FBI Delays Case Against Apple; May Have Way To Break Phone (threatpost.com)

msm1267 writes: The FBI has delayed its case against Apple less than a day before a scheduled court hearing and showdown over its demands that Apple help unlock a terrorist's iPhone. The government late Monday afternoon filed a motion to vacate its case, putting a halt to a saga that began in mid-February when a federal magistrate ordered Apple to help the FBI access a phone belonging to one of the shooters involved in last December's attack that killed 14 in San Bernardino, Calif.

The motion also indicates that the FBI may have found a way onto the phone without Apple's help. "On Sunday, March 20, 2016, an outside party demonstrated to the FBI a possible method for unlocking [shooter Syed] Farook's iPhone," the motion says. "Testing is required to determine whether it is a viable method that will not compromise data on Farook's iPhone. If the method is viable, it should eliminate the need for the assistance from Apple Inc. ("Apple") set forth in the All Writs Act Order in this case." Update 3/22/16 at 01:05:00 GMT: The story was updated to reflect the correct information that the case was delayed, not dropped. A federal judge agreed to postpone the oral arguments between Apple and the U.S. government.

Comments

Um

[war4peace]

See, life always finds a way :)
I meant hacking! HACKING!

Last we will hear of that....

[Tehrasha]

" it should eliminate the need for the assistance from Apple Inc. "

Until Apple fixes this exploit in the next release...

Re:Last we will hear of that....

[brantondaveperson]

You have your facts a bit wrong. Apple have stated it is possible to create software to break into its phones, but that doing so would a significant undertaking, and would compromise the security of their products. This is a perfectly fair position for them to take, and is backed up by all the facts that are available. At no point has anyone said that the iPhone 5C is "unbreakable". Never.

What people have said, however, and this is correct as far as anyone knows - there's no reason to doubt it - is that a newer iPhone with a strong passphrase is unbreakable for all practical purposes. A new iPhone with a 4-digit pin is breakable only with a special software release that can only be signed by Apple, just like the 5C. But, an iPhone 5C does not have the security baked right into the silicon, and so if you can dump all of the flash, you can brute force the PIN.

Also, the FBI has not yet broken into the phone without Apple's help. They still have to determine whether or not the method words, and rather importantly, whether or not doing so would compromise the admissibility of any evidence gathered.

Re:Last we will hear of that....

[brantondaveperson]

Again, trying to be fair to Apple, their new hardware usually is better. The secure enclave, which is a buzzword I've tried to avoid using, does sound extremely secure. Per-device IDs, key doesn't leave the chip, on-chip AES-256-CTR encryption that operates on the DMA channel, PIN and/or passcode never stored anywhere. I mean, it's pretty damn secure. It's hard to imagine how to reliably attack it even with physical access. Especially if the data is important, and screwing up means you don't get a second chance, ever.

FBI is a victim of the All Writs Act.

[Anonymous Coward]

Sounds like the FBI will be busy unlocking phones for hundreds of LE agencies now. Way to turn the burden around. In the meantime, the FBI posts "Now hiring for iPhone repair positions".

Re:FBI is a victim of the All Writs Act.

[shubus]

I still doubt they've cracked the iPhone....seems like a delaying tactic of the FBI since they're realized Apple's case is pretty strong and has a lot of support.

Nice way to try and destroy Apple's image

[JoeyRox]

The US Government knows that Apple has made encryption a cornerstone of their product strategy in order to protect their international sales in our post-Snowden era (in other words, to protect the world from the US Government). What better way to hit back at Apple for their lack of cooperation than to strike at the heart of Apple's strategy.

Re:Nice way to try and destroy Apple's image

[alvinrod]

There was always a way for them to gain access to that particular phone because it was an older model that didn't have the security features of their more recent devices to prevent those kinds of attacks. Basically some hacker found that they could hook a device up the phones innards and just try brute forcing the 4-digit PIN and that if they cut all power to the device on a failed attempt quickly enough that the system wouldn't register the failed attempt and wipe the device.

The FBI could always get into this phone, but they wanted Apple to give them the keys to get into any iPhone anytime that they wanted to. The only thing the FBI has probably done is drive Apple and other device makers to build security systems that they have no way of exploiting themselves, even if they have the ability to write a custom OS.

The government needs to stop trying to illegally invade the privacy of its citizens. All it's really doing is to hurt US businesses because foreign countries don't want anything to do with a country that's going to spy on all of their information or communications.

Re:Nice way to try and destroy Apple's image

[bigwheel]

Basically some hacker found that they could hook a device up the phones innards and just try brute forcing the 4-digit PIN and that if they cut all power to the device on a failed attempt quickly enough that the system wouldn't register the failed attempt and wipe the device.

