Slashdot Mirror

← Back to Stories (view on slashdot.org)

Apple Is Testing a Feature That Could Kill Police iPhone Unlockers (vice.com)

Posted by msmash on from the cat-and-mouse-race dept.

Lorenzo Franceschi-Bicchierai, reporting for Motherboard: On Monday, at its Worldwide Developers Conference, Apple teased the upcoming release of the iPhone's operating system, iOS 12. Among its most anticipated features are group FaceTime, Animoji, and a ruler app. But iOS 12's killer feature might be something that's been rumored for a while and wasn't discussed at Apple's event. It's called USB Restricted Mode, and Apple has been including it in some of the iOS beta releases since iOS 11.3.

The feature essentially forces users to unlock the iPhone with the passcode when connecting it to a USB accessory everytime the phone has not been unlocked for one hour. That includes the iPhone unlocking devices that companies such as Cellebrite or GrayShift make, which police departments all over the world use to hack into seized iPhones. "That pretty much kills [GrayShift's product] GrayKey and Cellebrite," Ryan Duff, a security researcher who has studied iPhone and is Director of Cyber Solutions at Point3 Security, told Motherboard in an online chat. "If it actually does what it says and doesn't let ANY type of data connection happen until it's unlocked, then yes. You can't exploit the device if you can't communicate with it."

17 of 187 comments (clear)

  1. Cludge fix? by sinij · · Score: 3, Interesting

    I admit, I don't know exactly how GrayKey and Cellebrite work. However, if viewed from proper access control and privileges point of view, it shouldn't be possible to siphon the kinds of data (e.g. contacts, calls) that it is reportedly capable of doing.

    So, could someone explain to me why they went with a solution that still leaves 1 hour window of opportunity to compromise a phone instead of fixing, what I guess are overly permissive privileges within the file system?

    1. Re:Cludge fix? by Anonymous Coward · · Score: 5, Informative

      I admit, I don't know exactly how GrayKey and Cellebrite work. However, if viewed from proper access control and privileges point of view, it shouldn't be possible to siphon the kinds of data (e.g. contacts, calls) that it is reportedly capable of doing.

      So, could someone explain to me why they went with a solution that still leaves 1 hour window of opportunity to compromise a phone instead of fixing, what I guess are overly permissive privileges within the file system?

      The file system isn’t left open, there are kernel exploits in iOS. Apple’s developers aren’t perfect and don’t know where they left things like buffer overflows that can be exploited. They fix them as they find them, but of course GrayKey won’t share its trade secret. Instead of thinking that patching every possible exploit is possible, they restrict access to the device so that although exploits will probably always exist, someone without the passcode can’t interact with the phone at all. Problem is though, when you forget your password with this feature, there is no restore. Cool brick!

    2. Re:Cludge fix? by bensafrickingenius · · Score: 4, Insightful

      I too was thrown by the 1 hour window. How often outside of sleepy time does one's phone remain unlocked for an entire hour?

      --
      I am not left-handed, either!
    3. Re:Cludge fix? by Anonymous Coward · · Score: 5, Funny

      I too was thrown by the 1 hour window. How often outside of sleepy time does one's phone remain unlocked for an entire hour?

      When the police seize it.

    4. Re:Cludge fix? by bondsbw · · Score: 5, Funny

      Apple’s developers aren’t perfect

      No no no... that's not how it works. Apple developers definitely are perfect, and everything they "fix" is really just better perfection.

      --
      All my liberal friends think I'm a conservative, all my conservative friends think I'm a liberal.
    5. Re:Cludge fix? by BorgDrone · · Score: 3, Insightful

      They don't need to patch every possible exploit, only ones that allow privilege escalation.

      Well, if you give them a list of exploits that these tools use, I'll bet they will be more than happy to fix them.

      if a product, like GrayKey and Cellebrite is released, then it is imperative that Apple reverse-engineer it to fix bugs they exploit.

      And to do that they need to get their hands on one of them first, and GrayKey/Cellebrite are doing everything they can to prevent that.

    6. Re:Cludge fix? by NFN_NLN · · Score: 4, Interesting

      The file system isn’t left open, there are kernel exploits in iOS. Apple’s developers aren’t perfect and don’t know where they left things like buffer overflows that can be exploited.

      I remember back in the satellite smart card hacking days when we had to "glitch" cards. We would put them in a special card reader and run commands through a loop over and over. As the commands were running through you could adjust the VCC voltage supplied to the card. If you hit the right timing/voltage the card would "glitch" and you could write to protected memory and gain access. You could buy unhacked cards by the hundreds and with enough skill 90% of the cards were glitchable. There isn't any amount of coding skill that can defend against a glitch like that.

