FBI Delays Case Against Apple; May Have Way To Break Phone (threatpost.com)

Um by war4peace · 2016-03-21 12:34 · Score: 2, Insightful

See, life always finds a way :)
I meant hacking! HACKING!

--
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)

Last we will hear of that.... by Tehrasha · 2016-03-21 12:36 · Score: 3, Insightful

" it should eliminate the need for the assistance from Apple Inc. "

Until Apple fixes this exploit in the next release...

Re:Last we will hear of that.... by daveschroeder · 2016-03-21 12:39 · Score: 1

The next release of what? The iPhone 5c? Remember that part of the shortcoming here isn't in crypto or the OS, it was a combination of the newer iOS (8/9) with older hardware without the new security enclave (iPhone 5 and older).
Re:Last we will hear of that.... by SimonTheSoundMan · 2016-03-21 12:40 · Score: 1

This phone is running iOS 7, any newer version for be far harder and more destructive if you attempted to hack it.
Re:Last we will hear of that.... by daveschroeder · 2016-03-21 12:48 · Score: 1

No, the phone is running iOS 9 -- this is the San Bernardino phone. The phone running iOS 7 was the case in the Eastern District of New York -- which of course Apple's own law enforcement compliance statement says it will unlock when presented with a warrant, but I guess it didn't feel like it this time.
Re:Last we will hear of that.... by ooloorie · 2016-03-21 13:10 · Score: 1

Until Apple fixes this exploit in the next release...
The question you should be asking is why the exploit was there in the first place. The fact that the iPhone 5C had exploits was clear from the beginning, and any halfway competent Apple engineer must have known that.
Re:Last we will hear of that.... by Bing+Tsher+E · 2016-03-21 14:41 · Score: 1

The delicious thing will be if the FBI has managed to break into the phone on their own. After all the crowing of Apple about how unbreakable it is and what extraordinary means they refuse to engage to open it... If the FBI gets in, Apples use of this whole 'crisis' as a marketing opportunity to flaunt their 'security' will explode and tumble like a castle made of playing cards.
We can hope, anyway, those of us who are so tired of Apple's smug use of the issue to hype their stuff.
Re:Last we will hear of that.... by brantondaveperson · 2016-03-21 14:53 · Score: 4, Informative

You have your facts a bit wrong. Apple have stated it is possible to create software to break into its phones, but that doing so would a significant undertaking, and would compromise the security of their products. This is a perfectly fair position for them to take, and is backed up by all the facts that are available. At no point has anyone said that the iPhone 5C is "unbreakable". Never.
What people have said, however, and this is correct as far as anyone knows - there's no reason to doubt it - is that a newer iPhone with a strong passphrase is unbreakable for all practical purposes. A new iPhone with a 4-digit pin is breakable only with a special software release that can only be signed by Apple, just like the 5C. But, an iPhone 5C does not have the security baked right into the silicon, and so if you can dump all of the flash, you can brute force the PIN.
Also, the FBI has not yet broken into the phone without Apple's help. They still have to determine whether or not the method words, and rather importantly, whether or not doing so would compromise the admissibility of any evidence gathered.
Re:Last we will hear of that.... by AchilleTalon · 2016-03-21 15:03 · Score: 1

The article says nothing about how they believe they can access they encryption key. It may be a hardware hack since they have physical access to the device.

--
Achille Talon
Hop!
Re:Last we will hear of that.... by AchilleTalon · 2016-03-21 15:07 · Score: 1

You seems to rule out the possibility the exploit may be a hardware exploit and not a software exploit. In which case, it may not be possible to fix it unless they release another iPhone. In which case, this means as well physical access to the device is required to recover the encryption key and the data.

--
Achille Talon
Hop!
Re:Last we will hear of that.... by Bing+Tsher+E · 2016-03-21 15:11 · Score: 1

Apple has indicated that a forked version of the OS that they would have to digitally sign could be created.
For the phone in question, it could be a fork that simply NOPs out the wipe after ten attempts, and possible shortens some integers that set a delay time between subsequent attempts.
Then the fork would have to be digitally signed by Apple of course, so that it could be pushed onto the phone, which is the crux of the matter.
'Secure Enclave' is the new buzzword, though, and the new hardware is better (It's ALWAYS better with Apple, line up at the store for your new shiny!)
Re:Last we will hear of that.... by dsmatthews9379 · 2016-03-21 15:31 · Score: 1

It may not be the sort of "exploit" you imagine. Here is a big fat hint, digital logic on silicon chips is not a "black box" so you can't really hide your secrets on them if somebody can access the device physically while it is operating and checking the validity of the access code. This can be done without touching the chip.

Meanwhile Apple now has to face the fact that a universal method has been found to compromise their technology, one that would not have been developed for the FBI if Apple had tried to do as little as possible and just told the FBI the access code, but nothing else.

The stories about a greater risk of hacking were lies, Apple know they could have got the code and destroyed the tools so that the knowledge was lost, except for in the minds of a few key people. Even the names of those people could have been kept from the FBI and each other so that the team could not be coerced back together to repeat the exercise. It was never a question of it it was possible. It was always a question of how long and how much money would it take, as you now can see.
Re:Last we will hear of that.... by Applehu+Akbar · 2016-03-21 16:32 · Score: 1

"The next release of what? "
There was a new iOS point update just today. Wonder if that had anything to do with the FBI's assertion?
Re:Last we will hear of that.... by rtb61 · 2016-03-21 16:58 · Score: 1

OHH bullshit, everyone knew it was all about punching a permanent back door into all iphones and not this particular one. The more extensive goal was to force Apple to allow the backdoor from here on in and that to protect M$ and the permanent back door put into windows and specifically protect it from Apple selling privacy as a feature. They were losing the case and are going to do exactly what they could have done in the very beginning but were pretending to not be able to do and oh yeah, the password change did not occur by accident but was part of the over scam. They were forced to back down from implementing a permanent back door into all Apple products and ensuring Apple could not market privacy against M$'s Windows anal probe 10 permanent back door. M$ spying on your children.

--
Chaos - everything, everywhere, everywhen
Re:Last we will hear of that.... by ooloorie · 2016-03-21 17:11 · Score: 1

I'm assuming it is a hardware exploit. It certainly relies on the fact that the iPhone 5c hardware is not secure, and that isn't fixable. The question is: why was the iPhone 5c designed that way in the first place. Neither cost nor lack of technology account for it.
Re:Last we will hear of that.... by MaxSmoke · 2016-03-21 19:05 · Score: 1

Wonderedthe same.
Maybe a win-win? FBI got what they wanted behind the doors while Apple looks like the winner in public eyes.
Re:Last we will hear of that.... by fustakrakich · 2016-03-21 19:37 · Score: 1

but I guess it didn't feel like it this time.
Or maybe they can't break into iOS9, which I hope is true, but is probably mere fantasy.

--
“He’s not deformed, he’s just drunk!”
Re:Last we will hear of that.... by brantondaveperson · 2016-03-21 19:50 · Score: 3, Interesting

Again, trying to be fair to Apple, their new hardware usually is better. The secure enclave, which is a buzzword I've tried to avoid using, does sound extremely secure. Per-device IDs, key doesn't leave the chip, on-chip AES-256-CTR encryption that operates on the DMA channel, PIN and/or passcode never stored anywhere. I mean, it's pretty damn secure. It's hard to imagine how to reliably attack it even with physical access. Especially if the data is important, and screwing up means you don't get a second chance, ever.
Re:Last we will hear of that.... by delt0r · 2016-03-21 22:20 · Score: 1

The exploit is based on the fact that the pass code is too small, so its not really an exploit IMO. There is no way around offline attacks with small passwords or phrases. And if you have the hardware it is always a matter of time to do an offline attack. Hell it really isn't hard to do. Typically you can buy cracking kits off the internet, a new phone takes a little while to get kits common enough.

--
If information wants to be free, why does my internet connection cost so much?
Re:Last we will hear of that.... by delt0r · 2016-03-21 22:22 · Score: 1

The phone is not made from tamper resistant hardware. It is not even in the threat model. It is not hard to gain the required access with sufficient application of a soldering iron.

