Professor proves NAND mirroring attack thwarts iPhone 5c security protocols

13»

Comments

  • Reply 41 of 41
    hungover said:
    Rosyna said:
    hungover said:
    foggyhill said:
    Didn't we ALREADY know that. I actually knew that without even trying (because I'm a computer engineer).
    That; why Apple changed it later.
    It's not an easy attack though; if a person is doing that to your phone, I'm guessing you can spring for an Iphone 7...
    If Apple were aware that the data could be extracted from the 5c using that technique why did they refuse to help the FBI and insist that the only way to extract the data would require custom code that could fall into the hands of criminals?

    Apple could have helped the FBI and then said "sorry guys, as much as we'd like to, we can't help you with any newer handsets" . Doing so would have been likely to have strengthened their case against future law enforcement demands and saved the public purse a shed load of money.
    No, what it proves is that the FBI never needed Apple's help at all. That the FBI's attempt to coerce a
    Apple was just to set a precedent so Apple couldn't refuse to help them in the future.

    That's also why the FBI used a phone in PR that they knew had absolutely nothing of value on it.
    Sorry, I am having problems following your logic.

    According to Foggyhill, Apple knew that the 5C could be subjected to a NAND attack when they released it (and presumably believed that the 5S, released at the same time would be protected from the method). He/she seems to be suggesting that it would have been common knowledge.

    By insisting that the FBI never needed help, you appear to be concurring with him/her.

    So why did Apple tell the courts that helping the FBI would require them to create a "backdoor" custom boot code? Did Apple and the FBI both lie to the courts and the public?

    Regarding precedent setting- Yes a phone used by a terrorist is very emotive and the FBI may have assumed that it would swing public favour in their direction (regardless of the  value of the data on it). Nevertheless, Apple simply needed to explain that the newer handsets with the security enclaves could not be cracked using the same techniques if at all, thus negating any attempts to set a precedent.

    And why would the FBI then pay (reputedly) a million dollars to a third party to crack the phone and drop the supposed "precedent" setting case?


    It's because the FBI explicitly demanded a backdoor. They did not ask that Apple use some hardware approach to break into that phone. All parties agreed that doing so could damage the data on the phone, and since the FBI'/ actual motivation was to secure from Apple a backdoor, they deliberately avoided adding to the conversation any notion of asking Apple to perform this type of NAND mirroring technique. The fact the press was talking about it as a possibility is a separate issue from the carefully crafted communication between the FBI and Apple.

     As to why Apple might not bring it up, it could be as simple as the fact that Apple doesn't want to get into the business of becoming a forensics lab, with all the heavy burden of documenting processes used to gather evidence and dealing with the challenges brought by defense attorneys, which would require handing over to defense experts details or any technique used to hack into an iPhone. This is also a part of the reason they wouldn't want to provide a backdoor; because defense attorneys could legally require them to hand over source code, and then iPhone'/ security secrets would be flying around in the hands of those who are assigning, or hired, to represent the world's baddest of bad actors. And every hacker who could hack their servers. And every other ad actor who could pay them for a copy. Nope, Apple avoided that whole slippery slope for very valid reasons.
    "It's because the FBI explicitly demanded a backdoor." 

    Good point, having looked in to the original demand, you are correct.

     "defense attorneys could legally require them to hand over source code,...And every hacker who could hack their servers"

    I note that the FBI later amended the demand to allow Apple to keep the phone on site and to destroy the software after the FBI had remotely accessed the data on the phone. Why would the dead suspect have a defence attorney?
Sign In or Register to comment.