But that would void the warranty.

Re:Nice way to try and destroy Apple's image

[SvnLyrBrto]

Well, there are two possibilities:

1) China has Apple, and every every other US tech company, compromised at the highest level, and we're all fucked.

2) China's government is not so much comprised of shit-for-brains idiots who have to get on television to appease a bunch of even more shit-for-brains idiots by appearing to "get tough on terr'ism." as ours. And while they'd no doubt like to be able to monitor all electronic communication with more efficiency than they do; they understand that forcing tech companies to build in that backdoor not only lets them do so, but lets everyone else spy on them that much more easily too.

Personally, I'm hoping for #2.

Re: Nice way to try and destroy Apple's image

[jxander]

Sounds more like the "one failed attempt" counter passes through RAM before being stored in non-volatile memory.

If you can rig up something to detect that message in RAM and hard-power-down the system before it transitions the data, you could have unlimited attempts.

If we assume they do this on every single attempt, and it takes exactly 1 minute to reboot and try again, you could brute force all 10,000 possible 4-digit numerics in just under a week.

Of course ... That's all wild speculation. I could be way off base.

Outside Party?

[TechyImmigrant]

So who is this outside party? Who's going to be the first to file an FOIA request?

Re:Outside Party?

[somenickname]

John McAfee, obviously.

Re:Outside Party?

[bughunter]

My money's on the NSA.

But whoever it is, I believe they knew they had this option all along.

They had the best experts in the world telling them that it could be broken, but they pursued the matter in the courts instead.

Re:Outside Party?

[Tehrasha]

If I had to guess, I would say it was Johns Hopkins University.....

https://www.washingtonpost.com...

Re:Outside Party?

[aaron44126]

This may be it. I heard an interview on NPR with an ex-NSA guy and this topic came up. He said his advice to the FBI, if he still worked in the government, would be something along the lines of "Bring the phone to the NSA and we will solve this problem for you." He said he had spoken to a number of experts who believed that the NSA has the resources to unlock this phone, but the FBI hadn't asked them, as they were more interested in the precedent than the result.

I'm not sure whether this is good news or bad...

[JMZero]

I certainly don't think that any information about this phone (or some new approach to getting info off it) is what prompted the change here. Giving up at this stage means one of two things:

1. They flinched. They thought they'd lose, either in court or in public opinion - so they kicked the can down the road.
2. They've already won; they know that legislation is about to become more favorable for them, and they'll have the tools they want without needing a precedent here.
3. They've already lost; they know that there will soon be enough robust/secure devices in the wild that having leverage over companies like Apple won't actually help them (because the Apple's of the world may not be able to break their own devices)

We'll find out which it is over the next few years.

Health

[Major Blud]

During Tim Cook's presentation today, I couldn't help thinking that they were pushing CareKit to make people start to consider how much information about their health would be on these devices, and who else could potentially have access to it. I could simply be overthinking it, but it very well could have been that he was trying to win over more people to Apple's side of the argument.

Translation: Next Time......

[Anonymous Coward]

Translation: Next time the FBI sues someone to force them to break encryption it will be someone that can't fight back, and they will get their precedence then.

DOJ did not want precedent from a loss in court

[xeno]

The last salvo from Apple's lawyers was fairly devastating to the DOJ's case: It pointed out errors of law, errors of logic, technical mistakes and omissions, and general arrogance. The DOJ knew lat week that they were getting shot down, so they'd rather not have that happen in court where it could affect their future error-and-arrogance-filled filings.

Last week someone pointed out that Apple has far better lawyers than the DOJ. True. Tragic, sad, demoralizing as an American, but obviously true.

Re:DOJ did not want precedent from a loss in court

[Darinbob]

Don't think the lawyers are necessarily better or worse. Apple has the larger budget to spend on this one issue. The higher pay also does not mean that the government is stuck with the leftovers who couldn't find a better job; I have a friend who quit being a lawyer to join the FBI as an agent with much lower pay. Some people value public service.

Re:DOJ did not want precedent from a loss in court

[david_thornley]

We're talking about an iPhone 5c, and Apple no longer sells them. The iPhone 5S (the next version) had enhanced security, so if anything it gives Apple some leverage to suggest upgrading the phones.

As far as waiting for the next terrorist attack to take place, that's pretty much what they have to do anyway.

I'm pretty sure there's nothing useful on the phone in question, because if there was the FBI would have snarfed the data before they ordered the County office that issued it to change a password and destroy access.