--
If information wants to be free, why does my internet connection cost so much?
Re:Last we will hear of that.... by daveschroeder · 2016-03-21 23:58 · Score: 1

I was referring to the iOS 7 device, which they can easily unlock/break (see Section I), but declined to do so this time (the EDNY case).
The combination of iOS 8/9 with iPhone 6 and newer (HW security enclave) is designed to not be able to be broken by Apple, even if it wanted to.
That's not to say that nothing is breakable, ever; it's all about the level of effort required and whether or not one can bypass the crypto altogether.
Re:Last we will hear of that.... by BasilBrush · 2016-03-22 00:09 · Score: 1

Nope. 9.3 has been in beta testing for weeks. And yesterday was Apple's spring announcements event, which included a couple of new features in 9.3. It's nothing to do with the FBI.
Besides the FBI want a custom version of iOS to get around security on a particular phone. It does not require launching a new version to the public.
The FBI's action today is because it was going to court today.
Re:Last we will hear of that.... by BasilBrush · 2016-03-22 00:15 · Score: 1

Devices without exploits are the exception, not the rule.
Re:Last we will hear of that.... by ooloorie · 2016-03-22 02:59 · Score: 1

The phone is not made from tamper resistant hardware.
The phone has a tamper resistant cryptographic processor (separate from the main processor), but that processor isn't used in a way that ensures cryptographic security. How to do it right was known at the time these phones were designed, and it wouldn't have been any more expensive. So, the question is: why are these phones designed the way they are? It either has to be staggering incompetence, or it has to be deliberate.
Re:Last we will hear of that.... by tlhIngan · 2016-03-22 03:35 · Score: 1

The phone running iOS 7 was the case in the Eastern District of New York -- which of course Apple's own law enforcement compliance statement says it will unlock when presented with a warrant, but I guess it didn't feel like it this time.
No, Apple wasn't presented with a warrant to unlock that phone.
Instead, the feds simply asked the court to force Apple to do it, using the All Writs Act. Basically the argument was since Apple could do it, and has, they should continue to do it. Apple however requires a legal document saying they should, in this case, a warrant (which means the judge was convinced there is significant merit in the case that it should be searched).
No warrant was ever issued. In fact, the defendant pleaded guilty, which means it's even more unlikely the judge will issue a warrant. Instead the feds want to compel Apple to unlock the phone anyways (using All Writs) absent said warrant. Apple said no.
The court case Apple won is basically saying that this was not a valid use of All Writs and the court refused to issue a court order.
Apple had basically changed the conditions to which they will unlock phones when they realized All Writs was being abused, and demanded a court order or warrant.
Re:Last we will hear of that.... by delt0r · 2016-03-22 07:47 · Score: 1

Consumer grade crytpo processor have proven time and time again to be very poor. Hell we are not talking about "motivated attackers" in the normal sense. We are talking about people wanting a few free games on a PlayStation. And they don't even survive that! Strong security at this level (government funded attackers) is both hard to get right even with the money and well expensive even if you want to try.

And yet the use of just plain old encrypt the whole device with a 3rd party tool probably would be far more secure. Assuming you use a really really long passcode.

--
If information wants to be free, why does my internet connection cost so much?
Re:Last we will hear of that.... by david_thornley · 2016-03-22 10:23 · Score: 1

Which is why the 5S and later iPhones had even better security measures. Making a device able to resist any attack by someone with full physical control over the phone is non-trivial, and gets extremely difficult when the phone is required to be easy to use. Apple is working on this, but complete security isn't easy.

--
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
Re:Last we will hear of that.... by fustakrakich · 2016-03-22 16:54 · Score: 1

but declined to do so this time
Yes, better consistency would be a plus. Let's hope the point is moot with the better security.

--
“He’s not deformed, he’s just drunk!”
Re:Last we will hear of that.... by ooloorie · 2016-03-22 18:07 · Score: 1

Apple doesn't make some obscure implementation error. The design of the 5C's encryption hardware was obviously fundamentally wrong from the start, namely the way they combine the PIN with the hardware key. The question is why.
Re:Last we will hear of that.... by ooloorie · 2016-03-22 18:44 · Score: 1

Making a device able to resist any attack by someone with full physical control over the phone is non-trivial, and gets extremely difficult when the phone is required to be easy to use.
Bullshit. All Apple needed to do is perform the PIN check inside the crypto processor instead of in ARM software, and not use the PIN as a component of the encryption key. That's not rocket science. The fact that 5C encryption was badly broken was obvious from the start.

Which is why the 5S and later iPhones had even better security measures.
We don't know how good the security measures of the 5S and later iPhones are, and at this point, we can't trust anything Apple says.
Re:Last we will hear of that.... by david_thornley · 2016-03-23 02:52 · Score: 1

What do you mean, "not use the PIN as a component of the encryption key"? Creating the key as a function of the PIN and a stored 256-bit random number means that the key can't be generated without the correct PIN. This, I'd think, would be a desirable feature, because it means that, if the PIN check is bypassed somehow, the key can't be generated. Keeping all the components in the phone at all times sounds like a potential vulnerability to me. This is two-factor authentication (something the owner knows, something the owner has) that has to be there before the memory can be read.
This also means that a vital part of the PIN check is in the crypto processor, just what you wanted. The problem is that the rate limitation and wipe capability appear to be in ARM software in the 5C, and this was corrected in the 5S.
And that means that you either don't know what you're talking about or can't express yourself clearly, since you called for something like the 5C's security model but with an additional vulnerability.
Also, "at this point, we can't trust anything Apple says." What has changed recently to alter your perception of Apple's trustworthiness? What statement did Apple make that proved false?

--
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
Re:Last we will hear of that.... by ooloorie · 2016-03-23 04:53 · Score: 1

This also means that a vital part of the PIN check is in the crypto processor, just what you wanted. The problem is that the rate limitation and wipe capability appear to be in ARM software in the 5C,
The rate limitation and wipe capability are the "vital part" of the PIN check, and the fact that those are implemented by the ARM instead of the crypto processor is a fundamental problem. Combining the PIN with the internal (fixed) 256 bit key is pointless because the entropy of the PIN is so low.
The iPhone 5C crypto system is almost the ideal design for a backdoor: it provides good security against attacks by most criminals, but Apple can easily create tools to brute force it if required by governments. Apple themselves admits that, that's what this fight is all about, after all.

Also, "at this point, we can't trust anything Apple says." What has changed recently to alter your perception of Apple's trustworthiness? What statement did Apple make that proved false?
The lack of security of the iPhone 5C wasn't a problem in itself; anybody could look at Apple's documents and draw their own conclusions, but people just weren't very interested; Apple didn't try to sell their phones as ultra-secure and they didn't pretend that they weren't collaborating with governments. What has changed is that Apple is now pretending that their refusal to cooperate with the FBI amounts to some principled defense of privacy.
Furthermore, given the situation in places like China and Russia (and probably France and Germany, as well as pending legislation in US states), it is inconceivable that Apple phones cannot have some form of government backdoor, because Apple is clearly going to face a choice at some point: stop selling your phones or cooperate with authorities. In the iPhone 5C, the backdoor was in the design in a fairly obvious way; in the 5S and subsequent phones, it may simply be some kind of software or hardware "master key", or alternatively, Apple may simply be lying about the design.

FBI is a victim of the All Writs Act. by Anonymous Coward · 2016-03-21 12:36 · Score: 5, Funny

Sounds like the FBI will be busy unlocking phones for hundreds of LE agencies now. Way to turn the burden around. In the meantime, the FBI posts "Now hiring for iPhone repair positions".

Re:FBI is a victim of the All Writs Act. by shubus · 2016-03-21 14:03 · Score: 2

I still doubt they've cracked the iPhone....seems like a delaying tactic of the FBI since they're realized Apple's case is pretty strong and has a lot of support.
Re:FBI is a victim of the All Writs Act. by AchilleTalon · 2016-03-21 15:09 · Score: 1

With physical access to the device, it is perfectly plausible they found a way to recover the encryption key.

