufacturers have to provide them with a way in. Second, they won't have to go hat in hand to another agency to ask for help. Third, it'd be a lot more quick, convenient and cheap to install a compromised OS on a device than it would be to have to disassemble it. You could potentially do that while you had someone in short term custody (e.g. within 100 miles of the US border, which can be done without probable cause and where 2/3 of the American population lives).

Re:yes they should

[thegarbz]

How many years have we been reading about security researchers mounting clever side channel attacks on things like smart cards? Has everyone here forgotten about Tempest [wikipedia.org] already?

Are you telling me that security researches get through clever side channel attacks first go without breaking hardware? That's the ticket here. Whatever they are going to do needs to be damn certain that it's going to work.

Re:yes they should

[Anonymous Coward]

So you make another copy and try again?

Re: yes they should

[Pseudonym]

Now you're just being pedantic.

On that note, my laptop has something which the vendor referred to its flash storage as "solid state disk". This term more accurately describes a rotating hard drive, which is both made from matter in its solid state and disk-shaped.

Language is a social contract in which Alice agrees to try to make herself understood and Bob tries to understand. In this case, the lossy communication channel did the job.

Re:yes they should

[Pseudonym]

I could have had a 4-digit id, but I come from an era when long-term lurking before posting was considered virtuous.

Re: yes they should

[Cramer]

No he's not. The iPhone does not contain a HARD DRIVE; it has a flash memory chip. The entire contents of which are encrypted. Removing that chip (which is not easy) would yield nothing but a bunch of random garbage. After 1.2million years of attempting keys, you might gain access to the filesystem, only to find EVERY file of value encrypted yet again (with various keys).

The thing that needs to be backed up -- the UID and key built from it -- cannot be accessed.

Re:yes they should

[Just Some Guy]

Same here. That's why I only have a 4-digit ID.

Re:yes they should

[Anonymous Coward]

I've been lurking for fifteen years.

AC Foreva!

Re:yes they should

[Vadim Grinshpun]

Let there be...
nevermind.

Re: yes they should

[mikael]

iPhones can get USB dongles to allow data to be copied to a memory card. Android smartphones have a socket for a removable SD card (any size from 8GB to 128GB). The memory is really that cheap (and small as a fingernail). Perfect for backing up data, even if the USB cable port won't accept data service.

Re:yes they should

[Isaac-Lew]

Should be OK for Valhalla. Save me a chair & a flagon of mead.

Re:yes they should

[Anonymous Coward]

But is this chip what keeps track of the attempt count, or some variable stored in memory?

Re:yes they should

[NicBenjamin]

So you make another copy and try again?

You can't make a copy. That's the whole design of the system.

You can work around that by trying to apply just enough acid to just the right places to get the data off the chip that you would need to copy, but if you fuck it up the chip is ruined and the data is lost forever.

Re:yes they should

[NicBenjamin]

The attack makes sense. The filesystem key is not related to the UID, and the filesystem key is what is erased to prevent brute-forcing, not the encrypted file system on the SSD itself. If you get a copy of the eh, erasable memory (which may or may not be stored on the SSD), then you have the filesystem key. Be it that Apple is very mum about what actually talks to the devices, I don't know where that part of the memory is. Be it that the 5C doesn't even have a security enclave, I don't understand why you wouldn't be able to just find the key and plug in the algorithm. With the security enclave, the phones would be vulnerable to the same attack, but they'd be rate limited by the security enclave meaning a small alphanumeric code could make it impossibly long to get into - but the self destruct system is bypassable.

But of course, if any of this is actually possible Apple's been lying about the security on their smartphones for literally years, and it's likely that almost every country could hack the system.

The whole design is that the drive can only be read with a key. Without the key it's encrypted gibberish. The key is derived from a) a chip on the motherboard, and b) your PIN. The chip is specifically designed so that it ain't gonna tell you it's bit unless the PIN is right. You could probably get the hardware bit of the key by destroying the relevant chip to read it, but if you fuck that up the key is gone forever, and you still don't have a PIN. And the whole shebang kills itself (including the hardware bit of the key that you actually need if you wever want to read the iPhone's data) if you enter the wrong PIN 10 times.

Re:yes they should

[kriston]

The iPhone 5c doesn't have the "tamperproof chip." That's only in the current generation.

Re:yes they should

[NicBenjamin]

You could copy the Flash memory storage, but to actually decrypt that you need a copy of the key that's in chips on the motherboard. Those chips are not designed to tell the world what their key is without the right PIN, and without their key or a centuries+long decryption job the data is simply unreadable. And the chips erase themselves after 10 failed PINs.

So to make your 100-copies you'd have to destroy all the chips in question, because the only way to read it is acid, and acid does not leave chips in workable condition. Which is why Apple was able to seriously argue that the encryption on the 5c was virtually impossible to crack, even for the FBI/NSA/etc.

Basically if anything Issa were talking about was actually remotely possible a) we would not be talking about this because the Judge would never have issued the order, and b) there would be potential false advertisement issues for Apple.

Re:yes they should

[laugau]

first post, forced pissed, whatever.

Re:yes they should

[dwywit]

This may have been covered already, but won't Apple have a record of the hardware ID, and be compelled by warrant to hand it over?

Re:yes they should

[reboot246]

The defendant is dead. There won't be a trial.

Whatever evidence they find on the phone pointing to other potential terrorists would probably not be enough to prosecute them. It may be enough to warrant further investigation of them.

Re:yes they should

[dgatwood]

... the real problem is that the private key is kept in NAND memory, not the flash memory ...

NAND memory is flash memory. Depending on which key you're talking about, either:

• The disk encryption key is stored on disk on the 5c. The secure enclave wasn't added until the 5s.
• The hardware key consists of burned out fuses inside the CPU. The PIN is entangled with that key. It cannot be readily retrieved in software. You can, however, use acid to remove part of the chip and then using an electron microscope or similar.

The OS erases the disk encryption key after a certain number of tries. However, in the hands of professional attackers, that isn't very valuable, because the key itself is still stored in the normal flash rather than inside a dedicated crypto coprocessor. As a result, you can interpose hardware between the CPU and the flash part to simulate writes using RAM so that the flash data is not actually modified and can be reset trivially to its original values. This is the most sane attack strategy. It involves unsoldering the flash part and adding hardware in the middle. This is slow, but I see no reason that it can't be done unless I'm missing something subtle about the hardware.

Re:yes they should

[smartr]

The key is derived from a) a chip on the motherboard, and b) your PIN. The chip is specifically designed so that it ain't gonna tell you it's bit unless the PIN is right. You could probably get the hardware bit of the key by destroying the relevant chip to read it, but if you fuck that up the key is gone forever, and you still don't have a PIN. And the whole shebang kills itself (including the hardware bit of the key that you actually need if you wever want to read the iPhone's data) if you enter the wrong PIN 10 times.

The "Chip" you're talking about is the security enclave which is not on the iPhone 5C. The filesystem key is not stored in the security enclave. If you make a copy of the encrypted memory that stores the filesystem key bit for bit, then you've defeated the erasing system. It's also possible the FBI is terribly incompetent given they have multi million dollar forensic labs that can't figure out how to copy this memory.

Re: yes they should

[Malc]

But somehow you couldn't quite let go?

Re: yes they should

[ihtoit]

you have a citation for that?

Wikipedia: "SSDs have no moving (mechanical) components. This distinguishes them from traditional electromechanical magnetic disks such as hard disk drives (HDDs) or floppy disks, which contain spinning disks and movable read/write heads."

eBuyer Jargon Buster: "What is the difference between a Solid State Drive (SSD) and a Hard Disk Drive (HDD)? A traditional HDD is a device made up of moving parts that uses spinning platters to store data. An SSD on the other hand uses flash memory and has no moving parts."

market leader OCZ: http://ocz.com/consumer/ssd-gu... (with a nice infomercial at the bottom of the page)
.

Nope, I can't find anything in a cursory search that agrees with your assertion.

Re:yes they should

[ihtoit]

they'd have to get Apple to rewrite the software to allow that (it introduces a random delay of between 80ms-5s purely to defeat bruteforce attempts), also so it doesn't fry the flash memory after the tenth unsuccessful attempt. THAT is what every freedom-loving human on the planet has a problem with: if Apple make that software, who are the FBI to be trusted not to pocket the thing and use it elsewhen (notwithstanding their promise not to, I wouldn't trust the FBI as far as I could spit them)?

Re:yes they should

[ihtoit]

quantum computers would be no good since quantum computers are DESIGNED for use on unknown data sets looking for familiar patterns, whereas a 256-bit AES key is a known data set with unknown patterns.

Re: yes they should

[MrNiceguy_KS]

What he's saying is that the term "Solid State Disc" is not accurate, since the term "disc" describes a specific shape, and there's nothing disc-shaped in a Solid State "Disc". He's responding to the pedantic comment about iPhones not having "hard drives" by pointing out that Solid State Discs aren't actually discs.