    7. Re:Cludge fix? by KiloByte · · Score: 5, Informative

      How many privilege escalation and code execution flaws in, for example, current RHEL?

      With the default desktop, plug in any USB mass storage with a crafted filesystem. Even a simple filesystem like ext4 whose maintainer keeps religiously fuzzing it keeps popping up new exploitable flaws; no one bothers issuing CVEs nor even backporting patches to stable kernels for these (as the attack mode is known since forever, and there's only so much educating distro maintainers about security Tytso and co can do). Besides ext4, we have some ridiculously complex filesystems like btrfs or xfs, and plenty of unmaintained ones like qnx4/qnx6 that nevertheless have their modules enabled, including automount, on distro kernels.

      Red Hat/Fedora's default is to automount any inserted removable media, at least in the desktop version, even if the screen is locked. This is exactly a case of flaw discussed in this very article; I guess other USB sub-protocols other than mass storage also might have similarly egregious flaws. Shutting down recognizing any new USB devices (other than possibly dumb chargers) while locked is a long overdue fix.

      --
      The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
    8. Re:Cludge fix? by UnknowingFool · · Score: 5, Informative

      I'm not sure this change will affect GrayKey and Cellebrite anyway. My understanding is that they attack the phone's bootloader.

      How does GrayKey and Cellebrite get access to the boot loader? Cellebrite currently sells a small device that plugs into the phone.

      Eventually, law enforcement came to rely on Cellebrite's Universal Forensics Extraction Device, the UFED. It's a small, hand-held device that's easy to use. Police can simply plug in a phone and download the device's memory to a flash drive in a matter of seconds. That's how police can find your deleted text messages.

      GrayKey is a box that plugs into the Lightning port.

      The product itself is a gray box four inches deep by two inches tall, with two lightning cables sticking out of the front. Up to two phones can be plugged into the device at a time and are connected for about two minutes.

      If the iPhone refuses to communicate via cable then neither device can probably work unless the companies find a flaw they can exploit.

      --
      Well, there's spam egg sausage and spam, that's not got much spam in it.
    9. Re:Cludge fix? by AmiMoJo · · Score: 3, Interesting

      Reminds me of the attack that finally recovered the hidden Gameboy boot ROM. Up until that point it had to be replaced by an open source one in emulators. The ROM was inside the CPU, and the final instruction in it disabled the ability to read said ROM until the next reset.

      Someone realized they could simply count the number of clock cycles needed to exit the ROM after reset, then sent that number -1 and glitched the clock line. The glitch caused the ROM-read-disable instruction to be skipped and the ROM could be dumped with a custom cart.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    10. Re:Cludge fix? by msauve · · Score: 3, Interesting

      "I'm not sure this change will affect GrayKey and Cellebrite anyway."

      I'd assume that Apple has gotten their hands on one, knows how it works, and has used it to develop and test their new feature.

      --
      "National Security is the chief cause of national insecurity." - Celine's First Law
    11. Re:Cludge fix? by UnknowingFool · · Score: 4, Interesting

      Let's say that Apple can do this. The problem is that Apple is then limited to plugging every single flaw one at time. With this feature they can mitigate a whole class of exploits.

      --
      Well, there's spam egg sausage and spam, that's not got much spam in it.
  2. Hyperbole much? by Jason1729 · · Score: 4, Informative

    "Apple Is Testing a Feature That Could Kill Police iPhone Unlockers. " Um, the feature you describe will prevent current unlockers from working on an iPhone with the feature enabled. But it's not going to kill the unlocker. That conjures up imagery of something that will detect the unlocker and fire high voltage into it or some such.

    I guess my 4-digit pin kills anyone who tries to casually snoop at my phone.

  3. It could be so much easier! by idji · · Score: 4, Interesting

    What if your left thumb unlocked your phone and your right thumb wiped the device invisibly? The criminal could never know, you deniability and the police will be too scared to tap your dead finger to the phone.
    Or what if left-right-left unlocked and left-right-right wiped?

  4. Isn't Android doing this since years? by Zorpheus · · Score: 5, Insightful

    Sounds pretty much like it works in Android

  5. Seems illegal. by in10se · · Score: 4, Funny

    It seems like killing police for unlocking an iPhone would get Apple in trouble.

    --
    Popisms.com - Connecting pop culture
  6. Different Fingerprints: Different VMs by crow · · Score: 3, Interesting

    What I want is to have encrypted VMs on my phone, with different fingerprints unlocking different VMs. Or perhaps different levels of unlocking. Unlocking the phone doesn't have to be a binary operation.

    Something like this would also be great for handing my phone to my son so that he can play games, while locking him out of my email and such.