--
Achille Talon
Hop!
Re:FBI is a victim of the All Writs Act. by shubus · 2016-03-21 15:35 · Score: 1

As I understand the possible FBI scheme is to keep replacing the NAND chip which contains the counter - 10 tries after which the chip erases the iPhone - by first cloning that chip, testing a code, then replacing the chip with a fresh one with the counter still at 10...theoretically this would work.....if they can work through all the 1,000,000 possible combinations.
Re:FBI is a victim of the All Writs Act. by Anonymous Coward · 2016-03-21 16:03 · Score: 1

Sounds like hard work desoldering/resoldering the flash chip hundreds of times. Surely they can just mount the flash chip on a daughterboard, clone it just once and then reflash it after every ten attempts?
Re:FBI is a victim of the All Writs Act. by Phreakiture · 2016-03-22 01:24 · Score: 1

It appears to be six. There is a hack out there to reduce it to four, which is apparently what it used to be. I'm wondering if six is a minimum or an absolute, i.e. is it at least 6 or exactly 6? Can I use 11 if I want? I'm an Android user, so I don't know.

--
www.wavefront-av.com
Re:FBI is a victim of the All Writs Act. by Anonymous Coward · 2016-03-22 01:44 · Score: 1

I think you nailed it. The FBI was looking for precedent but can see they are going to lose. So they delay until they can strengthen their case.
Re:FBI is a victim of the All Writs Act. by david_thornley · 2016-03-22 10:27 · Score: 1

I doubt it's a separate chip, even in the 5C. Remember, the wipe doesn't touch the internal storage, but rather wipes a 256-bit value stored in hardware.

--
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes

Nice way to try and destroy Apple's image by JoeyRox · 2016-03-21 12:37 · Score: 4, Informative

The US Government knows that Apple has made encryption a cornerstone of their product strategy in order to protect their international sales in our post-Snowden era (in other words, to protect the world from the US Government). What better way to hit back at Apple for their lack of cooperation than to strike at the heart of Apple's strategy.

Re:Nice way to try and destroy Apple's image by alvinrod · 2016-03-21 12:51 · Score: 5, Interesting

There was always a way for them to gain access to that particular phone because it was an older model that didn't have the security features of their more recent devices to prevent those kinds of attacks. Basically some hacker found that they could hook a device up the phones innards and just try brute forcing the 4-digit PIN and that if they cut all power to the device on a failed attempt quickly enough that the system wouldn't register the failed attempt and wipe the device.

The FBI could always get into this phone, but they wanted Apple to give them the keys to get into any iPhone anytime that they wanted to. The only thing the FBI has probably done is drive Apple and other device makers to build security systems that they have no way of exploiting themselves, even if they have the ability to write a custom OS.

The government needs to stop trying to illegally invade the privacy of its citizens. All it's really doing is to hurt US businesses because foreign countries don't want anything to do with a country that's going to spy on all of their information or communications.
Re:Nice way to try and destroy Apple's image by SeaFox · 2016-03-21 14:41 · Score: 1

...foreign countries don't want anything to do with a country that's going to spy on all of their information or communications.
Really? So China gives foreign companies a free pass on communications?
Re:Nice way to try and destroy Apple's image by bigwheel · 2016-03-21 14:42 · Score: 5, Funny

Basically some hacker found that they could hook a device up the phones innards and just try brute forcing the 4-digit PIN and that if they cut all power to the device on a failed attempt quickly enough that the system wouldn't register the failed attempt and wipe the device.
But that would void the warranty.
Re:Nice way to try and destroy Apple's image by SvnLyrBrto · 2016-03-21 15:04 · Score: 2

Well, there are two possibilities:
1) China has Apple, and every every other US tech company, compromised at the highest level, and we're all fucked.
2) China's government is not so much comprised of shit-for-brains idiots who have to get on television to appease a bunch of even more shit-for-brains idiots by appearing to "get tough on terr'ism." as ours. And while they'd no doubt like to be able to monitor all electronic communication with more efficiency than they do; they understand that forcing tech companies to build in that backdoor not only lets them do so, but lets everyone else spy on them that much more easily too.
Personally, I'm hoping for #2.

--
Imagine all the people...
Re:Nice way to try and destroy Apple's image by Bing+Tsher+E · 2016-03-21 15:12 · Score: 1

But that would void the warranty.
Likely, it would also constitute 'holding it wrong.'
Re:Nice way to try and destroy Apple's image by Etherwalk · 2016-03-21 15:35 · Score: 1

Well, there are two possibilities:
1) China has Apple, and every every other US tech company, compromised at the highest level, and we're all fucked.
2) China's government is not so much comprised of shit-for-brains idiots who have to get on television to appease a bunch of even more shit-for-brains idiots by appearing to "get tough on terr'ism." as ours. And while they'd no doubt like to be able to monitor all electronic communication with more efficiency than they do; they understand that forcing tech companies to build in that backdoor not only lets them do so, but lets everyone else spy on them that much more easily too.
Personally, I'm hoping for #2.
China attempts to compromise every US tech company. I assume they do this with human intelligence assets as well as electronically.
Re: Nice way to try and destroy Apple's image by jxander · 2016-03-21 17:51 · Score: 2

Sounds more like the "one failed attempt" counter passes through RAM before being stored in non-volatile memory.
If you can rig up something to detect that message in RAM and hard-power-down the system before it transitions the data, you could have unlimited attempts.
If we assume they do this on every single attempt, and it takes exactly 1 minute to reboot and try again, you could brute force all 10,000 possible 4-digit numerics in just under a week.
Of course ... That's all wild speculation. I could be way off base.

--
This signature is false.
Re:Nice way to try and destroy Apple's image by shawn2772 · 2016-03-21 17:55 · Score: 1

Basically some hacker found that they could hook a device up the phones innards and just try brute forcing the 4-digit PIN and that if they cut all power to the device on a failed attempt quickly enough that the system wouldn't register the failed attempt and wipe the device.
I thought iOS 8 vulnerability was fixed in iOS 9. I don't think that's the attack they're using.
Re:Nice way to try and destroy Apple's image by delt0r · 2016-03-21 22:26 · Score: 1

It would not be that hard to simply power bits and pieces to copy an image. The test passwords till your hearts content. It is not like iPhones are tamper resistant.

--
If information wants to be free, why does my internet connection cost so much?
Re:Nice way to try and destroy Apple's image by shawn2772 · 2016-03-22 00:18 · Score: 1

You should learn about relay protected memory. I'd explain it but I'm on my phone.
Re:Nice way to try and destroy Apple's image by delt0r · 2016-03-22 07:41 · Score: 1

Well google gives nothing so perhaps not. Also its not like quite expensive tamper resistant chips haven't been broken for a little more than shits n giggles, and full class breaks i may add. Simple zero memory features on most consumer devices is really pretty easy to get around for the simple reason that they are cheap, even when they have them. You want expensive security your not going to get in consumer devices. For fucks sake its like a 4-6 digit pin. Hardly real security.

--
If information wants to be free, why does my internet connection cost so much?
Re:Nice way to try and destroy Apple's image by shawn2772 · 2016-03-23 01:06 · Score: 1

Well google gives nothing so perhaps not.
Hmm. There is less information online that I'd have thought. In brief: RPMB is flash whose on-board controller has an embedded MAC key, which is pre-shared at the factory with the CPU. All write messages must be correctly MACed or they're rejected. Each message must include the current value of a counter which increments on every successful operation, so a valid write message can't be replayed. There's more to it, but that's sufficient here.

Also its not like quite expensive tamper resistant chips haven't been broken for a little more than shits n giggles, and full class breaks i may add. Simple zero memory features on most consumer devices is really pretty easy to get around for the simple reason that they are cheap, even when they have them. You want expensive security your not going to get in consumer devices.
Depends on the sophistication and level of dedication of the attacker. No you're never going to keep the NSA, GCHQ, Mossad, etc. out of a consumer device. Or probably even a grad student with lots of time, access to expensive equipment (e.g. electron force microscope) and a willingness to destructively disassemble devices and painstakingly scan tiny chip features and read out embedded keys. But you can stop anyone less dedicated and less well-equipped.
I don't know if Apple uses RPMB, but it's the most obvious way to prevent the attack you mention (which I assume you got from the ACLU-distributed article that mentions it, but maybe not). There are others.