Hence his last sentence:

Language is a social contract in which Alice agrees to try to make herself understood and Bob tries to understand. In this case, the lossy communication channel did the job.

In other words, "You know what he means, and being nit-picky about the technical terms just makes one look like an ass."

Re: yes they should

[ihtoit]

ummm... think you'll find it is, it's equivalent ot the Secret Intelligence Service (also referred to as MI6), the Foreign Intelligence Service of Great Britain, directly answerable to the Ministry of Defence and with a speed dial to the Office of the Prime minister and one of the few agencies that can call the PM out of a tea party with the Queen for a COBRA meeting.

If proof were ever needed, look at who chairs the NSA: a serving Admiral in the United States Navy: Adm. Michael Rogers.

Re:yes they should

[hey!]

Taking apart a phone, even desoldering the chips and putting them test jigs, isn't a high risk operation for a skilled technician.

Re: yes they should

[ihtoit]

there's actually no consensus on the use of the term "disc" vs. "disk". Both describe form and function. In medical terminology, the preferred term is "disc", while in describing magnetic, optical or magneto-optical, or flash media, you can use either. I've never been pulled up anywhere for using the term "disk" to describe something that looks like a stick of gum and plugs into the side of a laptop.

Re:yes they should

[NicBenjamin]

The key is derived from a) a chip on the motherboard, and b) your PIN. The chip is specifically designed so that it ain't gonna tell you it's bit unless the PIN is right. You could probably get the hardware bit of the key by destroying the relevant chip to read it, but if you fuck that up the key is gone forever, and you still don't have a PIN. And the whole shebang kills itself (including the hardware bit of the key that you actually need if you wever want to read the iPhone's data) if you enter the wrong PIN 10 times.

The "Chip" you're talking about is the security enclave which is not on the iPhone 5C. The filesystem key is not stored in the security enclave. If you make a copy of the encrypted memory that stores the filesystem key bit for bit, then you've defeated the erasing system. It's also possible the FBI is terribly incompetent given they have multi million dollar forensic labs that can't figure out how to copy this memory.

The 5c has a hardware-defined security code that works roughly how I described. Ars Technica has a fairly good article on how hard it would be to get the relevant info out of the iPhone without the PIN. Secure Enclave's new wrinkle is that most of the process got moved out of the OS into the firmware, not that the architecture of the security system changed.

I am far from an actual CompSci or EE person, so it's probable I'm missing more then a few little wrinkles in this system that are very important to the Slashdot audience, but I think I have abetter handle on the issue then fucking Issa.

Re:yes they should

[Anonymous Coward]

I think the ps2, ps3, xbox 360, etc, etc had "tamper proof" chips and that didn't stop a guy named "bunnie" ... http://hackingthexbox.com/

You know what the smart thing to do in this situation is if you're the government or the nsa? Buy tons of every kind of phone that comes out and break the encryption on each one through hardware hacks/software/whatever so that you get the technique down and automate it. Pretty sure they have enough money, time, and smart people to do this kind of thing.

I don't think this is about setting a "precedent" to make apple build a backdoor. I think this is a kind of ruse to make people think their phones are more secure than they really are.

Re:yes they should

[NicBenjamin]

Why would they have that record? They probably could figure out which set of chips went into this particular batch of iPhones, but that isn't gonna help the FBI much.

And, since the number on the chip can be changed (the way the phone resets itself after 10 wrong PINs is wiping the number, which renders the data on the phone undecryptable garage), even if they could figure out the hardware bit of the decryption key it shipped with that may not be the one the phone was using.

Re: yes they should

[Anonymous Coward]

It's still admissible. Your honor, my client is accused solely because of data they claim was on a phone they destroyed. My client doesn't have a fair opportunity to defend against this evidence and everything else they got from it.

Re: yes they should

[Pseudonym]

I've never been pulled up anywhere for using the term "disk" to describe something that looks like a stick of gum and plugs into the side of a laptop.

Nor have I, and nor would I hyper-correct someone else who did it. But in this very thread, someone had a problem with the suggestion that the iPhone had a "hard drive" in it.

Re:yes they should

[smartr]

The thing is, the hardware UID key is software filesystem key. If you can't see the UID, a brute force attack goes from something like ten thousand posibilities to a septillion possiblities. The software filesystem key is stored in effaceable memory. What makes that memory inaccessible beyond someone failing the normal routine and it getting erased? Here's what the iOS security guide says: https://www.apple.com/business...

The metadata of all files in the file system is encrypted with a random key, which is created when iOS is first installed or when the device is wiped by a user. The file system key is stored in Effaceable Storage. Since it’s stored on the device, this key is not used to maintain the confidentiality of data; instead, it’s designed to be quickly erased on demand (by the user, with the “Erase all content and settings” option, or by a user or administrator issuing a remote wipe command from a mobile device management (MDM) server, Exchange ActiveSync, or iCloud). Erasing the key in this manner renders all files cryptographically inaccessible.

So - if you copy that key - that one key that's, "not used to maintain the confidentiality of the data", then prevent the erasing system from working its magic.

Re: yes they should

[Pseudonym]

Incidentally, people forget that the term "solid state" is to distinguish semiconductor technology from vacuum tubes.

Re:yes they should

[dwywit]

Someone upthread posted that the hardware ID is actually burned (for want of a better word) into the chip during manufacture, and as the phone and the CPU will have their own serial numbers, then such records would be kept, e.g. Phone serial # abc123 has CPU serial # xzy789, with hardware ID abck4e5ur789. I can't imagine why they *wouldn't* keep such information - you'd need it to verify authenticity, warranty, or ownership for some examples. Someone brings an iphone into an Apple store to repair a cracked screen, do you think they're *not* going to check it against the serial numbers of known stolen phones? Or check that it's not a brumby, i.e. some dodgy repairer has substituted the guts of one phone into the enclosure of another, thus presenting a mismatch of serial numbers?

Re: yes they should

[Anonymous Coward]

Disc is typically used to describe a thing that is inserted ... Eg. Compact disc
Disk drive typically describes a fixed disk.

I don't know how widespread that distinction is, but in the game console world they are very particular about the disc part.

Re: yes they should

[ihtoit]

I have two 4GB microdrives (to the IBM definition of "microdrive", which is 43mm36mmx5mm). Haven't plugged 'em in in years. Pretty sure they'd fit and run in any device that accepts CFII...

Re:yes they should

[NicBenjamin]

I've never heard anyone who even sounded vaguely like he knew what he was talking about say he could access "effaceable memory" and get that number out. Plenty who clearly don't (both Issa and John McCaffee come to mind) act like it's trivial, but it just doesn't work like that.

The whole point of the court order is that they can;t stop the erasing system without a signed re-write of iOS from Apple.

Re:yes they should

[NicBenjamin]

First off, why would they keep that particular number? Their entire marketing strategy is based on them not having that number, and numerous other identification codes that have nothing to do with security could be used to tell whether this mainboard was shipped with that display. Use an ID from some other chip on the main board, or ship with a random key, or damn near anything except have a key you can reconstruct yourself.

Secondly, we're don't seem to be talking about the same number.

The way the iPhone locks itself after 10 wrong PINs is it rewrites the number. The dude I'm talking to upthread (and let's see if this little trick actually works in giving you a reference) got this from Apple's site "The metadata of all files in the file system is encrypted with a random key, which is created when iOS is first installed or when the device is wiped by a user."

It's possible that Apple could figure out the key it shipped from the factory. But if the user, or the owner (in this case the County) has ever reinstalled the OS or wiped the phone it would be a totally new key.

Re: yes they should

[CanadianMacFan]

I haven't had the need to try it before but doesn't the phone need to be unlocked for that to work?

Re:yes they should

[clovis]

I could not live with the thought of having as many as 5 digits, so I cut my thumb off.

Re:yes they should

[Wovel]

The FBI Director should be jailed for attempting to conscript a private corporation into law enforcement. The sentence should be doubled for doing so before exhausting every potential avenue within the government.

Re:yes they should

[Wovel]

I am fairly certain changing the operating system would make the evidence similarly dubious.

Re:yes they should

[Wovel]

They need the hardware id of the device which is combined with the pin for the key. The only way to get the hardware device is through a fairly tricky process that could easily destroy the id instead of revealing it.

Re:yes they should

[Wovel]

Wish I hadn't just used all mine :(

Re:yes they should

[Wovel]

Was my post the perfect balance between imbecilic and trollish?

Re:yes they should

[Phoenix Rising]

Ding! We have a winner several zillion posts down the page and buried.

If a software/firmware update can disable the key wipe, then the FBI should be able to bypass it through direct hardware access and copying. The new phones do this all within a secured chip, making it much harder, but the 5c doesn't have that extra hardware protection.