Something is not right here....

[erp_consultant]

So the government is dropping the case because some third party might have a way to break into the phone? Might have a way? So they haven't even verified that it works before dropping the case? Why not let the case proceed and if they come to find out later that the 3rd party method works then drop the case?

Surely it can't be to save taxpayer money. That has never been a criteria for any branch of government when it comes to prosecution (errr...persecution). Maybe the FBI had a way to break into the phone all along and this was just a shakedown of Apple.

Are we really to believe that some mysterious "3rd party" just suddenly appears a day before the case is to go to court? I call BS on this whole thing.

Re: Something is not right here....

[maitai]

They didn't drop it. They got a continuance until April 5th to see if they can actually get into the phone themselves. Article is really way off.

Re:Something is not right here....

[whipslash]

Yes you're right. Story updated.

Tin foil

[rocqua]

My guess: "shit we aren't winning in public. How do we retract this without saving face."

Re:Tin foil

[Anubis IV]

The polls between when it all started in mid-February and last week were rather telling. The numbers shifted from something like 70-30 in favor of the FBI to a nearly even 50-50 split (and that was despite the fact that the polls incorrectly phrased it as merely "have Apple unlock the phone for the FBI"). It was clear what direction things were heading as the courtroom drama stayed in the news, people became more informed, and more and more civil rights groups, companies, politicians, chiefs of various government organizations, and other public figures weighed in in support for Apple.

Not dropped

[maitai]

The FBI didn't drop the case. They asked for and got a continuance until April 5th.

Re:Comments

[Anonymous Coward]

1. "The government actually had this capability all along; they just wanted the precedent."

No...just, no. Facts not in evidence. Also makes no sense, because if "the government" had the capability, and was able to use it in secret, the whole discussion is moot.

No, because having the precedent would make the FBI's access into secure devices much easier in the future.

2. "But they need the precedent so they can force companies to weaken/break products that they really can't break in the future."

Again, no. As I can't guarantee the sun won't explode tomorrow, I similarly can't "guarantee" anything with regard to precedent, but it does not follow at all that any government victory in this narrow case somehow translates into the government being able to "force" vendors to do any such thing.

Why not? If the government can force Apple to write a whole new operating system so that it can break iPhone security, then what else could they force vendors to do?

3. "The government was afraid it was going to lose, so it had to slink back into the corner with its tail between its legs."

No. If the government did lose on this specific case, it would change nothing, because the phone would still be locked, and the questions still need to be answered.

Uh, if the government lost, then there would be concrete case law on the books that the All Writs Act isn't a "give us whatever we want" card.

4. Further, you couldn't really ask for a better case to use if all they were really going for was "precedent": an older, breakable phone made by a US company, used in an international terrorist attack on US soil, owned by a US county government agency, which has given full permission to search the device. So it's not like "the government" is now going to "wait for a better case".

Quite possibly. This case was pretty strong, in that a lot of people were supporting Team FBI.

5. If the government does drop the request, people get exactly what they wanted: the status quo.

But all of these questions still need answers:

Yep. I just hope the answer isn't going to be making National Security Letters the new standard MO.

The Problem is Cracking the Times Code

[Anonymous Coward]

You don't have to break the encryption if you can subvert the code that counts the number of attempts, that could easily be done by altering one of the cpu instructions in the silicon or disabling it.. basically a brute force attack on the silicon. Another way would be to replace the CPU with a custom emulator of the CPU which could step around the sequence for destruction.. or simpler.. multiply the number of times by an arbitrarily chosen "factor".. or reset it to zero after each attempt.

Re:The Problem is Cracking the Times Code

[shawn2772]

You don't have to break the encryption if you can subvert the code that counts the number of attempts, that could easily be done by altering one of the cpu instructions in the silicon or disabling it

Nope. You're talking about very fundamental instructions like increment, compare, load, store, etc. If you alter or break how one of them functions (not that it's at all obvious how you could do that), you'd break the CPU completely, making it unable to execute simple code.

Another way would be to replace the CPU with a custom emulator of the CPU which could step around the sequence for destruction

Nope. The emulator wouldn't have access to the key burned into the CPU, so it couldn't compute the key to test.

or simpler.. multiply the number of times by an arbitrarily chosen "factor".. or reset it to zero after each attempt.

It may or may not be possible to restore the counter value. The value is almost certainly protected against simple updates (e.g. with a message authentication code), but it may be possible to roll it back, assuming it's not stored in a Replay Protected Memory Block (RPMB), or similar. RPMB is special flash that requires every write to be signed, and the signature includes a counter value and is increased on each operation, so replaying an old write command won't work, and only a device with the signing key (which would be burned into the CPU) could produce a valid write signature.

