Slashdot Mirror
FBI May Be Opening A Security Hole To Federal Agencies (computerworld.com)
Lucas123 writes: In its rush to gather information, the FBI blew its chance to retrieve data from the iPhone of one of the San Bernardino terrorists when it ordered his iCloud passcode to be reset shortly after the attacks. Now in its fervor to force Apple to create software that can break its own encryption algorithm, the FBI may be opening a security hole to federal agencies. Over the past four years, the federal government has largely shifted its use of mobile devices from Blackberry to iPhones. One major reason for that is -- you guessed it -- the strong native security. If Apple creates an iPhone skeleton key, it not only threatens the public's privacy, but the security of the federal government as well.
how's that Hope thing working out?
explain how allowing the FBI to brute force individual iPhones in a lab setting constitutes creating a "skeleton key" that poses a risk to iPhones in the wild? I still haven't heard a remotely plausible explanation of how this happens without some seriously high level industrial espionage of the type that could render iPhones vulnerable *anyway* without Apple ever doing a thing to assist law enforcement? -Love, Legal.Troll
Given how thoroughly large government organizations keep getting hacked - such as we've recently seen with the OPM and IRS - it's not as if there's any information on government employees' phones which isn't already in the hands of the Chinese, Russians, and various criminal syndicates.
#DeleteChrome
For god's sakes, this isn't news!
Of COURSE it will open a security hole to federal agencies. ALL iPhones would compromised by such a skeleton key. The idea that federal government iPhones wouldn't be compromised is just plain delusional.
Apple rather slickly has each update of each recent iOS be specific to a phone. ONE physical phone. Probably to prevent the skeleton key scenario.
Each "copy" (not really an appropriate word here) of the update is unique (I don't know the details) which makes it hard to just use the same binary to on every phone. Each "copy" only works on one phone.
I find it hard to take the FBI seriously on iPhones when their own IT department's security is so lax.
Agent Mulder's work issued computer didn't even have a password protected lockscreen when the machine was idle. Thank goodness it was only Scully/Miller/Einstein - anyone from a double agent to a passer-by such as a cleaner or a vending machine technician could have accessed sensitive, classified information.
If it is possible for Apple to "create a backdoor" after the fact, then that itself is a back door. The FBI wants apple to release a version of it's OS that can disable certain security features and push that update out to the terrorist's phone without any confirmation from the (now deceased) user. Apple seems to confirm that this is indeed possible and has said that it would be dangerous to even create this version of it's OS because it might fall into the wrong hands and be abused. I would argue that it is already in the wrong hands, because it is in the hands of Apple, and even if Apple fights the FBI, they may be forced by a court to cooperate.
What Apple *should* do (and should have already done), is to create a security system that they would not have the ability to help the FBI hack into. They have already indicated they are working on this.
The IOS security is already broken. The only thing keeping the FBI from cracking it, is their own incompetence, and Apple's limited will to challenge the government. I doubt many people at Apple are willing to go to jail over this (nor should they be).
My advice to Apple, is to help the FBI hack into this phone, and come out with a real security system that is actually secure.
As opposed to the fact that most of the federal employees who got an iPhone just wanted one a lot more than a BlackBerry 10 phone. Which is a shame, really, because my Z10 is the best phone I've ever owned including my previous two iPhones. BlackBerry has the only MDM with an ATO from the DoD. If security were the primary motivation, they'd have standardized on BB10 phones with BlackBerry BES.
They want us to be less secure so they can justify their forever was.
Did it take anyone longer than ten seconds to realize this?
Why hasn't the military spoken up about this?
The FBI is obviously watching too much TV---they assume they'll solve every crime before the last commercial break.
here is the famous shoot in the foot again :-))
Nice to see...
where we have strong security that nobody but the good guys can break.
Your government communications and data stores are secure, approved business communications and data stores are secure, but everything else can be decrypted on demand.
Wonder when non-IT businesses are going to realize they have a dog in this fight.
Sheesh, evil *and* a jerk. -- Jade
Can't apple just roll back the iCloud password hash in the database and continue with their original plan....
Protecting the U.S. government communications and information systems against penetration is part of the NSA's charter.
Wait, what?! You guys were breaking encryption as well? Who was supposed to be protecting this stuff?
Have gnu, will travel.
"Missed their chance" - yeah right. The mainstream news is spreading this bullshit bad enough - do we really want Slashdot treating us like a bunch of naval-gazing know-nothings?