Re:yes they should

[KGIII]

I think I might have thought of a way in (or at least a different way to try) but I'm unsure of the technical details. At some point, there's the chip that sends a message to erase the data or to encrypt it with garbage. That has to travel over some sort of bus. Get a model of the same phone, observe the signal that is sent when that is intentionally done on the second phone, and the interrupt it. This does nothing for the time delay but I'd give even odds that such is overlooked and a simple reboot will start the cycle over again when the limit of 10 is reached.

The signal is sent, if I understand correctly, from a second chip. Interrupt it and don't let it get sent at all. This may not work, not necessarily, I can think of a few kludges in the way but they might not be there - and we've no real way of knowing as we're not Apple engineers. But... It does seem like it's worth trying. The signal may be encrypted itself (can that be found or is it turtles all the way down?), the phone may stop after 10 and a reboot may not reset that - it's hard to tell what it'll do in a failure - there might be a way to interrupt and replay directly at the bus line, and a few other things.

I'd go into more detail but I am soon off for the day. I'll be busy again today. Yay... Go me... Then, I may be off on one of two adventures. Or not... It really depends.

At any rate, someone with more skill than I can think about it further. If successful, I only ask that you not blame me. I don't have a problem with the FBI having the data, not at all. What I do have a problem with is the judge ordering the company to write software. What I do have issue with is the judicial overreach. In the end, I'm hoping the backlash from this results in an unemployed ex-judge but I suspect that's more than I will get.

Those liberties weren't going to erode themselves, it's a good thing we've got judges to help 'em out. :/

Re: yes they should

[TWX]

disc and disk are used to describe a flat cylinder. That's where the terms originated.

Re:yes they should

[Anonymous Coward]

What I do have a problem with is the judge ordering the company to write software.

Oh, it'd be relatively trivial for government programmers to write the software. But Apple would have to release that software source to the government AND their signing code.

Apple does not want to do the former, but probably will because the government is a large enough vendor that I'm sure they've already done it, but the latter, the latter is a sticking point.

So Apple is stuck doing the business.

Re:yes they should

[kriston]

No. The iPhone 5c, the phone in this dispute, doesn't have the "tamperproof chip." That's only in the current generation.

Re:yes they should

[WeezulDK]

No doubt. An 8 digit would have explained the article without using personal pronouns in the third person and then thrown poo at the 7 digit poster....

Re:yes they should

[WeezulDK]

Unicorn!! Uuuuuuuunicorn!!

Re:yes they should

[smartr]

Zdziarski, author of iPhone forensics, seems to suggest it's quite likely a viable technique: http://www.zdziarski.com/blog/...

Directory Comey made another misleading statement – twice – to Congress yesterday; namely that the FBI has attempted every possibility of unlocking the device on their own, and is even willing to accept input from any experts. Quite the contrary, at least three possibilities have come to light that the FBI has not yet explored:

• Imaging the NAND flash of the device and trying ten passcodes at a time; when the device wipes, re-flash the NAND with the original image and try again. This technique is done in kiosks in Chinese malls to upgrade your 16 GB iPhone to 128GB for about $60 US. $60 for ten tries, they could pay retail and still get this done for $60,000.

Re:yes they should

[NicBenjamin]

No shit. Somebody associated with the security community swears up and down that some trivial-sounding idea only he has can actually do this for cheap. Nothing is stopping that guy from buying an iPhone 5c, and proving it. He does that shit on Youtube, and he'll the hero of a fucking generation for making this case go away.

As for "kiosks in China" why would you need 11 tries at the PIN to do that shit? It's your own phone, with the PIN you put on it. I have no doubt they have to do something to replace the Flash storage on a phone, but trying 11 PINs in a row is not one of them.

Re:yes they should

[NicBenjamin]

I don't have an EE, but it seems to me that "Effaceable memory on a FLASH chip" is "chips on the motherboard."

Re:yes they should

[smartr]

I'm not sure it really makes the case go away, it just makes the FBI look really stupid if it works. Be it that he's actually involved in the congressional questioning, I'd say his point is mainly the FBI did not in fact try. I'll throw it out there that the Chinese hardware was probably fabricated at an Apple factory... There's not much legal about copying that hardware... Nor is he really claiming it's something he's the only one coming up with it. While there's literally no nuance in this source article, you'd still have to buy yourself an extra iPhone or two and then plan a trip to China, for the primary purpose of pissing off the FBI... and Apple... There's no heroics involved.

Re:yes they should

[kriston]

The technology that they are describing as the "secure enclave" does not exist on the iPhone used by the shooter, which is a software-only solution that relies on an ID number embedded in the CPU.

Re:yes they should

[NicBenjamin]

What have I said that isn't a description of the effaceable memory Apple has put on the 5c? It's in Flash. Flash is not a hard disk. It is not papyrus. It is a chip on the motherboard.

It's designed so that you don't get the decryption key for the hardware on a copy, and you can't just back it up to iCloud, restore the backup to 100 iPhone 5cs, and try 10 PINs on each.

Re:yes they should

[NicBenjamin]

Yes it makes the case go away.

Under the All Writs Act if someone, literally anyone in the entire universe, besides the company served the Writ can do the job then the Writ is invalid due to a lack of Proximity. Since everyone involved swears up and down that Apple's system is unhackable without a new version of iOS signed by Apple*, they're arguing the other half of the test (that it's an Undue Burden to force Apple to comply with the Writ), along with a lot of political bullshit the Judge is officially not supposed to care about (ie: that the investigation is of a horrendous crime, that the victim's relatives who have taken a side are siding with Apple, etc.).

So if this guy is not talking out of his ass because it sounds good, he can single-handedly make himself the most popular security guy in the Valley for the price of a plane ticket and a 5c.

Since he's not doing that, I suspect he's quite wrong about the number of PINs that get tried in these kiosks.

*Strictly speaking Apple does make an argument against proximity, but it's firmly in the tradition of "we've got lawyers, let's waste everyone's time just in case this stupid shit works," not in the tradition of arguing the actual law.

Re: yes they should

[Anonymous Coward]

For the love of Zeus, people, try to get this thru your heads. When you exceed the ten tries, the phone doesn't do ANYTHING to the data on the phone. It simply changes the saved encrytion key. The data is still there, but the original key no longer exists, so at that point the data is just random gibberish. Nothing is "wiped", "formatted" or "burned"! The data is now inaccessible because brute forcing the key you don't have is computationally infeasible.

Re: yes they should

[Anonymous Coward]

The nsa was the brain that helped create aes-256 in the first place.

Re: yes they should

[Anonymous Coward]

The key is generated randomly when the os is installed or the flash is "wiped".. It isnt burned into anything, as that would make it impossible to change. Use your head.

Re: yes they should

[dgatwood]

Assuming I understand the hardware correctly, you're conflating two unrelated keys:

• The disk encryption key is generated whenever the OS is installed or the flash is "wiped", as you say. On 5c and earlier, this is stored on the flash part; on 5s and later it is stored in a separate coprocessor (secure enclave).
• The device hardware key (device ID) consists of 256 physical fuses inside the CPU. These fuses are burned out randomly during the manufacturing process, and cannot be read externally except by part of the CPU while using it to encrypt other data.

When the disk is decrypted, your passcode is entangled with that permanent hardware key, and used to decrypt the disk encryption key. This means that having the data from the flash part is insufficient because you don't have that 256-bit hardware key. However, the 256-bit hardware key cannot change, because it consists of physical fuses. Therefore, if you externally copy the data from the flash parts and restore it, or otherwise mimic writes temporarily, then you're effectively preventing the device from being able to wipe the disk encryption key after n unsuccessful attempts, so the next time it boots after you restore the flash data, you'll have another n tries to guess the password.

That attack probably won't work with the 5s, of course, because of the coprocessor/secure enclave, but that doesn't apply when you're talking about the 5c.

Seems like...

[__aaclcg7560]

Someone is confusing the iPhone with the iPod Classic.

Re:Seems like...

[dsmatthews9379]

No, he is right, it can be done, the hard part is virtualising the entire phone in the first place, once you have done that you can crack it in milliseconds by running a thousand virtual copies in parallel.

So how do you virtualise a piece of computer hardware? With a form of diffraction tomography using a coherent light-source such as a synchrotron. The only problem is you need very smart people with very expensive gear to do it and that costs a hell of a lot of money that the FBI should not have to waste just because some company does not want to cooperate and hasten the inevitable. Once the iPhone is virtualised doing it for any device they (FBI) physically seize will become a lot cheaper and easier, the first one of anything always cost a lot. Can Apple protect their chips from this method? No, the tomography can operate in a room with less than the normal background radiation levels and be so weak as to go undetected by self destruction devices incorporated onto the silicon, because they need to be able to go though an airport x-ray scanner without self destructing too. The conceptual flaw in Apple device security is essentially that they are relying on a form of 'Security by Obscurity" because they think that people cant see inside the chips and watch the data and address lines operating, and they really should know better than to do that.