For fucks sake its like a 4-6 digit pin. Hardly real security.
Whether a four-digit PIN is secure depends on the brute force mitigations in place. If there are none, sure, you can pop that in a fraction of a second. If the device will wipe after 10 consecutive failed attempts, you either need really good information about what the PIN might be, or you're not getting the data.
Re:Nice way to try and destroy Apple's image by delt0r · 2016-03-24 10:54 · Score: 1

So along the lines of what i would have called zeroing memory. I just have my doubts they use this. Even $10 per devices ends up being quite a lot of price difference, or profit loss. Can you make consumer grade electronics pretty secure. Yep, but generally not at a consumer grade price. In days of old even the set top box folks took shortcuts to save money, and there was a really good financial argument against preventing class breaks in that case.

--
If information wants to be free, why does my internet connection cost so much?
Re:Nice way to try and destroy Apple's image by shawn2772 · 2016-03-24 14:04 · Score: 1

So along the lines of what i would have called zeroing memory. I just have my doubts they use this. Even $10 per devices ends up being quite a lot of price difference, or profit loss.
$50 Android phones have RPMB. I see no reason Apple wouldn't use it.

Outside Party? by TechyImmigrant · 2016-03-21 12:39 · Score: 4, Insightful

So who is this outside party? Who's going to be the first to file an FOIA request?

--
I should use this sig to advertise my book ISBN-13 : 978-1501515132.

Re:Outside Party? by somenickname · 2016-03-21 12:54 · Score: 5, Funny

John McAfee, obviously.
Re:Outside Party? by bughunter · 2016-03-21 13:03 · Score: 5, Interesting

My money's on the NSA.
But whoever it is, I believe they knew they had this option all along.
They had the best experts in the world telling them that it could be broken, but they pursued the matter in the courts instead.

--
I can see the fnords!
Re:Outside Party? by Tehrasha · 2016-03-21 13:04 · Score: 2

If I had to guess, I would say it was Johns Hopkins University.....
https://www.washingtonpost.com...
Re:Outside Party? by Proudrooster · 2016-03-21 13:22 · Score: 1

John McAfee lied to get press.
Re:Outside Party? by 93+Escort+Wagon · 2016-03-21 13:35 · Score: 1

The NSA collects zero days - we already know that. But I wouldn't put it past the FBI to screw up again and update the phone to iOS 9.3 before they extract the data.
Also, a couple months back there was supposedly some private entity that paid a million dollars for a jailbreak... at least according to the company selling the jailbreak. Not sure how reliable that announcement was, though.

--
#DeleteChrome
Re:Outside Party? by Fnord666 · 2016-03-21 16:47 · Score: 1

If I had to guess, I would say it was Johns Hopkins University.....
And you would almost certainly be incorrect.

--
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
Re: Outside Party? by 93+Escort+Wagon · 2016-03-21 16:55 · Score: 1

Yeah, that what I'm saying - I could see them unlocking the phone, getting the "update to 9.3?" prompt, and clicking "yes" without thinking about it until it was too late.

--
#DeleteChrome
Re:Outside Party? by Thelasko · 2016-03-22 02:22 · Score: 1

My money's on the NSA.
But whoever it is, I believe they knew they had this option all along.
They had the best experts in the world telling them that it could be broken, but they pursued the matter in the courts instead.
Richard A. Clarke has stated so publicly.

--
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
Re:Outside Party? by aaron44126 · 2016-03-22 04:14 · Score: 2

This may be it. I heard an interview on NPR with an ex-NSA guy and this topic came up. He said his advice to the FBI, if he still worked in the government, would be something along the lines of "Bring the phone to the NSA and we will solve this problem for you." He said he had spoken to a number of experts who believed that the NSA has the resources to unlock this phone, but the FBI hadn't asked them, as they were more interested in the precedent than the result.
Re:Outside Party? by bughunter · 2016-03-22 06:37 · Score: 1

Yes, I heard the same interview. It was pretty damning for the FBI.

--
I can see the fnords!
Re:Outside Party? by TechyImmigrant · 2016-03-22 15:29 · Score: 1

If I had to guess, I would say it was Johns Hopkins University.....
https://www.washingtonpost.com...
Johns Hopkins denied it today.

--
I should use this sig to advertise my book ISBN-13 : 978-1501515132.

OZ never gave the Tin Man by turkeydance · 2016-03-21 12:41 · Score: 1

what he didn't already have.

I'm not sure whether this is good news or bad... by JMZero · 2016-03-21 12:41 · Score: 5, Interesting

I certainly don't think that any information about this phone (or some new approach to getting info off it) is what prompted the change here. Giving up at this stage means one of two things:

1. They flinched. They thought they'd lose, either in court or in public opinion - so they kicked the can down the road.
2. They've already won; they know that legislation is about to become more favorable for them, and they'll have the tools they want without needing a precedent here.
3. They've already lost; they know that there will soon be enough robust/secure devices in the wild that having leverage over companies like Apple won't actually help them (because the Apple's of the world may not be able to break their own devices)

We'll find out which it is over the next few years.

--
Let's not stir that bag of worms...

Health by Major+Blud · 2016-03-21 12:42 · Score: 3, Interesting

During Tim Cook's presentation today, I couldn't help thinking that they were pushing CareKit to make people start to consider how much information about their health would be on these devices, and who else could potentially have access to it. I could simply be overthinking it, but it very well could have been that he was trying to win over more people to Apple's side of the argument.

--
If you post as Anonymous Coward, don't expect a reply.

Re:Health by ConfusedVorlon · 2016-03-21 22:50 · Score: 1

Yup - I thought the same. Not to mention the highly regulated nature of health data.

--
VLC Remote for iPhone and Android

Translation: Next Time...... by Anonymous Coward · 2016-03-21 12:42 · Score: 5, Insightful

Translation: Next time the FBI sues someone to force them to break encryption it will be someone that can't fight back, and they will get their precedence then.

Re:Translation: Next Time...... by Darinbob · 2016-03-21 16:36 · Score: 1

I saw it and I think I have the default settings.
Re:Translation: Next Time...... by Anonymous Coward · 2016-03-21 18:05 · Score: 1

Good job, twat. His comment is currently +4. Twat.
Re:Translation: Next Time...... by fustakrakich · 2016-03-21 19:48 · Score: 1

Oh dear! Comments like that should cost you your modding privileges.

--
“He’s not deformed, he’s just drunk!”
Re:Translation: Next Time...... by edtice1559 · 2016-03-22 02:47 · Score: 1

They do. He got modded to -1 Troll which will reduce Karma and mod points.

DOJ did not want precedent from a loss in court by xeno · 2016-03-21 12:45 · Score: 5, Insightful

The last salvo from Apple's lawyers was fairly devastating to the DOJ's case: It pointed out errors of law, errors of logic, technical mistakes and omissions, and general arrogance. The DOJ knew lat week that they were getting shot down, so they'd rather not have that happen in court where it could affect their future error-and-arrogance-filled filings.

Last week someone pointed out that Apple has far better lawyers than the DOJ. True. Tragic, sad, demoralizing as an American, but obviously true.

--
I think not...(*poof*)

Re:DOJ did not want precedent from a loss in court by Aighearach · 2016-03-21 14:18 · Score: 1

The question is, will they be able to drop it, or not? Apple is facing over a dozen of these cases right now.
Re:DOJ did not want precedent from a loss in court by SvnLyrBrto · 2016-03-21 15:17 · Score: 1, Troll

Don't forget that Tim Cook has also said very publicly that he is totally willing to go all the way to the Supreme Court over this, and said court just lost its most thuggish scumbag justice. By folding now, the FBI loses this particular round; but avoids setting a precedent and still gets to extort anyone who can't darken the sky with quite so many lawyers as an enraged Apple.
(I'm not sure if you're referring to my post last week. But I pointed out then that, when the DoJ thought to take on IBM in the '70s, Big Blue ground them down under so many lawyers, dragging the case out for better than a decade, that the DoJ just gave up entirely... and Apple is richer (ie. can afford more and better lawyers) now than IBM was then.)