Here are some approaches that would work:

1. Carefully peel the CPU apart until you find the silicon that stores the key. Extract it, then you can easily brute force the PIN to decrypt the data. This is attack requires a fair amount of expertise and it requires lots of methodical, painstaking work, but it would work.

2. Connect probes to the memory bus and record everything that goes on as you boot the device and attempt to verify one password. Odds are good that at some point the key is written to or read from DRAM, though it is possible that it is transferred directly from the permanent storage location (likely on-chip fuses) to a hardware crypto engine in the CPU, in which case you won't see it and this won't work.

3. Insert a DRAM multiplexer between the mainboard and DRAM. Boot the device, which will verify the software and copy it into RAM. Let the device go to sleep (which will put the DRAM in self-refresh mode). Flip the muxer so the DRAM isn't connected to the device any more, but is instead connected to your own CPU. Read out all of the RAM contents. You may find the key, in which case you can easily brute force the PIN. If not, just write the DRAM to alter the code to skip the incrementing of the failure counter, then flip the muxer back and proceed to manually brute force the PIN.

I could probably come up with a few more. Without a separate secure processor that has it's own onboard RAM and storage (like the newer iOS devices have), there are lots of attacks available.

very suspicious...

[UVB-76]

FBI drops its case on the same day that both OS X and IOS have updates rolled out...

McAfee

[dejitaru]

Please oh please let there be a news release stating that the FBI went to John McAfee to unlock it...

Re:McAfee

[mrclevesque]

or went here

https://www.aclu.org/blog/free...

(possible because its a 5c not a 5s)

FBI Blinks on a "May be able to", very suspicious

[Proudrooster]

This is not how good lawyers work, you throw as much as you possibly can at the wall and see what sticks.

There is no reason for the FBI to vacate unless they are 100% sure they can get into this phone. I mean wasn't this case important?

Here is what really happened. Apple's response to the FBI's "all writs" order posed a constitutional challenge to their BS. The FBI simply didn't want to get laughed out of court or worse have this make it all the way to the Supreme Court and be told that they were abusing the law.

Is there a way Apple can continue this ex-parte and set a precedent to stop this from being abused in the future? It would be of great benefit to all-tech-kind.

Oh wait, late breaking news. The case is not dropped, the FBI asked for a continuance until April so they can get some better lawyers and threaten Apple behind the scenes with National Security Letters.

So now we have an interesting play going on.

If the FBI hacks the phone, Apple loses the security high ground.
If the Apple hacks the phone, Apple loses the security high ground.

This is a lose/lose for Apple, because even if the FBI doesn't hack they phone they will say they did just to spite Tim Cook and his keynote speech today.

I see what you did there FBI, nice move, but be careful, your next move is critically important to winning the game and you can still lose.

Re:Told you so

[Proudrooster]

Sure, anything is hackable, give the time. The point is that they are trying to make a secure box and they are standing up for our privacy. I don't think it is just marketing in this case. Apple's CEO is gay, and I think he, more than anyone realizes the implication of leaked private data. This is how governments own you, both foreign and domestic. These really nice guys swoop up all your breadcrumbs and look for anything that could be misconstrued or taken out of context, then threaten you with it.

Let's take a look at EmoWindt's phone and see what we can find.

That doesn't feel good does it?

Knowing that your location data, texts, calls, browser history, apps, music collection, notes, could be made public.

That is what Crapple is fighting against, and I hope they win. I don't want to live in Orwell's 1984.

In other words...

[cirby]

...the local law enforcement guy who accidentally turned on the passcode after they found the phone found the Post-It note with the new code.

Re: lol

[Anonymous Coward]

Translation: They figured out they have a non trivial chance of losing this case so they 'discovered' this new alleged hack that they doubtless had all along.

The government used to do this in gun rights cases all the time--fold when they were gonna lose, which is why it took so long to finally get to the Supreme Court where, guess what? They lost. Just like they'll lose this one.

Next step: have the FBI manufacture a 'terrorist' to arrest who used strong encryption (provided by the FBI) so as to have an even more sympathetic case.

Re: DOJ did not want precedent from a loss in cour

[mick129]

It is cancelled: https://twitter.com/BrendanSas...

Re: DOJ did not want precedent from a loss in cour

[Anonymous Coward]

It's not cancelled. They got a continuance. Kind of different.

Re:Comments

[Chas]

If the government can force Apple to write a whole new operating system

Its not a new OS, just a small code change. What Apple has that FBI lacks is the digital signature needed to install the modified firmware.
At least the FBI is not demanding that, though few would be surprised if the NSA already has it.