BTW Welcome to ten years ago. :-)

Re:Seems like...

[__aaclcg7560]

BTW Welcome to ten years ago. :-)

I was referring to the "hard drive" comment, which the iPhone doesn't have but the iPod Classic used to have.

It's not about the phone... or the crime

[Anonymous Coward]

They certainly use these to their advantage, I mean c'mon, big murder spree gotta get on that phone! KEEP U SAFE FROM NUTJOBS

Oh please, oh please, general public / corporate America, give us the keys to the castle, we promise to be very very careful with them

Re:It's not about the phone... or the crime

[halivar]

In this case, the suggestion is (perhaps accidentally) correct in that it is the FBI's job to discover evidence in their own possession, not Apple's. The burden of cracking the phone should be on the agency.

Re:It's not about the phone... or the crime

[Dcnjoe60]

In this case, the suggestion is (perhaps accidentally) correct in that it is the FBI's job to discover evidence in their own possession, not Apple's. The burden of cracking the phone should be on the agency.

Isn't that what they are trying to do (not that I'm saying they are in the right, here). They are trying to get to the data on the phone. They aren't asking Apple to decrypt the evidence, just to keep the phone from erasing the evidence.

Re:It's not about the phone... or the crime

[TapeCutter]

The court has ordered Apple to write a piece of software that Apple claims does not exist. Apple claim they can write the software but are refusing to do so because they consider such a tool to be "digital cancer". The legal argument appears to boil down to the definition of "reasonable burden", ie: is it reasonable to burden Apple with writing a piece of software that they claim would significantly damage their commercial reputation?

The court seems to be in a position of weighing up which of two things are more 'valuable', the unknown future value of the information vs the unknown future loss to Apple.

Re:It's not about the phone... or the crime

[Dcnjoe60]

The court has ordered Apple to write a piece of software that Apple claims does not exist. Apple claim they can write the software but are refusing to do so because they consider such a tool to be "digital cancer". The legal argument appears to boil down to the definition of "reasonable burden", ie: is it reasonable to burden Apple with writing a piece of software that they claim would significantly damage their commercial reputation?

The court seems to be in a position of weighing up which of two things are more 'valuable', the unknown future value of the information vs the unknown future loss to Apple.

But, is not the piece of code in question to stop the phone from erasing itself after 10 failed password attempts versus actually decrypting the data? It is hard to see the ability to disable auto-erase, when ordered to do so by a court of law is going to be a digital cancer. It is more likely that their approach to this is that it will spur Congress both in the US and elsewhere to prohibit encryption on such devices. Then we all lose.

Re: It's not about the phone... or the crime

[Anonymous Coward]

They lost the moral high ground when they advertised this as a device to defeat law enforcement agencies. The shit upon it when they quietly caved to the Chinese government and did what was asked here.

This guy over here....

[wkwilley2]

This guy's so far behind the times, he thinks an Iphone has a hard drive in it.

Re:This guy over here....

[theCzechGuy]

He's still ahead of FBI.

Re:This guy over here....

[Anonymous Coward]

It still has a flash chip that conceptually is the same. You can still read every binary 1 and 0 off it to get a copy of the original, since the encryption/decryption is handled in software. The only issue with doing that is they don't have the 256bit AES encryption key and don't have the computing power to brute force that.
Likely you'll see in the next iPhone that the secure enclave gives the AES key directly to the chip not to the operating system to prevent you doing that without popping the top of the chip and looking at it under an electron microscope.

Re:This guy over here....

[DigiShaman]

I'll give the benefit of the doubt that he's using the word hard drive interchangeably with storage. Now, if he actually thought he could pull the platters apart vs pulling data off with a cable or a manual flash chip migration to a breadboard, then yes, he's a fucking moron.

Re:This guy over here....

[Znork]

Are they actually serious? I assumed this was the way that it was always done; for as long as I can remember it's always been pointed out that self-destruct traps are essentially pointless as no serious attacker would be so grossly incompetent that they'd try to break into the original.

For things like rubber hose protection you'd use plausible deniability material instead where the 'wrong' password reveals something somewhat embarrassing but fairly innocent, so they basically can't tell if there's anything more available. Destroying the contents instead merely means you gave them the wrong code and they know there's a right one and they still have the next copy and can beat you with the rubber hose until you give them one that unlocks it.

If the FBI is actually working with the original there needs to be some serious firing done...

Re:This guy over here....

[Nutria]

then yes, he would be a fucking moron.

FTFY.

Re:This guy over here....

[halivar]

He called it a hard-drive, not a hard-disk. Honestly, we're splitting hairs about shit literally no one that does not frequent technology blogs gives a crap about. This is especially true because the HDD/SSD distinction has no bearing on the merits of his suggestion.

Re:This guy over here....

[ImprovOmega]

The iPhone's flash drive is encrypted. The key is securely stored. If you guess the lock code incorrectly 10 times then it's not the hard drive that's erased, it's the key that is irrevocably destroyed. At that point it doesn't matter if you have a bunch of copies of the disk, you have a bunch of garbage and the only key in the universe was just wiped out.

Re:This guy over here....

[Big Hairy Ian]

And now thanks to Apple & Android everyone seems to think Ram and Storage are the same :|

Re:This guy over here....

[mrchaotica]

Are they actually serious? I assumed this was the way that it was always done; for as long as I can remember it's always been pointed out that self-destruct traps are essentially pointless as no serious attacker would be so grossly incompetent that they'd try to break into the original.

The difference is that on iPhones, Apple has managed to design the system in such a way that breaking into the original is the only practical choice. I mean, they can make a copy, but that means they have to copy the code hard-wired into the encryption chip, not just the data in the flash. To copy that chip, they have to very carefully physically disassemble it with acid and lasers, and then examine the circuits with an electron microscope.

And if they care that damn much then that's exactly what they should do, not force Apple to create a tool to allow the FBI subvert everybody else's security at-will.

Re:This guy over here....

[Anonymous Coward]

Yeah, and you're so far behind the times that you have not realized that the proper spelling is iPhone.

That point isn't to correct your spelling, it's to point out that Issa not using correct terminology at that particular moment does not undercut his point. He obviously understands there is storage media inside. (Which sad to say, is actually somewhat positive considering the extraordinary lack of technology knowledge in Congress.)

Re:This guy over here....

[BigBuckHunter]

Most of us realize he's speaking of the Hynix NAND flash chip.

Someone with domain knowledge, please correct me:

My understanding is that the NAND/Flash is protected by strong encryption and is not easily hackable. The PIN unlocks the key for the NAND device, and if the PIN is incorrect 10 times, the key is deleted (not the NAND contents).

Re:This guy over here....

[MachineShedFred]

Well, the trick (as I understand it) is that the phone uses the CPU's internal UID as part of the AES-256 key, ensuring that all cracking attempts must be done on that phone. There's no way to read the UID out of the CPU without extreme measures.

Re:This guy over here....

[Anonymous Coward]

Why does this shit still get modded insightful? It's basically half-hearted trolling. Or stupidity... It could definitely be stupidity.

Re:This guy over here....

[Anonymous Coward]

just because you're a pedantic ass doesn't actually mean he's behind the times. Calling it a hard drive successfully conveys he's talking about persistent storage. Just to annoy you, I'm going to start calling trojans viruses.

Re:This guy over here....

[mitcheli]

This got me thinking. If you were to load the flash drive into a VM with rollback capabilities, it could be conceivably possible to hack the phone at near real time. Just rollback the image after each failed attempt until you have a success. Might not be as fast as hammering it with a brute force attack (minus delays) like their asking, but as long as the rollback could occur in a short enough period of time, you'd avoid the protections Apple put in place. Just a thought.

Re:This guy over here....

[Anonymous Coward]

if he actually thought he could pull the platters apart

Apparently you are the Jon Snow of digital forensics.

Re:This guy over here....

[Anonymous Coward]

it's very unlikely the secure enclave would allow to receive thousands of queries in parallel and process them in parallel. It all likelyhood, it process things one by one, with delay between queries (specially failing) at the hardware level.

Re:This guy over here....

[SecurityGuy]

I disagree. It's a pretty concrete example that he has no idea what he's talking about. It's handy to know when someone has their incompetence bit set so we can skip the rest of their argument.

Re:This guy over here....

[mitcheli]

I'm aware of that. Whose to say that the secure enclave can't be incorporated into the VM solution so that the group key and device key is made available to the simulated environment? From that point forward, the passcode / rollback technique should work fine. I don't recall there being a direct coorelation between the secure enclave and the software cycle outside of the crypto. That shouldn't be affected by a rollback (barring that doesn't cross OS versions that is).

Re:This guy over here....

[Anonymous Coward]

they always have

Re:This guy over here....

[Tinsoldier314]

I frequent technology blogs and I literally do not give a crap about it.