--
Imagine all the people...
Re:DOJ did not want precedent from a loss in court by Darinbob · 2016-03-21 16:43 · Score: 3, Interesting

Don't think the lawyers are necessarily better or worse. Apple has the larger budget to spend on this one issue. The higher pay also does not mean that the government is stuck with the leftovers who couldn't find a better job; I have a friend who quit being a lawyer to join the FBI as an agent with much lower pay. Some people value public service.
Re:DOJ did not want precedent from a loss in court by Darinbob · 2016-03-21 16:45 · Score: 1

I suspect Scalia would have backed Apple's arguments.
Re:DOJ did not want precedent from a loss in court by chispito · 2016-03-22 03:18 · Score: 1

Last week someone pointed out that Apple has far better lawyers than the DOJ. True. Tragic, sad, demoralizing as an American, but obviously true.
Why is that demoralizing? You really want all the best lawyers to work for the government?

--
The Daddy casts sleep on the Baby. The Baby resists!
Re:DOJ did not want precedent from a loss in court by david_thornley · 2016-03-22 10:35 · Score: 1

So far, Mitchell seems determined to not vote him up or down. Obama selected the nominee to be unobjectionable, and President Clinton might well have a Senate majority to put someone the Republicans like less on the Supreme Court.

--
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
Re:DOJ did not want precedent from a loss in court by david_thornley · 2016-03-22 10:48 · Score: 2

We're talking about an iPhone 5c, and Apple no longer sells them. The iPhone 5S (the next version) had enhanced security, so if anything it gives Apple some leverage to suggest upgrading the phones.
As far as waiting for the next terrorist attack to take place, that's pretty much what they have to do anyway.
I'm pretty sure there's nothing useful on the phone in question, because if there was the FBI would have snarfed the data before they ordered the County office that issued it to change a password and destroy access.

--
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes

Something is not right here.... by erp_consultant · 2016-03-21 12:45 · Score: 4, Interesting

So the government is dropping the case because some third party might have a way to break into the phone? Might have a way? So they haven't even verified that it works before dropping the case? Why not let the case proceed and if they come to find out later that the 3rd party method works then drop the case?

Surely it can't be to save taxpayer money. That has never been a criteria for any branch of government when it comes to prosecution (errr...persecution). Maybe the FBI had a way to break into the phone all along and this was just a shakedown of Apple.

Are we really to believe that some mysterious "3rd party" just suddenly appears a day before the case is to go to court? I call BS on this whole thing.

Re: Something is not right here.... by maitai · 2016-03-21 13:00 · Score: 4, Informative

They didn't drop it. They got a continuance until April 5th to see if they can actually get into the phone themselves. Article is really way off.
Re:Something is not right here.... by whipslash · 2016-03-21 13:07 · Score: 3, Informative

Yes you're right. Story updated.
Re:Something is not right here.... by AHuxley · 2016-03-21 17:52 · Score: 1

Re "Maybe the FBI had a way to break into the phone all along and this was just a shakedown of Apple."
The NSA always had a way in, like PRISM and all the staff that helped keep that way in wide open. But that was a secret
The CIA, GCHQ, Australia, NZ, Canada have their own methods to track any phone globally. That still is a secret and would not be useful in an open US state or federal court.
The part the FBI wants is a method that is open court friendly. A legal team can call any US expert and the result in open court will be that the US branded cell phone was decrypted and information was extracted.
The part needed was to conscript a US company into creating a computer ready master key to generations of cell phones ready for open courts at a state and federal level.
Re "So they haven't even verified that it works before dropping the case?"
If the method is kept a secret, then its a consultant in the US or on the international trusted friends of the US list and the method will be kept hidden from any public court. Secret courts, sealed paperwork, only get to use US gov approved security cleared lawyers.
Every case gets the States Secrets treatment and the US legal professions notices the change and talks to the press. Hard to hide the lack of access to existing or pending cases and their clients or revoking a lawyers legal standing before a "secure" court at a state level due to fancy new federal crypto support :)
The lack of new federal interest in or public comment will confirm the code is broken on all devices of that generation.

The other option is an open court show trial to prove the federal crypto WIN in public, a method that is legally ready and any US lawyer can question in open court or call an expert on. All the cell phone trials pending are public and decrypted material is published in open court.
That public result will be clear for all generations and brand of phone. Conscription worked and the created master key is the very public informant.
That shows the GCHQ's decades of wisdom in never going to any court if at all possible and never having any of its experts near the open or secret legal system.

--
Domestic spying is now "Benign Information Gathering"
Re:Something is not right here.... by gweihir · 2016-03-21 23:23 · Score: 1

It is called "parallel construction" and it usually involves law "enforcement" lying under oath in court about the way they found something. Apparently it also works well when not under oath.

--
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.

Tin foil by rocqua · 2016-03-21 12:47 · Score: 5, Insightful

My guess: "shit we aren't winning in public. How do we retract this without saving face."

Re:Tin foil by Anubis+IV · 2016-03-22 02:45 · Score: 2

The polls between when it all started in mid-February and last week were rather telling. The numbers shifted from something like 70-30 in favor of the FBI to a nearly even 50-50 split (and that was despite the fact that the polls incorrectly phrased it as merely "have Apple unlock the phone for the FBI"). It was clear what direction things were heading as the courtroom drama stayed in the news, people became more informed, and more and more civil rights groups, companies, politicians, chiefs of various government organizations, and other public figures weighed in in support for Apple.

Not dropped by maitai · 2016-03-21 12:52 · Score: 4, Informative

The FBI didn't drop the case. They asked for and got a continuance until April 5th.

Re:Not dropped by whipslash · 2016-03-21 13:07 · Score: 1

You're right. Story updated.
Re: Not dropped by whipslash · 2016-03-21 14:49 · Score: 1

The hearing is dropped but not the entire case
Re:Not dropped by david_thornley · 2016-03-22 10:39 · Score: 1

I think they're dropping the case slowly, to avoid losing too obviously. The FBI can keep this from going anywhere until the press dies down, and quietly drop it. Like in the SCO case, the court system is designed to keep defendants from slowing the proceedings too much, so the plaintiff or agency demanding something can easily delay.

--
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes

Re:Comments by Anonymous Coward · 2016-03-21 12:52 · Score: 5, Insightful

1. "The government actually had this capability all along; they just wanted the precedent."

No...just, no. Facts not in evidence. Also makes no sense, because if "the government" had the capability, and was able to use it in secret, the whole discussion is moot.

No, because having the precedent would make the FBI's access into secure devices much easier in the future.

2. "But they need the precedent so they can force companies to weaken/break products that they really can't break in the future."

Again, no. As I can't guarantee the sun won't explode tomorrow, I similarly can't "guarantee" anything with regard to precedent, but it does not follow at all that any government victory in this narrow case somehow translates into the government being able to "force" vendors to do any such thing.

Why not? If the government can force Apple to write a whole new operating system so that it can break iPhone security, then what else could they force vendors to do?

3. "The government was afraid it was going to lose, so it had to slink back into the corner with its tail between its legs."

No. If the government did lose on this specific case, it would change nothing, because the phone would still be locked, and the questions still need to be answered.

Uh, if the government lost, then there would be concrete case law on the books that the All Writs Act isn't a "give us whatever we want" card.

4. Further, you couldn't really ask for a better case to use if all they were really going for was "precedent": an older, breakable phone made by a US company, used in an international terrorist attack on US soil, owned by a US county government agency, which has given full permission to search the device. So it's not like "the government" is now going to "wait for a better case".

Quite possibly. This case was pretty strong, in that a lot of people were supporting Team FBI.

5. If the government does drop the request, people get exactly what they wanted: the status quo.

But all of these questions still need answers:

Yep. I just hope the answer isn't going to be making National Security Letters the new standard MO.

The Problem is Cracking the Times Code by Anonymous Coward · 2016-03-21 13:02 · Score: 3, Informative

You don't have to break the encryption if you can subvert the code that counts the number of attempts, that could easily be done by altering one of the cpu instructions in the silicon or disabling it.. basically a brute force attack on the silicon. Another way would be to replace the CPU with a custom emulator of the CPU which could step around the sequence for destruction.. or simpler.. multiply the number of times by an arbitrarily chosen "factor".. or reset it to zero after each attempt.