The preceding post was not a Slashvertisement.
I wrote something similar on this topic a few weeks ago for a blog post at work, though I went into more technical detail than TFA did:
http://blog.acumensecurity.net...
Our founding fathers would be pissed.
https://www.youtube.com/c/BrendaEM
If Apple can reset the pin count on their phones with a software update, the "native security" isn't so strong. And what that really means is that the FBI's data is owned by Apple, hardly a good situation.
"Now in its fervor to force Apple to create software that can break its own encryption algorithm"
It's doing no such thing. Could people please stop writing about this until they have the first clue about the actual issues involved here?
They're not asking Apple to 'break its own encryption algorithm'. They're asking it to provide a customized operating system that disables the automatic lockout and delay while entering PIN numbers.
- Given an order to produce software, and that such a capability will demonstrably then exist.
- Given a duty to maximize shareholder value.
- Given a duty to comply with national laws.
The only satisfactory solution appears to be to create the software for the first government that asks, and then to sell it to the Chinese, Germans, British, India, Brazil and anyone else.
So the question is -- just how much should Apple charge the Chinese government for the back door, so they can at least establish a fair market value for subverting crypto? RSA took only 10M, and that was clearly undervalued. Should the back door be priced by per device, per nation, per policy agency? Unlocks per year? Are they cheaper in the bulk decryption package?
CAPTCHA: latrines
I suppose it's asking too much of the Feds to have properly implemented Apple's mobile device management protocols, so that when the next Ed Snowden takes his government-issued iPhone to Moscow with him, the Feds can read his itinerary from it?
As soon as they make it public that they can open any iPhone they can get a court order for, people with something to hide from them will move to using more secure applications which are written by companies or people the FBI can't so easily influence with the American legal system.
Better yet, they'll move to using programs that are written by people who added security and wouldn't know how to hack them themselves.
So, basically, all they're doing is educating the criminals to use technologies that are more secure written by companies outside of their jurisdiction.
If they open this phone, it basically will guarantee they will never be able to get to "terrorist data" ever again.
How come no one ever bitches about this? I bet you that 99% of all terrorists have moved to using something more secure by now.
http://www.c-span.org/video/?405442-1/hearing-encryption-federal-investigations
Like Cook said, public safety is important,so is citizen private information !
"One major reason for that is -- you guessed it -- the strong native security."
Blackberries are more secure in many ways than iPhones. They certainly have more remotely manageable security, and can be more locked down, feature-wise.
This has nothing to do with terrorism, San Bernardino, or some drug dealer in New York. This is about the Federal Government wanting unfettered access to EVERYTHING without knowledge, consent, or warrant. The goal here is to outdo the UK in the surveillance society, where everything you say, do, and everywhere you go, is monitored, logged, and recorded for later use against you should the State decide you need to be handled. This is all about eroding civil rights.
Public buses in Maryland record video and audio of everything you say and do on the bus.
Billboards in New York track your cell phone as you travel nearby.
Cameras are EVERYWHERE.
Rump before Trump.
The FBI demanded a tool that would let them plant evidence on every Apple device.
In its rush to gather information, the FBI blew its chance to retrieve data from the iPhone of one of the San Bernardino terrorists when it ordered his iCloud passcode to be reset shortly after the attacks.
This is very misleading. It would have only given them access to the data on the phone stored in iCloud.
I thought it was very telling the language that was used to deny that the NSA had the ability to hack this phone... that they asked other government agencies if they could crack the iphone 5 specifically "running iOS 9"...
Of course other government agencies couldn't crack the phone using the version of the iOS that they want to have Apple replace. They are asking Apple to replace iOS 9 with custom built software. So the question about US government capabilities to hack this phone without Apple stands unanswered.
Can the NSA crack this phone? Does the NSA have software or hardware which would allow them to get the data from the phone? The NSA non-answer seems to imply that they do have the capability to crack the phone, but are trying really really hard to answer some red herring questions to distract from their capabilities.
Understandably so, since they probably derived the ability to crack the iPhone by hacking Apple to steal Apple's encryption keys
Hint: don't get the cheap/free apps: http://www.y42k.com/2016/02/29/when-apple-settles-with-the-fbi/
They have switched their BlackBerry devices over to Android. Which, of course, has problems of it's own.
Does that mean that BB10 uses the vaunted Dual_EC_DRBG guessable number generator?