Re:This guy over here....

[halivar]

Except the rest of his suggestion still holds, so in this case your stupid-bit-check yields too many false positives to be of any actual use.

Re:This guy over here....

[Bob the Super Hamste]

You must be new here. I remember back in the 90s hearing people saying "My computer says it is out of memory but I have XX free MB on the hard drive". Then there was my personal favorite where they would call refer to the case as the CPU or hard drive.

Re:This guy over here....

[radarskiy]

There's no way to get the key out of the physical secure enclave and into the VM's secure enclave. If there was, you wouldn't need the VM, since you'd have the key.

Re:This guy over here....

[Xenna]

"not force Apple to create a tool to allow the FBI subvert everybody else's security at-will."

If I understand correctly they want Apple to use their signing key to 'update' the phone's software with a version that doesn't delete the encryption key after 20 attempts.

How does that make other iphones less secure?

Re:This guy over here....

[HornWumpus]

Now the feds have a signed image they can load onto any iPhone and crack it without even talking to a judge.

Re: This guy over here....

[Anonymous Coward]

Not viruses, call 'em virii. Go for broke.

Re:This guy over here....

[kimvette]

The idea is telling a government "no" so no precedent is set. This is important as recent history shows that the FBI, NSA, TSA, etc. don't give a flying fuck about legality when it comes to their actions, and you know once they have that precedent set they will proceed with blanket surveillance, "for security." They've been regarding 1984 as an instruction manual rather than a warning.... and The People have been likewise regarding "Idiocracy" as an instruction manual rather than a warning.

Re:This guy over here....

[Pseudonym]

Not quite. The FBI probably wouldn't be allowed to retain a copy of this signed image, which would stay with Apple. (I'm sure that the NSA and the Chinese Ministry of State Security would manage to obtain a copy, though...)

The problem is that once it exists, courts would start compelling its use. Remember, this is the 13th time that law enforcement agencies have tried to compel Apple to break into a phone.

Anti-terrorism tools have this way of being used against-non-terrorists. How long before someone tries to get it used in a corporate law case? Or a divorce case?

Re:This guy over here....

[Xenna]

Sure, it would be a precedent. But the courts can already order a house search or access to your gmail account (heck, even mine and I'm not even an American) or the key to the iCloud servers. That's generally accepted.

It would be much more interesting to see if they could stop Apple from creating a device that even they themselves couldn't crack. The 20 times and you're out check could be done inside the hardware chip.

As far as Apple is concerned I'm sure they're milking it for all the publicity value that's in it.

Re:This guy over here....

[Xenna]

That precedent's already been set ages ago hasn't it? How is searching your phone different from searching your house or vault or mail account or tapping your phone or internet connection?

Re:This guy over here....

[HornWumpus]

Because you trust the feds not to keep a copy?

How do you expect them to load the image onto the phone they hold without having access?

They will certainly keep a copy, no matter what any agreement says. They are the FBI, who is going to arrest them?

Apple and all other manufacturers should simply make all devices not take updates when locked.

Re:This guy over here....

[mrchaotica]

Whose to say that the secure enclave can't be incorporated into the VM solution so that the group key and device key is made available to the simulated environment?

You can implement the logic of the secure enclave in a VM all you want, but you still need the secret, individually-unique number burned into the chip during manufacture if you want it to be able to decrypt anything previously encrypted with the same number. It's the same reason just transplanting the flash into a different real iPhone wouldn't work.

Re:This guy over here....

[Anonymous Coward]

>The FBI probably wouldn't be allowed to retain a copy

I LAUGH at you. You are either charmingly naive or incredibly stupid if you think either the gov't won't use this or that it won't get leaked.

Read up on INSLAW, CONITELPRO, and so many too many instances of the FBI etc. doing just exactly as they please and screwing the target audience du jour.

Re:This guy over here....

[Anonymous Coward]

"Get a warrant, search my phone" is not the same as "force a manufacturer to build SW that invalidates security for an entire range of devices", especially when the FBI created this problem in the first place by doing what Apple told them what NOT TO DO.

Get a warrant. Fine.

Make millions of phones government hackable because you are technically incompetent and make us cross our fingers hoping that our perfect world of Unicorns and Rainbows will keep bad people from abusing this backdoor? Go get BENT.

If you can't see the difference and understand the danger, please say so here and we'll try again to explain this.

Re:This guy over here....

[Pseudonym]

Because you trust the feds not to keep a copy?

In the long-term, no. In the short-term, I think they'll find it easier on their conscience just to abuse the hell out of parallel construction.

Re:This guy over here....

[CanadianMacFan]

It's time you left the basement and started interacting with some real people. Non-technical people have always confused the two and some technical people have also.

Re:This guy over here....

[kimvette]

He's too busy watching the latest episode of "Ow my balls!" after having come in from a long day of irrigating his barren garden with Brawndo.

I didn't know iPhones had a

[Anonymous Coward]

"hard drive"???

Re:I didn't know iPhones had a

[Anonymous Coward]

Solid state is about as hard as you can get.

Re:I didn't know iPhones had a

[TapeCutter]

"hard drive"???

Brisbane to Darwin in the wet season.

Good for Issa

[Anonymous Coward]

At least someone is thinking out of the box. In the face of a recalcitrant Apple, disassemble the phone, analyze the parts. Identify the murder's accomplices.

Approach may work

[Anonymous Coward]

Well duh the approach may work, which is one of the reasons the All Writs Act shouldn't apply (it is only supposed to be used when Apple's help is necessary, not 'necessary for how we feel like doing it'). But the goal of the FBI is not, and has never been, to actually get into the phone. The FBI's goal all along has been to use this as ammunition to press Congress for mandated backdoors and/or more funding for their 'cybercrime' division.

You can bet your ass the NSA already HAS a copy and is either actively brute forcing it, or has already done so. But they'll never publicly admit to it, because doing so will expose too much of their capability.

Also, in terms of the Cloud Backup approach, it should be a relatively simple matter to hook the phone up to a custom network which mimicks the iCloud server, and they would know immediately if the phone is even trying to backup to it or not. If it is, it's also relatively simple for the Cloud instance to just accept whatever password hash the phone sends.

How Long Have You Got

[lazarus]

“I can tell you from the Department of Justice perspective, if that drive is encrypted, you’re done,” Ovie Carroll, director of the cyber-crime lab at the Computer Crime and Intellectual Property Section in the Department of Justice, said during his keynote address at the DFRWS computer forensics conference in Washington, D.C., last Monday. “When conducting criminal investigations, if you pull the power on a drive that is whole-disk encrypted you have lost any chance of recovering that data.”

From: The iPhone Has Passed a Key Security Threshold

I'm sure a politician knows more about crypto than MIT or the DoJ.

Re:How Long Have You Got

[Anonymous Coward]

It all depends on password strength. If it is based on a PIN number (4 digits), then it is of course very very easy to brute force decryption. If it is based on finger print, it is even easier: a finger print is 1 digit only! /ducks

Re: How Long Have You Got

[Anonymous Coward]

I believe it goes MIT > FBI > Politician > McAfee.

Re:How Long Have You Got

[Anonymous Coward]

A good pun is its own reword.

Re:How Long Have You Got

[Anonymous Coward]

Nice Pun, but I made the same mistake about PINs as you did. I was informed that the 4-6 digit PIN is then combined with a secret value known only to the encryption chip in order to create the secret key.
This pulling out the physical media and writing your own brute forcing program to go through pins is useless in new iPhones, since you don't know the secret key since you don't know which 10000-1000000 keys of the subspace of all keys correspond to the PIN numbers.

That said, there is a vulnerability in that particular iPhone, in that the password throttling is not built in onto the chip, but rather done through the Operating System. So, in essence, what Issa is suggesting is a hack that indeed may be possible. It wont do any good against newer iPhones though.

Re:How Long Have You Got

[halivar]

Whilst a bad pun is its own pun...ishment.

Re:How Long Have You Got

[Anonymous Coward]

The FBI already has everyone's fingerprints so I'm sure they're overjoyed about the cheap fingerprint unlockers on phones.

Re:How Long Have You Got

[RivenAleem]

I have a digital image to share with you.

Re:How Long Have You Got

[Hognoxious]

You lost me. Try explaining it with Alice trying to steal Bob's car.

Copyedit summary please???

[davidwr]

try unlocking mass shooter Syed Rizwan Farook

Good luck unlocking a dead man.

Re: Copyedit summary please???

[Anonymous Coward]

It's not legal in most jurisdictions, but some folks love to crack open a cold one. I heard Director Comey is into that sort of thing. -PCP

Re:Copyedit summary please???

[myowntrueself]

try unlocking mass shooter Syed Rizwan Farook

Good luck unlocking a dead man.

You'd think they would have preserved his fingers...

Re:Copyedit summary please???