Re:The Problem is Cracking the Times Code by shawn2772 · 2016-03-21 18:16 · Score: 2

You don't have to break the encryption if you can subvert the code that counts the number of attempts, that could easily be done by altering one of the cpu instructions in the silicon or disabling it
Nope. You're talking about very fundamental instructions like increment, compare, load, store, etc. If you alter or break how one of them functions (not that it's at all obvious how you could do that), you'd break the CPU completely, making it unable to execute simple code.

Another way would be to replace the CPU with a custom emulator of the CPU which could step around the sequence for destruction
Nope. The emulator wouldn't have access to the key burned into the CPU, so it couldn't compute the key to test.

or simpler.. multiply the number of times by an arbitrarily chosen "factor".. or reset it to zero after each attempt.
It may or may not be possible to restore the counter value. The value is almost certainly protected against simple updates (e.g. with a message authentication code), but it may be possible to roll it back, assuming it's not stored in a Replay Protected Memory Block (RPMB), or similar. RPMB is special flash that requires every write to be signed, and the signature includes a counter value and is increased on each operation, so replaying an old write command won't work, and only a device with the signing key (which would be burned into the CPU) could produce a valid write signature.
Here are some approaches that would work:
1. Carefully peel the CPU apart until you find the silicon that stores the key. Extract it, then you can easily brute force the PIN to decrypt the data. This is attack requires a fair amount of expertise and it requires lots of methodical, painstaking work, but it would work.
2. Connect probes to the memory bus and record everything that goes on as you boot the device and attempt to verify one password. Odds are good that at some point the key is written to or read from DRAM, though it is possible that it is transferred directly from the permanent storage location (likely on-chip fuses) to a hardware crypto engine in the CPU, in which case you won't see it and this won't work.
3. Insert a DRAM multiplexer between the mainboard and DRAM. Boot the device, which will verify the software and copy it into RAM. Let the device go to sleep (which will put the DRAM in self-refresh mode). Flip the muxer so the DRAM isn't connected to the device any more, but is instead connected to your own CPU. Read out all of the RAM contents. You may find the key, in which case you can easily brute force the PIN. If not, just write the DRAM to alter the code to skip the incrementing of the failure counter, then flip the muxer back and proceed to manually brute force the PIN.
I could probably come up with a few more. Without a separate secure processor that has it's own onboard RAM and storage (like the newer iOS devices have), there are lots of attacks available.
Re:The Problem is Cracking the Times Code by shawn2772 · 2016-03-23 01:10 · Score: 1

Or clock frequency/supply voltage attacks. If timed right one may be able to make the phone crash/do something else instead of counting the failed attempt.
Glitching attacks can work, but they're hit or miss, and I don't think the approach you suggest would work. The iOS 8 bug was that the failure counter was updated after the password was tested and the result returned, so just by cutting power very quickly after the failure the counter update could be prevented. The simple solution to this is to increment the failure counter *before* you check the password. If the check is successful, you then zero the counter. If not, cutting power or other glitching won't help because it was already updated.

very suspicious... by UVB-76 · 2016-03-21 13:06 · Score: 2

FBI drops its case on the same day that both OS X and IOS have updates rolled out...

McAfee by dejitaru · 2016-03-21 13:07 · Score: 4, Funny

Please oh please let there be a news release stating that the FBI went to John McAfee to unlock it...

Re:McAfee by mrclevesque · 2016-03-22 01:13 · Score: 2

or went here
https://www.aclu.org/blog/free...
(possible because its a 5c not a 5s)

FBI Blinks on a "May be able to", very suspicious by Proudrooster · 2016-03-21 13:21 · Score: 3, Insightful

This is not how good lawyers work, you throw as much as you possibly can at the wall and see what sticks.

There is no reason for the FBI to vacate unless they are 100% sure they can get into this phone. I mean wasn't this case important?

Here is what really happened. Apple's response to the FBI's "all writs" order posed a constitutional challenge to their BS. The FBI simply didn't want to get laughed out of court or worse have this make it all the way to the Supreme Court and be told that they were abusing the law.

Is there a way Apple can continue this ex-parte and set a precedent to stop this from being abused in the future? It would be of great benefit to all-tech-kind.

Oh wait, late breaking news. The case is not dropped, the FBI asked for a continuance until April so they can get some better lawyers and threaten Apple behind the scenes with National Security Letters.

So now we have an interesting play going on.

If the FBI hacks the phone, Apple loses the security high ground.
If the Apple hacks the phone, Apple loses the security high ground.

This is a lose/lose for Apple, because even if the FBI doesn't hack they phone they will say they did just to spite Tim Cook and his keynote speech today.

I see what you did there FBI, nice move, but be careful, your next move is critically important to winning the game and you can still lose.

I bet . . . by thecombatwombat · 2016-03-21 13:40 · Score: 1

. . . some brilliant agent finally thought to try 123456 on the pass code screen.

Re:I bet . . . by golgotha007 · 2016-03-22 01:30 · Score: 1

That's the stupidest combination I've ever heard in my life! That's the kind of thing an idiot would have on his luggage!

Re:Told you so by Proudrooster · 2016-03-21 13:42 · Score: 4, Interesting

Sure, anything is hackable, give the time. The point is that they are trying to make a secure box and they are standing up for our privacy. I don't think it is just marketing in this case. Apple's CEO is gay, and I think he, more than anyone realizes the implication of leaked private data. This is how governments own you, both foreign and domestic. These really nice guys swoop up all your breadcrumbs and look for anything that could be misconstrued or taken out of context, then threaten you with it.

Let's take a look at EmoWindt's phone and see what we can find.

That doesn't feel good does it?

Knowing that your location data, texts, calls, browser history, apps, music collection, notes, could be made public.

That is what Crapple is fighting against, and I hope they win. I don't want to live in Orwell's 1984.

In other words... by cirby · 2016-03-21 14:02 · Score: 2

...the local law enforcement guy who accidentally turned on the passcode after they found the phone found the Post-It note with the new code.

Re: lol by Anonymous Coward · 2016-03-21 14:16 · Score: 4, Insightful

Translation: They figured out they have a non trivial chance of losing this case so they 'discovered' this new alleged hack that they doubtless had all along.

The government used to do this in gun rights cases all the time--fold when they were gonna lose, which is why it took so long to finally get to the Supreme Court where, guess what? They lost. Just like they'll lose this one.

Next step: have the FBI manufacture a 'terrorist' to arrest who used strong encryption (provided by the FBI) so as to have an even more sympathetic case.

Re: DOJ did not want precedent from a loss in cour by mick129 · 2016-03-21 14:25 · Score: 4, Informative

It is cancelled: https://twitter.com/BrendanSas...

--
Move along, no sig to see here.

Re: That's AMAZING, I have the same combination on by mangamaster03 · 2016-03-21 14:29 · Score: 1

ROT13 is best. Higher numbers mean higher encryption. Everyone knows that.

Re:FBI Blinks on a "May be able to", very suspicio by Bing+Tsher+E · 2016-03-21 14:49 · Score: 1

It might be a little late to short some Apple.

Just get the info from Facebook or Google. by See+Attached · 2016-03-21 15:03 · Score: 1

They already have all the useful information. Or Apple Backups? Anything typed into a phone is replicated many times....

--
Time for a new Political party in the US (or two!) One is off the rails Other cant pony up a leader.

I don't see why it reflects badly on Apple. by Brannon · 2016-03-21 15:39 · Score: 1

Anything is breakable with enough time & money. This is all about making the cost higher to break an iPhone.

Re:I don't see why it reflects badly on Apple. by gweihir · 2016-03-21 23:25 · Score: 1

Not true in general. Likely true for this case.

--
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.

Re: DOJ did not want precedent from a loss in cour by Anonymous Coward · 2016-03-21 15:42 · Score: 3, Informative

It's not cancelled. They got a continuance. Kind of different.

It's in Apple's business interest? GOOD! by Ungrounded+Lightning · 2016-03-21 15:43 · Score: 1

Apple's concern about "security" is just a marketing ploy and posturing - that's it.

