Slashdot Mirror
FBI May Be Opening A Security Hole To Federal Agencies (computerworld.com)
Lucas123 writes: In its rush to gather information, the FBI blew its chance to retrieve data from the iPhone of one of the San Bernardino terrorists when it ordered his iCloud passcode to be reset shortly after the attacks. Now in its fervor to force Apple to create software that can break its own encryption algorithm, the FBI may be opening a security hole to federal agencies. Over the past four years, the federal government has largely shifted its use of mobile devices from Blackberry to iPhones. One major reason for that is -- you guessed it -- the strong native security. If Apple creates an iPhone skeleton key, it not only threatens the public's privacy, but the security of the federal government as well.
The security of the iPhone is hinged upon OS binaries signed by an Apple security certificate. The FBI wants Apple to sign and/or produce binaries with weakened security. Having achieved this, the FBI and all parties in possession of said binaries simply have to swap out the old secure binaries for their version since the phone trusts anything signed by Apple.
Two of my imaginary friends reproduced once
If it is possible for Apple to "create a backdoor" after the fact, then that itself is a back door. The FBI wants apple to release a version of it's OS that can disable certain security features and push that update out to the terrorist's phone without any confirmation from the (now deceased) user. Apple seems to confirm that this is indeed possible and has said that it would be dangerous to even create this version of it's OS because it might fall into the wrong hands and be abused. I would argue that it is already in the wrong hands, because it is in the hands of Apple, and even if Apple fights the FBI, they may be forced by a court to cooperate.
What Apple *should* do (and should have already done), is to create a security system that they would not have the ability to help the FBI hack into. They have already indicated they are working on this.
The IOS security is already broken. The only thing keeping the FBI from cracking it, is their own incompetence, and Apple's limited will to challenge the government. I doubt many people at Apple are willing to go to jail over this (nor should they be).
My advice to Apple, is to help the FBI hack into this phone, and come out with a real security system that is actually secure.
The House Committee on the Judiciary Hearings, The Encryption Tightrope: Balancing Americans’ Security and Privacy (Streamed live on Mar 1, 2016) :)
https://www.youtube.com/watch?...
Try around the 4:05 point in. 200 phones are in line for the same skeleton key needs. As mentioned, that federally demanded, universal "skeleton key" will be ready as an overlap for State and Federal courts
Domestic spying is now "Benign Information Gathering"
Except, of course, the court order specifically allows for Apple to NOT give the binaries to the FBI and the FBI requested it that way to address exactly that issue. But hey, I just read the writ, not the bullshit lies on the Internet.
Nope. Companies are creating things LEO's cannot defeat. (and in the case of iPhones, something even Apple cannot defeat. Unless they start recording the UIDs of every device.)
AC the "revoke" issue wont work to try and keep it for "one" physical. The request is for code that is on a drive that is given to the US gov. The computer code can then be used to open product lines at a state and federal level.
The code as a method on a computer hard drive is been conscripted for a generation of phones, not one physical phone.
Again the House Committee on the Judiciary Hearings, The Encryption Tightrope: Balancing Americans’ Security and Privacy (Streamed live on Mar 1, 2016)
https://www.youtube.com/watch?...
4:44 and onto 4:45 has the details on the request made.
Tool was to be put on a hard drive.
Hard drive with the new tool was to be sent to US gov.
A gov computer would then perform the task. Portable, reusable.
More details at (March 2, 2016)
http://nypost.com/2016/03/02/f...
"“The request we got from the government in this case is, ‘Take this tool and put it on a hard drive, send it to the FBI,’ and they’d load it onto their computer,”"
Domestic spying is now "Benign Information Gathering"
I'll address this in a few parts.
:)
1) BB was a good platform for its time. It's near absolute inflexibility from a development perspective made it a good platform for security since it was hard enough to code, it was pretty hard to hack. Palm Pilot wasn't bad either in its time.
2) BB10 is not BB. It is based on QNX which (I have extremely extensive experience coding for at a system level in direct coordination with QNX themselves) and is otherwise an entirely new operating system consisting of millions of lines of code produced by hundreds of developers over a short span of a few years.
3) To suggest that much new and untested code (no it hasn't been) is sheer silliness and doesn't belong in a forum for people who claim to understand technology. It is mathematically impossible to develop that much code that fast with that many people and have a secure platform.
So, let's talk about this... an iPhone and a Blackberry compared side by side are equally insecure. Sure, the obvious routes probably aren't a problem, but hackers don't use obvious routes... well sometimes the do... depends on what you consider obvious
I have always hated people saying things like "I don't even run antivirus, I'm running a Mac. Unlike a PC, it's secure!". I would respond "Just because no one is openly hacking it currently doesn't mean it's secure".
BES is secure until the messages hit the phones. Once they reach the phone, all security is absolutely gone. Secure messages require secure keys. Secure keys are 3072 bits or longer (for now according to the NSA... this means they can crack 3072 but they believe others can't). Unless you are manually typing 768 hexadecimal characters into the phone every time you log in to use BES, the key used for decrypting your messages is stored on the phone somewhere.
The key to decrypt the keys is probably a pin code or possibly up to a 10 character password convenient to type on the BB keyboard without too many shifts, controls, etc...
If I can locate the store of the key, locate the code to decrypt the key, find the location of 2 or more messages which contain headers (all do), then with the proper computational power, I can obtain the key to decrypt all messages stored by BES on the phone. It's only a matter of CPU. While the number of possible passwords to decrypt the keys increases exponentially with each character in length, the fact a laptop can crack 6 characters in a few second, 8 characters in about 10 minutes, throw 65536 CPUs or a few FPGAs at the problem and it would do 10 characters in about 10 minutes.
I never have been figuring out why so many idiots think that BES is secure... to decrypt messages, the phone has to be storing the information required to decrypt them. At some level there must be a way to read the messages and the security isn't as strong as the door and the lock securing it. It's as strong as the box next to the door holding a spare key that is guarded by a simple code.