[Anonymous Coward]

except the phone was iPhone 5c, which does not have fingerprint scanner

Still beating the dead horse

[BerneAI]

...and now it is coming to light that the reason the FBI needs Apple's help is because they screwed it up in the first place trying to reset the password...Apple should be "recalcitrant" and be very stubborn about letting the government into the house.

Cooperate

[Anonymous Coward]

I don't get it. Why don't they just ask the NSA for the key to the backdoor?

Oh. They probably did, but the NSA is never such a thing exists, and especially not to the FBI.
So until further notice, only Chinese and Russian hackers will have access to those back doors.

Re:Cooperate

[Anonymous Coward]

Sabotage, this early in the discussion? ;)
I could have sworn the words "going to admit" followed right after "NSA" in that post.

Yes, yes they should...

[Anonymous Coward]

They certainly should try that.

Now, Rep. Issa, can I make some laws? It can't be too hard to do. You certainly sound like you feel qualified to sound off about forensic technology issues, so I should have the privilege of feeling qualified to sound off about lawmaking.

Re:Yes, yes they should...

[MachineShedFred]

You do know that you actually can make laws, right? It's a citizen government, where you can run for office, or even go through the process of getting a ballot measure passed.

Re:Yes, yes they should...

[Anonymous Coward]

You do know that you actually can make laws, right? It's a citizen government, where you can run for office, or even go through the process of getting a ballot measure passed.

If you have a couple of million/billion dollars to spare and/or enough of the right friends. Preferably in one or the other major political parties.

Otherwise, good luck - you'll need it!

Re:Yes, yes they should...

[Overzeetop]

So, pretty much about as easy as decrypting an iPhone without the key.

Re:Yes, yes they should...

[clodney]

You do know that you actually can make laws, right? It's a citizen government, where you can run for office, or even go through the process of getting a ballot measure passed.

If you have a couple of million/billion dollars to spare and/or enough of the right friends. Preferably in one or the other major political parties.

Otherwise, good luck - you'll need it!

Here is how it works. You run for something local, like city council or school board. You show up at party functions to become a member of a party, and gain credibility within the party. You develop a name for yourself so that when you want to run for state office people have heard of you and you seem like a reasonable candidate.

Then you start thinking about running for a national office.

If you have millions of your own money or friends willing to fund you you can skip some of those steps, but if you go the usual route you don't need to be a millionaire.

And why should it be different? Do you hire somebody with no experience to be an architect or senior engineer, just because they have strong opinions on how things should be done? Why would I vote for your for Congress or President if you haven't shown me you can perform well at a lower level office? Why wouldn't I think that you are likely to be a single issue crank that has one hot button issue that has you all worked up, and zero interest in the rest of the mechanism of being a legislator?

Re:Yes, yes they should...

[HornWumpus]

They won't even consider letting you run for state office until the party has a _large_ pile of dirt on you.

Enough that you'd suicide before turning on them.

Think about what it takes to keep this kind of large conspiracy somewhat secret.

It's not by accident that we have no competent politicians. It's only partly explained by the fact that decent people don't want the job.

Re:Yes, yes they should...

[clodney]

Think about what it takes to keep this kind of large conspiracy somewhat secret.

Which is precisely why I don't believe that there is a conspiracy.

Re:Yes, yes they should...

[HornWumpus]

Did I say conspiracy? I meant 'self serving group of crooks that understand they have to maintain the fiction'. There just isn't one word for that.

Of course eventually one that has enough dirt on others will be about to be indicted...Hillary's health might take a decline in the near future.

As to long term conspiracies. My example is all the boy rapers in the English parliament that covered for each other for decades. Also the alter boy rapers. In every case the key is mutual dirt. You don't think the Ratsinger would have covered for the rapists unless he was equally dirty, do you?

Re:Yes, yes they should...

[TapeCutter]

Nice conspiracy theory, it neatly explains why a candidate often appears to represent the views of their party but how does it explain the fact that Trump is still breathing?

IMHO the majority of politicians enter politics with good intentions, but as they say, the road to hell is paved with good intentions.

Re:Yes, yes they should...

[HornWumpus]

They MIGHT have had good intentions when they ran for student council in _middle school_. Beyond that; I don't believe it.

Trump is clearly an 'unauthorized' candidate. It happens, they are usually left to their 'purity', not knowing a thing that goes on around them.

Even when practiced by two groups of the worst people on the planet (Ds and Rs) politics remains the 'art of the possible'.

You mean the FBI *has't* tried

[Nutria]

cracking an image of the "hard" drive (both via social engineering and brute force)? What kind of incompetent dunderheads are they???

Or is the Conspiracy Theory that this is really a trojan horse for greater federal power not actually a Conspiracy Theory?

Re:You mean the FBI *has't* tried

[ImprovOmega]

It's not that simple. The drive isn't protected by a passcode, the *decryption key* is protected by a passcode. The drive is protected by encryption. Without the key it's basically just a bunch of random gibberish.

Re:You mean the FBI *has't* tried

[Nutria]

So figure out the passcode (shouldn't be that hard, since people typically use simple PINs or ones that are meaningful to them) to get the decryption key?

How many times have we been told, "all bets are off once you've got physical control of the h/w"? Well, they've got physical control of the h/w.

Re:You mean the FBI *has't* tried

[Anonymous Coward]

well, it's been at least 10 years since this has stop being valid. Since then we now have hw-encrypted hard drive, tpm, secure enclave...
so I guess ... welcome to 2016.

Re:You mean the FBI *has't* tried

[balbeir]

I bet it's the birth year of Mohammed, in reverse because arabic is RTL !

If I am reading this right..

[Anonymous Coward]

Are they suggesting that the agencies involved try to dump the phone's flash memory to an image file and then try to run many instances of that image in an iPhone simulator (like the one devs use as part of the iPhone devolopment SDK?). If the phone's flash drive is encrypted though I'm not sure if what they dump will even be 'bootable' as a virtual instance.

Any experts care to chime in?

Re:If I am reading this right..

[Vlad_the_Inhaler]

What makes you think they would want to boot it? Reading it is supposed to be what they want to do.
It seems a strange thing to say but John McCafee's comment about the cost of the NSA's backdoor seems to have introduced some sanity into the discussion, who would have thunk it?

Re:If I am reading this right..

[nereid666]

It is not as easy, the iPhone have FIPS 140-2 crypto processor that stores the key, you can not copy that data, and you can not emulate it. Or force attack the secure crytpto processor... I think the aproach of copy the hard disk is not posible, take a look to Apple documentation. https://www.apple.com/business... I am not sure even if is posible to release a new iOs without the retry password and time limits, It shouldn't be possible if the design is well done as it seems.

Re:If I am reading this right..

[HornWumpus]

Does it make it's own clock internally and have a capacitor on Vcc.

Otherwise it's susceptible to voltage and clock glitching. Just like the last generation of sat receiver smart cards.

All you have to do is 16x it's processor clock for the cycle where it's trying to store the 'PIN try count exceeded' flag, or do the same when incrementing the fail count.

Or just burn up one low bit of memory at the address the fail count is stored at.

But all these approaches would ultimately be '1 try'. After you've burned up 100 other iPhones testing.

The FBI want's Apple to update the phone to disable the fail count. What kind of phone takes an update when in a locked state? Apple should fix that.

Darrell Issa

[Anonymous Coward]

Darrell Issa is an idiot, an asshole, a partisan hack, and a bought (through donations) turd.

Sadly, the phone is obviously very vulnerable

[Cafe Alpha]

because the password the user typed can't be long enough to be secure from brute force.

The phone is only "secure" if you can depend on the OS to wipe the phone after 5 bad attempts.

If you can get into the phone's internal flash, it's game over.

Re:Sadly, the phone is obviously very vulnerable

[Anonymous Coward]

because the password the user typed can't be long enough to be secure from brute force.

It can be 37 characters, each one of 77 symbols.
That's somewhere north of 6 e+69 combinations, at 80 mSec per trial.

If your definition of "brute" can handle that, well then you're right.

Re:Sadly, the phone is obviously very vulnerable

[Anonymous Coward]

That's off by default on the iPhone, as is the wipe.

The fact that those two things can be toggled means that Apple can flash the firmware, and they should. Then build their next phone like a BlackBerry that will absolutely wipe (ie, no choice, no flashing will change that) after ten bad tries and has quadrillions of possible password combinations.

Since they've copied every other cool innovation BlackBerry has invented, including 3D Touch, why the heck not? Let the Canadians invent things. We can sell them.

Re:Sadly, the phone is obviously very vulnerable

[Cafe Alpha]

Oh, I thought it was more like a 7 number pin.

But still:
1) no one can remember short secure passwords, because the entropy is too high.
2) You need sentences and that requires more like 300 characters unless you're chinese. So secure is 18 randomly chosen words from a large dictionary with other words stuck in to turn them into sentences.
3) no one is going to type at a little phone screen for 15 minutes every time they want to use it!