So they're ~just refusing to crack their own product for the US goverment because it's good for their business~?

No Karma Bonus Post Anonymously

GOOD!

If it's the right BUSINESS decision, they'll KEEP doing it. I trust that a LOT more than if they're doing it because it's the moral thing to do. Morals last until the stockholders replace the C-suite with fresh, intelligent, psychopaths from the big-name business schools. The profit motive lasts as long as the officers in charge are smart enough to see which side of the bread has the butter.

In this case the Apple execs judged that the situation was SO lopsided that it was worth risking the company and their own personal freedom to FIGHT THE US GOVERNMENT HEAD-ON rather than cooperate.

With the public show over that decision, it should last at least until they have deployed code they couldn't crack if they wanted to. Further, they now have the incentive to write that code, before the government gets a judge that will move against Apple and make the issue moot in the other direction, or the world market deserts them in droves and it becomes apparent that even Apple is not "too big to fail".

If the FBI or anyone else really wants to get in, they'll get in.

Being crackable by nation-state level outside attackers is only Apple's problem to the extent that, if true, it's another incentive to work on the future code to make it still more robust.

--
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way

Re:Comments by Chas · 2016-03-21 15:46 · Score: 2, Insightful

If the government can force Apple to write a whole new operating system

Its not a new OS, just a small code change. What Apple has that FBI lacks is the digital signature needed to install the modified firmware.
At least the FBI is not demanding that, though few would be surprised if the NSA already has it.

*Insert Standard Code Rant*

Unless you've actually SEEN the code, SHUT THE FUCK UP. You're not qualified to gauge how large or small such a change is. Nor how much effort it will take to alter/implement it.

--

Chas - The one, the only.
THANK GOD!!!

Re: Comments by Bartles · 2016-03-21 16:37 · Score: 1

Oh come on. It's not that hard to alter a counter so it doesn't increase.

Re:Counter sue by Aristos+Mazer · 2016-03-21 16:51 · Score: 1

Unfortunately, everything I've seen on that says the government is immune to these kinds of lawsuits. There's no way for Apple (or any other private citizen/company) to force a decision. The gov't gets to pick its favorite case.

Re: Comments by WarJolt · 2016-03-21 17:19 · Score: 1

It's not that simple, they'll have to sign the binary. *Sarcasm*

Re: That's AMAZING, I have the same combination on by deniable · 2016-03-21 17:32 · Score: 1

Yeah, but ROT-13 sucks for I18N and true geniuses use double ROT-13.

Re: Comments by Chas · 2016-03-21 17:36 · Score: 1

Please see parent post for my answer.

--

Chas - The one, the only.
THANK GOD!!!

Re:Comments by shawn2772 · 2016-03-21 17:53 · Score: 1

Yep. I just hope the answer isn't going to be making National Security Letters the new standard MO.

An NSL wouldn't help the FBI in a case like this. NSLs can only compel metadata in the company's possession. Apple doesn't possess the data on Farook's device, and so can't be ordered to extract and deliver the metadata.

Re:Comments by Dutch+Gun · 2016-03-21 18:38 · Score: 4, Interesting

Actually, it was Apple who qualified the changes. They claim it would take a handful of engineers spending four to six weeks, or something thereabouts. So, I guess for Apple that's relatively "minor". For a one-programmer shop like mine, that's fairly significant. Depends on your perspective, I guess.

My feeling is that the FBI saw that their chances in court were not looking great, so decided to accept the outside offers (NSA?) for cracking the phone that had in fact been available to them all this time. The excuse that they no longer need to crack the phone also allows them to back down without losing face.

--
Irony: Agile development has too much intertia to be abandoned now.

Re: lol by Alypius · 2016-03-21 18:44 · Score: 2

Next step: have the FBI manufacture a 'terrorist' to arrest who used strong encryption (provided by the FBI) so as to have an even more sympathetic case.

They tried this already. It was called "Fast and Furious" and the only reason why no one was indicted when it was discovered was that everyone involved were Democrats.

Re:I'm not sure whether this is good news or bad.. by rahvin112 · 2016-03-21 19:01 · Score: 4, Insightful

I shouldn't need to point out the obvious answer that everyone seems to avoid. If the FBI succeeds in this action they have precedent that they can force private companies and people to develop devices/software/whatever under threat of imprisonment for contempt of court (absolutely no appeals and you can be imprisoned until you cooperate up to life in prison). This would make the all writs act a law of incredible power allowing the FBI to impress into service any person or company with the ability to do something it needs for the investigation. Apple in this action is at best a third party, they developed and had manufactured the phone but they are neither the owner nor do they have access or the software to do what the FBI asks. The FBI is asking for them to be compelled to do work for the FBI under threat of imprisonment or divulging their most precious assets (a public release of which could decimate their company revenue).

With the precedent of this case, If you had the skill to do something the FBI needed for an investigation they could simply compel you to do so under the all writs act and if they refuse you could go to jail until you comply. This is ALL kinds of scary and 99% of the articles and comments I read about it focus on the insignificant details of this individual complaint and not the precedent it sets.

Re: Comments by Chas · 2016-03-21 19:54 · Score: 1

And the standard code rant says that until one knows what they're actually talking about, they don't actually have an opinion in the matter.

--

Chas - The one, the only.
THANK GOD!!!

Re:Told you so by fustakrakich · 2016-03-21 20:02 · Score: 1

I don't want to live in Orwell's 1984.

Not to worry. We're cutting straight to Golding's "Lord of the Flies".

--
“He’s not deformed, he’s just drunk!”

Re:Comments by Kartu · 2016-03-21 20:21 · Score: 1

...write a whole new operating system...

Patch existing operating system.

Re:Nah. by Kartu · 2016-03-21 20:22 · Score: 1

Do you realize, that backdoor is, in fact, ALREADY THERE, right?
What government demanded was access to an EXISTING backdoor, conveniently left there by Apple.

Lies. FBI never demanded the keys by Kartu · 2016-03-21 20:25 · Score: 1

Lies. FBI never demanded the keys, on the opposite, the whole "do it at your own headquarters, Apple" suggestion was so that FBI does not touch not only the keys (why would one need them anyway??? +5 interesting, pathetic) but that FBI doesn't touch even binaries for THAT SINGLE IPHONE.

Re:Lies. FBI never demanded the keys by david_thornley · 2016-03-22 10:30 · Score: 1

The FBI was trying to look reasonable while still forcing Apple to break their own security. The result of forcing Apple to break security would be court orders forcing Apple to break the security on the next couple thousand iPhones, and whatever pressure they could make to produce a universal tool that the FBI could distribute.

--
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes

Re:Comments by tripleevenfall · 2016-03-21 23:35 · Score: 4, Insightful

My guess is that the DOJ wanted the precedent - this is the Alinsky way, "never let a crisis go to waste". They thought that if people had the specter of a new terrorist attack hanging over their head's they'd be more malleable. Then they could use it for all sorts of purposes like tax evasion - as Obama clearly stated he wanted to do.

Turns out they were wrong, and the public and the industry didn't go along as easily as they'd hoped. Rather than suffer a judicial defeat which may be counterproductive to their aims, they just "find" an alternative at the 11th hour and move on.

Re:Comments by Joce640k · 2016-03-22 00:01 · Score: 2

Tax evasion? Start with Apple...

--
No sig today...

Re: lol by Joce640k · 2016-03-22 00:02 · Score: 3, Interesting

NO, next step is to find a whole load of "evidence" on the phone that could have prevented something or other.

"See, this is what Apple's delay has cost us!"

--
No sig today...

More accurate headline... by MitchDev · 2016-03-22 00:07 · Score: 4, Insightful

"FBI gonna get spanked in court, backs off temporarily..."

Re:More accurate headline... by elixircode · 2016-03-22 01:41 · Score: 1

I hope so!

Re:Um,it wasn't a terrorist. by MitchDev · 2016-03-22 00:08 · Score: 1

That's true, but if they call him and his wife "terrorists", due process and the constitution can be ignored and they can play the "You don't want to support the terrorists, do you?" card....

