Slashdot Mirror
Cops Around the Country Can Now Unlock iPhones, Records Show (vice.com)
Law enforcement agencies across the country have purchased GrayKey, a relatively cheap tool for bypassing the encryption on iPhones, while the FBI pushes again for encryption backdoors, Motherboard reported on Thursday. From the report: FBI Director Christopher Wray recently said that law enforcement agencies are "increasingly unable to access" evidence stored on encrypted devices. Wray is not telling the whole truth. Police forces and federal agencies around the country have bought relatively cheap tools to unlock up-to-date iPhones and bypass their encryption, according to a Motherboard investigation based on several caches of internal agency documents, online records, and conversations with law enforcement officials. Many of the documents were obtained by Motherboard using public records requests.
The news highlights the going dark debate, in which law enforcement officials say they cannot access evidence against criminals. But easy access to iPhone hacking tools also hamstrings the FBI's argument for introducing backdoors into consumer devices so authorities can more readily access their contents.
The news highlights the going dark debate, in which law enforcement officials say they cannot access evidence against criminals. But easy access to iPhone hacking tools also hamstrings the FBI's argument for introducing backdoors into consumer devices so authorities can more readily access their contents.
Can someone speak to what the exploit is? Does it have to do with bypassing the 10 PIN entry lockout limit?
Lots of times, computer forensics can point to reasons for violent crime (ex: school shooters, the danish submarine rapist / murderer, etc). Text messages and other phone only communications can also help build models, which can only help prevent horrific crimes. Unlocking these phones is a step forward towards preventative enforcement vs punitive enforcement. This will reduce the number of people forced to live in barbaric and horrific prison conditions and increase the number of people who get the help they need plus reduce violent crimes, assuming those models are applied to live network traffic analysis.
We are on our own.
trumps everything.
Maybe not everything: a 256bit symmetric encryption purely in software with a true 256bit passphrase aka actual meaningful encryption. Which is pretty much much impractical for use with a phone: enter 256bit of passphrase everytime you want to use it, make a call? Pure masochism.
So there is no practical way to secure your phone and you have to act accordingly for any data you want to be protected. Either destroy your phone: is there a market for phones with thermite inside? Or don't use them for anything incriminating.
A $5 pipe wrench will always be successful at bypassing the multi-million dollar security appliance.
Zuck the police!
This is NOT the tool wanted. This tool means they have to have physical access to the phone.
What they REALLY want is a remote backdoor so they can spy on everyone in real time if they want.
Based on the quoted time to crack the exploit is likely using brute-force - the purpose of the device is to guess those while also disabling the usual 10-guess iOS limit before the device is locked. However, iOS supports complex passcodes as well, up to at least 90 alphanumeric characters, and these are are unlikely to be cracked.
Or do like me and NOT keep sensitive info of you frigging phone!
Sounds like the fellow may have committed the crime 18 U.S.C. 1001 (Making False Statements) on matters within the federal jurisdiction, regarding law enforcement activities....
...is what the FBI's agenda on this issue is. It's clearly not to fight organised crime or terrorism because they tend not to use encryption, opting for stolen, burner, and pay phones. What does defeating encryption do for them?
... if I have anything of interest to law enforcement, it isn't going to be sitting around in memory relying on the phone encryption as the only defense. It's going to be encrypted again, with my own keys, probably off-phone, and stored on DropBox or whatever for intermittent access. You are not going to brute force my AES encrypted password safe with 35 character password. Ain't gonna happen. You will get a bunch of location data so you can watch me commute to the work address you already have, but the damn thing goes into a Faraday cage every time I go anyplace interesting, or better yet, I send it with my wife and she marches it around the city while I am off doing secret things. /shrug Only the stupid criminals get caught.
The total and laughable failure of police here is a testament to government stupidity. Maybe if they weren't too busy arresting people for smoking a plant or giving speeding tickets to boost their coffers, maybe they could have figured this out. But what it means is privatized, focused enforcement is needed; it certainly DOESN'T mean give police more surveillance powers.
No one should have the right to see what you don't want them see, it's simple, it's easy and if the government / state disagrees, they can go fuck themselves.
as in plural... :)
[($)]
Real time snooping allows them to easily catch people in the act of committing crimes. And that's really how law enforcement sees things. It doesn't occur to them (or they don't care) that {...}
And also, they don't think that in the wrong hands, such tools could mean real-time hacking/stealing/etc. of people's phone, while they are attempting to conduct normal business :
A government-mandated backdoor that enable any random law-enforcement (be it with correct search warrant in order, or in abusive invasive state) to snoop in real time,
is also an entry point that could be abused by an attacker to steal personnal information of an unsuspecting user, divert money while they perform online-banking/online-shopping, steal sensitive corporate secret that they have stored encrypted (with the government-backdoored encryption), etc.
And here's the key problem :
- in the civilized modern world, there are only a few criminal try to organise nefarious deeds, that could be thwarted by a law enforcement agent eaves droping.
(common, there isn't *that* much crime going on in, e.g., Sweden, Danemark, Germany or Switzerland).
- at the same instant there's a massive amount of normal users conducting normal business that could get their stuff stolen if there's a hole in the security that is kept open by government law.
Backdoors solves very few problems (the limited amount of crimes) compared to the massive amount of problems it creates (nearly every random citizen is a potential victim of data-theft).
That's even with a well meaning government that doesn't have the slightest intent on spying on its citizen (see recent complain that advocating for privacy in Sweden is hard as few people see the government as a potential threat) or the government is a direct democracy (the people would need to vote themselves to allow the government to spy on them. Switzerland recently voted a reform of security laws that borders on that).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Didn't know the FBI were operating in my country.
iOS does not restrict your passcodes to 6 digits. That's just the default. Set a strong Alpha-Numeric password and the GrayKey will take hundreds of years to unlock your iPhone.
If this thing takes 3 or more hours to hacka a password, then I don't see how it's going to be used in a traffic stop, or anywhere else where
time is precious. They can't hold you for 3 hours while they hack your iPhone. That is unreasonable and most likely illegal.