Re:Sadly, the phone is obviously very vulnerable

[ihtoit]

what's that, 10^58 years to try 'em all?

I'll wait.

They should do it, but they haven't. Why?

[Anonymous Coward]

The answer is easy. They are not interested in the contents of the terrorist's phone as much as they want a magic key that will unlock anyone's iPhone anywhere. The NSA already has all the metadata from this phone recorded anyway, so the whole alarmist search for the phone's contents is a front for the government's overweening desire to pry into everyone's life.

Re:They should do it, but they haven't. Why?

[Anonymous Coward]

Some have already gone on record that the primary reason is that Law Enforcement should be always allowed to obtain any surviving information by whatever means necessary once they have a warrant.

Considering the expected side-effects a good car analogy would be dropping a hydrogen bomb on a house because it was the only way to crack open a safe inside and get whatever documents it might contain.

Oh, the cars? Vaporized for blocks around.

Re:They should do it, but they haven't. Why?

[mackil]

The answer is easy. They are not interested in the contents of the terrorist's phone as much as they want a magic key that will unlock anyone's iPhone anywhere.

That is it exactly. This is a high profile case. A major terrorist attack on US soil. What better way to convince the public that there NEEDS to be a backdoor on their devices? They aren't going to let this opportunity go to waste.

Re:They should do it, but they haven't. Why?

[Anonymous Coward]

Where's the Paul family when we actually need them?

Re:They should do it, but they haven't. Why?

[clodney]

That is it exactly. This is a high profile case. A major terrorist attack on US soil.

I will probably go to hell for saying this, and I mean no disrepect to anyone affected by the San Bernadino shootings, but I quibble with "A major terrorist attack on US soil". This was two people with easily available weapons which can be had at thousands of locations throughout the US. If the "major terrorist attack" bar is set that low, we can never be safe from terrorism, since literally any two people in the country might be terrorists. The 9/11 attacks were definitely a major attack. McVeigh blowing up the federal building in Oklahoma City was a major attack. One or two people shooting up a workplace is a tragedy, but hardly an existential threat. It captures the imagination and makes people nervous, but in terms of impact on the country as a whole it is nothing.

We need to acknowledge terrorism as an ongoing threat to be managed, like gangs, or drunk drivers, not as a war to be won.

Re:They should do it, but they haven't. Why?

[TapeCutter]

Spot on, ISIS et-al want us to view it as a war against Islam since that automatically gives them a billion plus foot soldiers. They will happily claim any random act that fits their MO as an act of martyrdom for their cause. We had the same here in Sydney when a random nut with an ISIS flag held people in a coffee shop hostage for a few hours while the cops worked out how to kill him. By claiming these random nutters as their own agents, ISIS are elevating ordinary muslims as a threat, the backlash on muslims just creates more foot soldiers for their cause.

The IRA was (in large part) defeated because the government of the day realised that treating terrorists as common criminals is far more effective at reducing violence than waging war against an ideology or political grudge. It was also a deliberate decision on the part of the Irish and UK governments to allow the political wing of the IRA to remain intact and included in society provided the military arm was disavowed and defunded.

US culture strongly supports the notion that guns solve problems, and thus bigger guns solve bigger problems, so there is little political will to back down from a "war against X" once it has been (informally) declared.

Re:They should do it, but they haven't. Why?

[hambone142]

Why not just work with Apple to extract the data image from this single phone without forcing Apple to reveal how they did it?

If all they want is the data on the phone, let Apple get it for them and hand over a decrypted image to the FBI.

Oh... that's not really what they want. They want the key to the back door for an entire class of phones I must suppose.

What makes you think they haven't

[Anonymous Coward]

The entire purpose of the FBI even discussing anything is to establish legal precedent. They already know there is something on the phone they want to be allowed to use in court. They already know what is on the phone, and Apple "standing up to the FBI" is just marketing so you will buy more backdoored devices from Apple.

I'm disappointed with Slashdot -

[pecosdave]

it's a forum full of geeks.

A forum full of geeks knows it's not that hard to break into an iPhone and this is nothing but a political maneuver.

I've stated before John McAffee is calling out the obviousness of the situation, but just like all the other political stuff that creeps across the site the modern Slashdot feels the need to prop up the political agenda despite the obvious answers staring us right in the face.

Re:I'm disappointed with Slashdot -

[TapeCutter]

Yes slashdot is full of geeks, there are a couple of posts on here that succinctly explain why McAfee is full of shit in a technical sense. Essentially, the key they need is burnt into the chip, it can't be electronically copied because it is not in memory. None of that is denying the court action and the media circus appears to be a power grab by the FBI, and it's also not beyond the realms of possibility that the FBI genuinely believe they are "doing the right thing"..

Comment removed

[account_deleted]

Comment removed based on user account deletion

I have difficulty beleiving...

[rshol]

...that the NSA or some other US intelligence agency cannot/has not cracked this phone. What I find more believable is that they have the information and they want to force Apple to crack the phone to protect their methods and knowledge of their access. If they win the get the bonus of sticking it to Apple and get a precedent they can use in other cases.

this whole thing is fishy to me

[argStyopa]

What I fundamentally don't understand is this:

EITHER
a) if this is GENUINELY a mattter of national security, the FBI could actually hand the phone to the NSA and get the information in about 30 seconds but for some reason isn't doing so, or
b) the NSA's upteen-gajillion-dollar "black" budget has pretty much enabled them to record/analyze/store only the utterly banal unencrypted conversations that you could hear just sitting and listening to the guy next to you at the coffeeshop, ie almost entirely wasted on stupid crap.

I don't see really any other alternative.

I'd expect, for example, that Russian and Chinese government communications are ROUTINELY of a higher level of encryption than the bloody iPhone you can buy at the mall, and yet the NSA's *job* is to listen in on that stuff and they claim that they're pretty damned good at it?

Re:this whole thing is fishy to me

[Jason Levine]

That's because the real situation is:

c) The FBI wants Apple (and other phone manufacturers) to give them backdoor access. So far, phone manufacturers have resisted this. So the FBI is using this high profile case relating to terrorism (that "scary word" that all too often gives politicians root access to do anything they want) to set a precedent. If it goes according to the FBI's plan, then Apple will be forced to help them unlock this one phone. Then another phone will need to be unlocked and the precedent will already be set. Eventually, the list of crimes requiring Apple to unlock and the number of agencies able to request an unlock will grow until the local police department can have your phone unlocked because you were speeding. At some point, Apple will be forced by sheer volume to just include a backdoor so the FBI (and other law enforcement agencies) can get in without their requests getting in line at Apple behind all the other ones.

THAT is their end game. They are using this to get their foot in the door and then they'll push for more and more until our security (via encryption) is gone to help ensure our "security" (as in security theater... also known as power trip by those in law enforcement).

Re:this whole thing is fishy to me

[Xylantiel]

What's going on is the FBI wants a precedent (and a firmware) that they can make apple use in other non-national-security cases. I have the viewpoint that if Apple didn't want to be subject to this, they should have designed the handset so that they couldn't "help" unlock it. The only reason Apple can resist in this case without getting killed in the press is that it is very unlikely that there is valuable data on this handset. (It's the gunman's work phone; he destroyed his personal phone.)

Re:this whole thing is fishy to me

[Anonymous Coward]

Yes. The NSA are the good guys. Snowden is a tr8tor. He is as much a tr8tor as the FBI who's job is to fore and coerce private companies and individuals to give up their freedom. Every citizen locked away is costing the paying tax payers 200 USD. All that money is going to further the efforts of the FBI and the elite share holders who own stock in the prison corporation of the americas.

Law enforcement tickets people for not wearing a safety belt and abducts kids from parents who dare to allow their kids to walk to school. The NSA and the military kill terrorist without sending them to be tried by highly paid lawyers. There is a difference.

FBI bad. NSA good.

The law is criminal. We need less law and more justice.
Why worry about GITMO, when 1% of the citizens are locked away in USAian prisons to ensure the profit of the elite.

Re:this whole thing is fishy to me

[Anonymous Coward]

c) This isn't actually about the data on the phone, but the legal precedent of getting Apple to break their own security.

Re:this whole thing is fishy to me

[HornWumpus]

And it should bite them in the ass. When apple makes future versions not take updates when in a locked state.

Re:this whole thing is fishy to me

[ihtoit]

c) They tried the same thing with RIM. What saved RIM was a small incident on the Eastern Seaboard in the back end of 2001 which basically rendered all mobile voice and text networks useless as they couldn't handle the traffic - with the sole exception of the Blackberry network.

They're just digital safes

[Anonymous Coward]

The Government has been demanding access to safes from various companies for a long time.
If Apple designed their phone so that you would need a new version of the OS instead of a simple key to access the safe, well, that was Apple's decision and their problem.
The Government can, and should, have court ordered access to these digital safes as well.