Re:FBI Blinks on a "May be able to", very suspicio by MitchDev · 2016-03-22 00:27 · Score: 1

"This is a lose/lose for Apple, because even if the FBI doesn't hack they phone they will say they did just to spite Tim Cook and his keynote speech today." And who seriously believes ANYTHING the FBI or NSA says any more aside from the Flavor-Aid drinkers?

Re:I'm not sure whether this is good news or bad.. by teh*fink · 2016-03-22 00:49 · Score: 1

With the precedent of this case, If you had the skill to do something the FBI needed for an investigation they could simply compel you to do so under the all writs act and if they refuse you could go to jail until you comply.

Sounds like a modern version of the Quartering Acts:
https://en.wikipedia.org/wiki/...

--
"I DARE you to make less sense!"

Re: lol by Jason+Levine · 2016-03-22 00:57 · Score: 2

In light of the Brussels attacks, the conspiracy theorist in me is wondering how long until they crack the phone and find "evidence' that he had used the phone to talk to the Brussels terrorists? "If only Apple had just caved in and done everything we told them to do from the start, lives could have been saved!"

--
My sci-fi novel, Ghost Thief, is now available from Amazon.com.

Re: lol by Gr8Apes · 2016-03-22 01:18 · Score: 1

They tried this already. It was called "Fast and Furious" and the only reason why no one was indicted when it was discovered was that everyone involved were Democrats.

So Bush was a democrat? It seems the entire project was started under the DOJ in 2006 as project Gunrunner, of which "Fast and Furious" was a new phase taken by Burke, a new Obama appointee. And apparently there were indictments, just not who you wanted. Burke was forced to resign.

--
The cesspool just got a check and balance.

Re: lol by jbengt · 2016-03-22 01:29 · Score: 1

It was called "Fast and Furious" and the only reason why no one was indicted when it was discovered was that everyone involved were Democrats.

Really? That program was started under the Bush administration.

Re: lol by bill_mcgonigle · 2016-03-22 01:30 · Score: 3, Insightful

Which is why Apple should oppose a motion to dismiss. It's "go big" but the only other option is "go home".

Apple can afford the fight but it cannot afford not to fight. Anything less than "dismissed with prejudice" is a loss, legall.

At least their PR might have been bolstered. I hate to say it, but if the iPhone 7 rejects unapproved signed firmware, I might actually buy one of the damn things.

--
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)

Re: Comments by The-Ixian · 2016-03-22 02:07 · Score: 1

Occam's razer is only applicable if you have all of the available information.

--
My eyes reflect the stars and a smile lights up my face.

Re: lol by sh00z · 2016-03-22 03:21 · Score: 1

At least their PR might have been bolstered. I hate to say it, but if the iPhone 7 rejects unapproved signed firmware, I might actually buy one of the damn things.

I thought that this (or something equivalent to it) was already in place, when the reports announced that this intrusion method would not work on a 5S or later iPhone.

Re: lol by sh00z · 2016-03-22 03:32 · Score: 1

Translation: They figured out they have a non trivial chance of losing this case so they 'discovered' this new alleged hack that they doubtless had all along.

I'd bet dollars to donuts (which phrase is about to become obsolete) that they're planning a smudge attack, which could only take ~7 tries...

Re:Comments by Cederic · 2016-03-22 04:11 · Score: 1

I think to be fair it's still a very minor change. A massive chunk of that time would be planning, design and testing - something you'd do in a couple of hours.

The code change is trivial, making sure it doesn't have ramifications that wipe the phone anyway aren't.

Re: lol by quintus_horatius · 2016-03-22 04:31 · Score: 3, Insightful

how long until they crack the phone and find "evidence' that he had used the phone to talk to the Brussels terrorists?

From what I've read recently, many of the European terrorists don't bother with encryption and just use burner phones. It makes you much harder to trace when your phone is essentially one-use -- its like using a one-time pad for perfect encryption.

I hardly think that someone would spend the money for an iPhone only to use it handful of times, and it seems like a poor idea to talk about illegal acts on a phone that you have a long-term relationship with. It's not just you taking chances with your own phone, either -- it's the chance that the people you're talking to get picked up, which leads the authorities back to you because they have your regular number. Better to use burners all around.

I'm pretty sure that all the FBI will find on the phone are call logs of him calling home, and cat pictures. (though the conspiracy theorist inside me says that they may announce that they found much more, I really think that's all they will actually find.)

Anyone notice the DAY of the week? by Anonymous Coward · 2016-03-22 04:34 · Score: 1

I scrolled through most comments on here and it seems no one picked up on one thing that makes this harder to believe. These are government employees. Underpaid, in crappy cubes, and prob not the best of the best... and they were working on a Sunday? Really? So a researcher/hacker/whatever is working on this late into Sat, plausible, and then on a Sunday calls or goes to his/her local FBI office? Come on. "Security" "Yes, this is -REDACTED-" "This building is closed on Sundays, please come back tomorrow." "But I have pwn3d a iphone!" "Congrats. Come back Monday." "But this is HUUUUGE." "OK Donald Trump, come back Monday." "But this will help their case against the dead guy who's phone they can't unlock" **BZZZZZZZ* "Come on in, I'll call in our tech squad."

Re: lol by MerlynEmrys67 · 2016-03-22 05:58 · Score: 1

Translation: They figured out they have a non trivial chance of losing this case so they 'discovered' this new alleged hack that they doubtless had all along.

You are not nearly cynical enough. Let me translate for you... They figured out they have a strong possibility of losing this case so they "discover" a hack that they announce they have. This causes Apples "security" value to plummet (Now everyone knows an iPhone is hackable - the US government said it is). There will be some back channel negotiations, they will come out and say - no it is completely secure, we couldn't get into the phone. Apple will quietly hack the phone and give the FBI the information that it wants

--
I have mod points and I am not afraid to use them

Re:Comments by macs4all · 2016-03-22 07:13 · Score: 1

My feeling is that the FBI saw that their chances in court were not looking great, so decided to accept the outside offers (NSA?) for cracking the phone that had in fact been available to them all this time. The excuse that they no longer need to crack the phone also allows them to back down without losing face.

You are exactly right. Nothing else makes sense. And, the Gummint is notorious for last-second things like this.

Re:Comments by macs4all · 2016-03-22 07:14 · Score: 1

My guess is that the DOJ wanted the precedent - this is the Alinsky way, "never let a crisis go to waste". They thought that if people had the specter of a new terrorist attack hanging over their head's they'd be more malleable. Then they could use it for all sorts of purposes like tax evasion - as Obama clearly stated he wanted to do.

Turns out they were wrong, and the public and the industry didn't go along as easily as they'd hoped. Rather than suffer a judicial defeat which may be counterproductive to their aims, they just "find" an alternative at the 11th hour and move on.

You are exactly correct.

Re: lol by macs4all · 2016-03-22 07:17 · Score: 1

NO, next step is to find a whole load of "evidence" on the phone that could have prevented something or other.

"See, this is what Apple's delay has cost us!"

You mean like the Belgium bombings today?

And yes, I do believe the FBI would go that far to manufacture a point.

Re:There's a better way... by david_thornley · 2016-03-22 10:41 · Score: 1

The flash memory isn't the issue. That's encrypted with AES-256, and is useless without the key. The decryption has to be done by a piece of hardware that can wipe the number the key is based on.

--
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes

Re: lol by Jason+Levine · 2016-03-23 00:32 · Score: 1

You're right that those bombers tend to use burner phones and unencrypted messaging (the Paris bombers used plain-text SMS). Still, that didn't stop some politicians from trying to claim that they could have stopped these attacks if only they had encryption back doors. Complete garbage, but many politicians can never pass up the chance to turn a tragedy into more power for themselves by tapping into people's fears.

--
My sci-fi novel, Ghost Thief, is now available from Amazon.com.

Re:Comments by Coren22 · 2016-03-23 01:45 · Score: 1

The tax avoidance Apple uses is the same one as every other corporation, and it is perfectly legal. If you have a problem with it, vote in a VAT, and it might fix the cause.

--
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?

Slashdot Mirror

FBI Delays Case Against Apple; May Have Way To Break Phone (threatpost.com)

157 of 255 comments (clear)