*Insert Standard Code Rant*

Unless you've actually SEEN the code, SHUT THE FUCK UP. You're not qualified to gauge how large or small such a change is. Nor how much effort it will take to alter/implement it.

Re:Comments

[Dutch Gun]

Actually, it was Apple who qualified the changes. They claim it would take a handful of engineers spending four to six weeks, or something thereabouts. So, I guess for Apple that's relatively "minor". For a one-programmer shop like mine, that's fairly significant. Depends on your perspective, I guess.

My feeling is that the FBI saw that their chances in court were not looking great, so decided to accept the outside offers (NSA?) for cracking the phone that had in fact been available to them all this time. The excuse that they no longer need to crack the phone also allows them to back down without losing face.

Re: lol

[Alypius]

Next step: have the FBI manufacture a 'terrorist' to arrest who used strong encryption (provided by the FBI) so as to have an even more sympathetic case.

They tried this already. It was called "Fast and Furious" and the only reason why no one was indicted when it was discovered was that everyone involved were Democrats.

Re:I'm not sure whether this is good news or bad..

[rahvin112]

I shouldn't need to point out the obvious answer that everyone seems to avoid. If the FBI succeeds in this action they have precedent that they can force private companies and people to develop devices/software/whatever under threat of imprisonment for contempt of court (absolutely no appeals and you can be imprisoned until you cooperate up to life in prison). This would make the all writs act a law of incredible power allowing the FBI to impress into service any person or company with the ability to do something it needs for the investigation. Apple in this action is at best a third party, they developed and had manufactured the phone but they are neither the owner nor do they have access or the software to do what the FBI asks. The FBI is asking for them to be compelled to do work for the FBI under threat of imprisonment or divulging their most precious assets (a public release of which could decimate their company revenue).

With the precedent of this case, If you had the skill to do something the FBI needed for an investigation they could simply compel you to do so under the all writs act and if they refuse you could go to jail until you comply. This is ALL kinds of scary and 99% of the articles and comments I read about it focus on the insignificant details of this individual complaint and not the precedent it sets.

Re:Comments

[tripleevenfall]

My guess is that the DOJ wanted the precedent - this is the Alinsky way, "never let a crisis go to waste". They thought that if people had the specter of a new terrorist attack hanging over their head's they'd be more malleable. Then they could use it for all sorts of purposes like tax evasion - as Obama clearly stated he wanted to do.

Turns out they were wrong, and the public and the industry didn't go along as easily as they'd hoped. Rather than suffer a judicial defeat which may be counterproductive to their aims, they just "find" an alternative at the 11th hour and move on.

Re:Comments

[Joce640k]

Tax evasion? Start with Apple...

Re: lol

[Joce640k]

NO, next step is to find a whole load of "evidence" on the phone that could have prevented something or other.

"See, this is what Apple's delay has cost us!"

More accurate headline...

[MitchDev]

"FBI gonna get spanked in court, backs off temporarily..."

Re: lol

[Jason Levine]

In light of the Brussels attacks, the conspiracy theorist in me is wondering how long until they crack the phone and find "evidence' that he had used the phone to talk to the Brussels terrorists? "If only Apple had just caved in and done everything we told them to do from the start, lives could have been saved!"

Re: lol

[bill_mcgonigle]

Which is why Apple should oppose a motion to dismiss. It's "go big" but the only other option is "go home".

Apple can afford the fight but it cannot afford not to fight. Anything less than "dismissed with prejudice" is a loss, legall.

At least their PR might have been bolstered. I hate to say it, but if the iPhone 7 rejects unapproved signed firmware, I might actually buy one of the damn things.

Re: lol

[quintus_horatius]

how long until they crack the phone and find "evidence' that he had used the phone to talk to the Brussels terrorists?

From what I've read recently, many of the European terrorists don't bother with encryption and just use burner phones. It makes you much harder to trace when your phone is essentially one-use -- its like using a one-time pad for perfect encryption.

I hardly think that someone would spend the money for an iPhone only to use it handful of times, and it seems like a poor idea to talk about illegal acts on a phone that you have a long-term relationship with. It's not just you taking chances with your own phone, either -- it's the chance that the people you're talking to get picked up, which leads the authorities back to you because they have your regular number. Better to use burners all around.

I'm pretty sure that all the FBI will find on the phone are call logs of him calling home, and cat pictures. (though the conspiracy theorist inside me says that they may announce that they found much more, I really think that's all they will actually find.)