Never fail to leverage a crisis

[Anonymous Coward]

The FBI is attempting to portray this as a crisis and the overriding rule of any security agency is, "Never fail to leverage a crisis."

Because it's terr'ists. Never mind that the terr'ists are dead and the crisis is long over. Never mind that they already have the metadata from the phone calls to Africa. Never mind that the FBI's ability to extradite any presumed terr'ists from Africa is likely zero. Never mind that there's a decent chance there is nothing criminal or relevant on that phone whatsoever.

Thus, the FBI is leveraging a dead crisis. In so doing they get Apple to create a magical phone unlocking tool and the FBI gets it for free. Never mind that in so doing, the FBI measurably and indisputably reduces security for all of the rest of us. Never mind that the FBI cannot lawfully coerce a company to perform the work that the FBI itself is supposed to be doing. Never mind that endless expansion of the phone cracking capability is inevitable.

Because terr'ists. Oh, and get ready for yet another expanded budget request from the FBI. They need it to hire the fleets of lawyers they need on their quixotic quest to save the nation by making all it's citizens vulnerable. You know, to criminals, fraud artists, that fake Nigerian prince with the $10 million dollars they just need to park in your bank account for a day, the Russian and Chinese hackers, Anonymous, etc. And the terr'ists!

The FBI needs to understand that security is a fundamental need. Our security systems get compromised every day, so what the nation needs is attention paid to security. Not yet another mechanism by which security can be trivially bypassed by every L33T Haxor with a grudge, a dubious mission, or a need to fill their own bank account with the contents of yours.

Oh wait, this is the FBI. They already understand that. They just don't care. Because terr'ists.

DMCA?

[Anonymous Coward]

Obviously none of our laws apply to law enforcement, so sure, go right ahead - and while you're at it tell the government that the constitution is meaningless - they can trample any right they like at any time for anyone.

Re:DMCA?

[Dcnjoe60]

Obviously none of our laws apply to law enforcement, so sure, go right ahead - and while you're at it tell the government that the constitution is meaningless - they can trample any right they like at any time for anyone.

Just the opposite. If the laws didn't apply to law enforcement, then there wouldn't be a court case about this incident. It would already have been unlocked.

Simple test

[Dcnjoe60]

Here is a simple test if you think McAffee is being legit here. Take another iPhone and encrypt it and give it to him and see if he can get the data off of it. Otherwise, talk is cheap, particularly if you know you never will have to make good on it.

Re:Simple test

[pecosdave]

I'm sure he would do that, propose that to him and the FBI - use an "Escrow" phone of the same model with some target data on it placed and encrypted by a third party - not McAfee or any government agency. If he succeeds then let him at it.

Re:Simple test

[Anonymous Coward]

Needs to succeed without destroying the original device. It can't be introduced as evidence if it is destroyed in the process of recovering the data, because the defendant does not have the opportunity to examine the evidence against them.

Re:Simple test

[ihtoit]

gives me an idea for an open competition: someone embeds a message (could be a starting location for a scavenger hunt or even a straight-to-x-marks-the-spot) in a flash chip, encrypted with a 256-bit AES key and stored behind a softwall under the same conditions as you'd find on a locked iphone 5C - hell, embed it on a 5C. Obviously, the first to break the encryption gets the prize.

I'll wait.

Be careful what you ask for....

[Dcnjoe60]

We should all be careful what we ask for. As it stands, right now, for the FBI to gain access to a phone in a criminal investigation, they need to get a court order to have Apple, or whomever unlock it. There is at least some check and balance to government intrusion, albeit small. If Apple succeeds in their appeal, then it is likely that the FBI will develop their own tools to access the data in the future, in which case, they will not need a court order any longer.

If Apple succeeds, this may be a case of winning the battle, but losing the war.

"Car-Alarm Entrepreneur"?

[SeaFox]

Representative Darrell Issa, a California Republican and former car-alarm entrepreneur...

I'm assuming there's a lot more to him. Because reading sentences like that makes me think California gets too many congressional seats if they give them to people who seem to have so little background in law or government.

Re:"Car-Alarm Entrepreneur"?

[Anonymous Coward]

Money Talks, Bullshit Walks

Re:"Car-Alarm Entrepreneur"?

[Wovel]

Issa is not a great example for this, but we would all be much better off if people in congress had a lot less experience in law and government and a lot more experience doing other stuff.

Problem solved

[Wargames]

Find surveilance of the guy unlocking his phone in public. Problem solved!

DMCA

[Anonymous Coward]

The FBI would then be violating the DMCA, and Apple could sue them.

Re:This guy above me....

[TapeCutter]

...deserves an informative mod, unfortunately I have none to give.

Issa ~ Idiot

[just someone]

When you see Issa, think car thief gone bad...

the Case is a modem

[Dareth]

My wife is a teacher. Other teachers were always calling the case/tower a modem. Even when the computer didn't have a modem in it I heard this again and again. I didn't understand why until one day I was in the "teacher store" with my wife getting supplies. There was an "educational" poster about computers and it had the tower labeled as a "modem" with an arrow pointing to where expansion cards would be in a case.

JTAG

[bugs2squash]

I thought I read somewhere that this device has a JTAG connector somewhere inside it. Seems reasonable to me that they could read out the memory content with that and then send it off to the NSA to brute force it, it would probably succumb to a "rainbow table" type attack anyway.

Re:JTAG

[JesseMcDonald]

I thought I read somewhere that this device has a JTAG connector somewhere inside it. Seems reasonable to me that they could read out the memory content with that...

You seem to think that, contrary to all evidence, the designers of the Secure Enclave chip must have been really stupid if you think they would even consider allowing JTAG access to the memory holding the device-specific key which is never, under any circumstances, to leave the Secure Enclave, thus nullifying the entire purpose of the chip.

Re:JTAG

[bugs2squash]

OK, but I thought that the 5c was not a secure enclave system - my bad

Re:JTAG

[ihtoit]

yep, the 5C has a JTAG pad next to the SIM port. It's even marked, and here's the key:

TP82_RF - BB UART TXD
TP89_RF - BB UART RXD
TP28_RF - BB UART RTS N
TP29_RF - BB UART CTS N

FBI are idiots

[Anonymous Coward]

I wonder why they didn't look at the smudges and fingerprints on the screen of the iPhone so that they could deduce what the pinched was and then use the fingerprint of the dead guy to unlock the phone (Maybe 3d print a copy of his fingerprint? because USA! USA!)

Sudo?

[dlingman]

"unlock the phone"

"no"

"sudo unlock the phone"

"Dammit. OK..."

propaganda

[Anonymous Coward]

ok if th eFBI cant break a 10 digit pin how can they break a military grade encryption like AES256 , seriously , this is more about having to tell a judge and therefore the public that they can and do day in day out , that new NSA intecept and decode center in utah has been designed to crack 57 petabytes of hard encrypted traffic a year , and they cant break an iphone pin ? they just wnt average joe to believe thir shit are safe on a iphone , but as like ANY computing device based on binary and a fixed word lenght , it's just a question of ressource and time , each being invertly proportional , and with the milliosn of CPU availlable to inteligence agency i wouldn't bet on a delta T of more then 10 minutes , seriously , whatever calculation a measely little A9 chip can do a few thousand xeon chips in parallel can undo in seconds . really Tim Cook is OSCAR material in best support role in a fiction

Dude enough

[Anonymous Coward]

I'm so sick of hearing about this. It's all over the major news networks on Sat Radio. It's on TV. And what are they going to find? A few numbers that might lead to the arrest of some terrorists?

Let's break it down by comparison. Texas guy sells his work truck to a dealership. Texas guy gets calls from angery people about supporting ISIS. Texas guy sees video of his truck in a desert with a .50cal on the back, loaded up with terrorists spraying ammo, name on truck shows up in video. They couldn't trace that truck to anyone past the dealer. Tell me how they are going to track a number? Oooooo they might get names. Come on. More important shit please.

If true then DUMB

[ramriot]

If Representative Darrell Issa actually said that then it is even more proof that you cannot have a rational discussion of this subject without understanding the technology. Without that understanding almost anything you say makes you look like a buffoon.

Sure you could image the hardware and try to brute force the encryption key, it would take you Trillions of years but you could do it. Reason being that the encryption key used on the storage is derived by mixing the users unlock code AND a strong secret, held within the devices CPU, the UID (even on the 5c). Without getting a copy of that from the device as well a the encrypted storage you cannot reduce the brute force guessing to the level of the passcode, being as the UID has much of the entropy of the two.

Apple quite logically has created the hardware of the CPU so that the UID is not available to any interface only as the output from an atomic operation when it is cryptographically mixed with the passcode guess. Also NO pretty sure you cannot physically extract it by taking the CPU apart, Apple would have made decapping the CPU extremely likely to damage it a way that prevents access. Which by the way would also render the evidence suspect and open to challenge under cross examination.