Slashdot Mirror
FBI May Be Opening A Security Hole To Federal Agencies (computerworld.com)
Lucas123 writes: In its rush to gather information, the FBI blew its chance to retrieve data from the iPhone of one of the San Bernardino terrorists when it ordered his iCloud passcode to be reset shortly after the attacks. Now in its fervor to force Apple to create software that can break its own encryption algorithm, the FBI may be opening a security hole to federal agencies. Over the past four years, the federal government has largely shifted its use of mobile devices from Blackberry to iPhones. One major reason for that is -- you guessed it -- the strong native security. If Apple creates an iPhone skeleton key, it not only threatens the public's privacy, but the security of the federal government as well.
how's that Hope thing working out?
explain how allowing the FBI to brute force individual iPhones in a lab setting constitutes creating a "skeleton key" that poses a risk to iPhones in the wild? I still haven't heard a remotely plausible explanation of how this happens without some seriously high level industrial espionage of the type that could render iPhones vulnerable *anyway* without Apple ever doing a thing to assist law enforcement? -Love, Legal.Troll
Given how thoroughly large government organizations keep getting hacked - such as we've recently seen with the OPM and IRS - it's not as if there's any information on government employees' phones which isn't already in the hands of the Chinese, Russians, and various criminal syndicates.
#DeleteChrome
Apple rather slickly has each update of each recent iOS be specific to a phone. ONE physical phone. Probably to prevent the skeleton key scenario.
Each "copy" (not really an appropriate word here) of the update is unique (I don't know the details) which makes it hard to just use the same binary to on every phone. Each "copy" only works on one phone.
I find it hard to take the FBI seriously on iPhones when their own IT department's security is so lax.
Agent Mulder's work issued computer didn't even have a password protected lockscreen when the machine was idle. Thank goodness it was only Scully/Miller/Einstein - anyone from a double agent to a passer-by such as a cleaner or a vending machine technician could have accessed sensitive, classified information.
If it is possible for Apple to "create a backdoor" after the fact, then that itself is a back door. The FBI wants apple to release a version of it's OS that can disable certain security features and push that update out to the terrorist's phone without any confirmation from the (now deceased) user. Apple seems to confirm that this is indeed possible and has said that it would be dangerous to even create this version of it's OS because it might fall into the wrong hands and be abused. I would argue that it is already in the wrong hands, because it is in the hands of Apple, and even if Apple fights the FBI, they may be forced by a court to cooperate.
What Apple *should* do (and should have already done), is to create a security system that they would not have the ability to help the FBI hack into. They have already indicated they are working on this.
The IOS security is already broken. The only thing keeping the FBI from cracking it, is their own incompetence, and Apple's limited will to challenge the government. I doubt many people at Apple are willing to go to jail over this (nor should they be).
My advice to Apple, is to help the FBI hack into this phone, and come out with a real security system that is actually secure.
As opposed to the fact that most of the federal employees who got an iPhone just wanted one a lot more than a BlackBerry 10 phone. Which is a shame, really, because my Z10 is the best phone I've ever owned including my previous two iPhones. BlackBerry has the only MDM with an ATO from the DoD. If security were the primary motivation, they'd have standardized on BB10 phones with BlackBerry BES.
here is the famous shoot in the foot again :-))
Nice to see...
where we have strong security that nobody but the good guys can break.
Your government communications and data stores are secure, approved business communications and data stores are secure, but everything else can be decrypted on demand.
Wonder when non-IT businesses are going to realize they have a dog in this fight.
Sheesh, evil *and* a jerk. -- Jade
Protecting the U.S. government communications and information systems against penetration is part of the NSA's charter.
Wait, what?! You guys were breaking encryption as well? Who was supposed to be protecting this stuff?
Have gnu, will travel.
"Missed their chance" - yeah right. The mainstream news is spreading this bullshit bad enough - do we really want Slashdot treating us like a bunch of naval-gazing know-nothings?
The preceding post was not a Slashvertisement.
I wrote something similar on this topic a few weeks ago for a blog post at work, though I went into more technical detail than TFA did:
http://blog.acumensecurity.net...
Our founding fathers would be pissed.
https://www.youtube.com/c/BrendaEM
If Apple can reset the pin count on their phones with a software update, the "native security" isn't so strong. And what that really means is that the FBI's data is owned by Apple, hardly a good situation.
I don't remember if they have the feature, but don't they try to inform you when you've used a password before? If so, they probably keep the hash and wouldn't even need to use backups.
"Now in its fervor to force Apple to create software that can break its own encryption algorithm"
It's doing no such thing. Could people please stop writing about this until they have the first clue about the actual issues involved here?
They're not asking Apple to 'break its own encryption algorithm'. They're asking it to provide a customized operating system that disables the automatic lockout and delay while entering PIN numbers.
- Given an order to produce software, and that such a capability will demonstrably then exist.
- Given a duty to maximize shareholder value.
- Given a duty to comply with national laws.
The only satisfactory solution appears to be to create the software for the first government that asks, and then to sell it to the Chinese, Germans, British, India, Brazil and anyone else.
So the question is -- just how much should Apple charge the Chinese government for the back door, so they can at least establish a fair market value for subverting crypto? RSA took only 10M, and that was clearly undervalued. Should the back door be priced by per device, per nation, per policy agency? Unlocks per year? Are they cheaper in the bulk decryption package?
CAPTCHA: latrines
As delusional as thinking the iPhone is currently secure from "state actors" (including foreign ones) if they physically get hold of it? Because that would be very delusional.
I suppose it's asking too much of the Feds to have properly implemented Apple's mobile device management protocols, so that when the next Ed Snowden takes his government-issued iPhone to Moscow with him, the Feds can read his itinerary from it?
As soon as they make it public that they can open any iPhone they can get a court order for, people with something to hide from them will move to using more secure applications which are written by companies or people the FBI can't so easily influence with the American legal system.
Better yet, they'll move to using programs that are written by people who added security and wouldn't know how to hack them themselves.
So, basically, all they're doing is educating the criminals to use technologies that are more secure written by companies outside of their jurisdiction.
If they open this phone, it basically will guarantee they will never be able to get to "terrorist data" ever again.
How come no one ever bitches about this? I bet you that 99% of all terrorists have moved to using something more secure by now.
Like Cook said, public safety is important,so is citizen private information !
"One major reason for that is -- you guessed it -- the strong native security."
Blackberries are more secure in many ways than iPhones. They certainly have more remotely manageable security, and can be more locked down, feature-wise.
As delusional as thinking the iPhone is currently secure from "state actors" (including foreign ones) if they physically get hold of it? Because that would be very delusional.
Well, at least a script kiddie with a Rubber Ducky can't get in.
Of course news about a fake are Fake News.
In its rush to gather information, the FBI blew its chance to retrieve data from the iPhone of one of the San Bernardino terrorists when it ordered his iCloud passcode to be reset shortly after the attacks.
This is very misleading. It would have only given them access to the data on the phone stored in iCloud.
Hint: don't get the cheap/free apps: http://www.y42k.com/2016/02/29/when-apple-settles-with-the-fbi/