Cellbrite is widely suspected to be using NAND mirroring, a method that's been demonstrated as a proof of concept. They de-solder the memory chip, clone it thousands of times, and then install an external interface on the phone so the chip can be easily replaced. Each chip gets six passcode tries before lockout, then they swap it out for the new one.
that sounds far too expensive to do for 1500 bucks a phone.
Oh boy!!! So what’s Apple to do now if this is really true about everything up to IOS being compromised?? A big selling point for me going with Apple is knowing they would never divulge any personal information I was texting or emailing to other Apple usures.
Security of Apple’s products is an important selling point, this news is a big problem. With Android you might be able to go with a 3rd party solution (like full disk encryption) but that’s not possible with Apple.
Cellibrite’s announcement is basically reporting a zero-day flaw in iOS. The problem is Apple has no information about the flaw, and Cellibrite isn’t likely to tell them.
The only thing I can think of is Apple buying rights to the exploit, and perhaps hiring them to find more. At that point Israel might get involved...
Also, there is nothing stopping someone else finding the same vulnerability, with the iBoot code already out there. Whatever happens this is going to cost Apple a bundle.
The problem here is that people like you believe that electronic devices can be made completely secure. That will never happen. While the thought of security may appeal to some people it is an indication in my mind that they don't understand fundamental issue with the technology. Sort of like people demanding gun control that don't understand a damn thing about guns.
To put it another way if you buy apple products because you think they are secure you completely misunderstand the technology.
Oh boy!!! So what’s Apple to do now if this is really true about everything up to IOS being compromised?? A big selling point for me going with Apple is knowing they would never divulge any personal information I was texting or emailing to other Apple usures.
And they still won't... someone else is claiming to be able to bypass Apple's security, Apple hasn't given up anything to help or allow that to happen.
Probably but they could care less and the FBI absolutely could care less how they get the data—if they actually did.
I wonder what a court would say.
A US federal court would likely not care what the Apple user agreement says. They would only be concerned with the requirements of the US Constitution and supporting law and precedence.
I'm not sure I would agree that a US Federal Count would not be interested in a breach of contract case.
Except Celebrite or the FBI didn't sign the TOS, the owner of the device (presumably) did. So no one is violating any TOS. And TOS's aren't much better than shrink-wrap license agreements which the courts said were worthless long ago.
We can only hope that they won't perform the service for countries with less then stellar record for human rights... (rhymes with prussia, rina and audi)
We can only hope that they won't perform the service for countries with less then stellar record for human rights... (rhymes with prussia, rina and audi)
hahaha, because the US is any better?
Yes, the US is better. Not perfect, for sure, but definitely better.
Probably but they could care less and the FBI absolutely could care less how they get the data—if they actually did.
I wonder what a court would say.
A US federal court would likely not care what the Apple user agreement says. They would only be concerned with the requirements of the US Constitution and supporting law and precedence.
I'm not sure I would agree that a US Federal Count would not be interested in a breach of contract case.
The Terms of Service is a "contract" between Apple and the owner of the phone, not Apple and the FBI, or any other agent of the government, and as such is in no way binding on any third party. There is no "breach of contract." If the FBI has probable cause or a warrant to search the phone, no TOS has any legal force to stop them.
In addition, a court issued warrant trumps any contract that doesn't involve national security, and even then a FISA warrant will do the trick. No matter what terms to which you and another party have agreed, if a warrant's terms require you to violate them, you will, or you'll potentially go to jail, suffer fines, or worse, for not doing so.
Oh boy!!! So what’s Apple to do now if this is really true about everything up to IOS being compromised?? A big selling point for me going with Apple is knowing they would never divulge any personal information I was texting or emailing to other Apple usures.
Security of Apple’s products is an important selling point, this news is a big problem. With Android you might be able to go with a 3rd party solution (like full disk encryption) but that’s not possible with Apple.
Cellibrite’s announcement is basically reporting a zero-day flaw in iOS. The problem is Apple has no information about the flaw, and Cellibrite isn’t likely to tell them.
The only thing I can think of is Apple buying rights to the exploit, and perhaps hiring them to find more. At that point Israel might get involved...
Also, there is nothing stopping someone else finding the same vulnerability, with the iBoot code already out there. Whatever happens this is going to cost Apple a bundle.
Mmm. Not so sure about that.
This break doesn’t sound like something that is going to be packaged in an app any time soon. You send the phone to Cellebite and their trained specialists handle the break. If it requires dismantling the phone then I’m not sure knowing how it’s done is going to mean Apple will think it’s worthwhile guarding against it.
And if Cellebite is dismantling the phone then it’s not a flaw in iOS.
I too have the ability to access devices running iOS11. I can unlock my phone, my wifes, my sons ipad, and my own ipad. I simply place my finger on the home button and VIOLA! It's unlocked.
This is interesting. What does Celebrite know that Apple doesn't know (yet) about their own OS?
My guess would be absolutely nothing. Apple isn't dumb enough to think they have a 100%, fully sealed security system that could never be exploited. Given enough time anything can be broken into. It's just a cat and mouse game for both sides, and as long as Apple is willing to keep getting better and more secure I will continue to trust them without question. All anyone would find is pictures of my kid with a lost tooth or various model/serial numbers I snap in order to search online for parts on my phone, but the fact that governments are having such a hard time getting into devices means the bad guys (no politics, please) also are at a loss. As opposed to some of Apple's competitors who flaunt how open and easy it is for people to take over your device or the info on it.
Cellbrite is widely suspected to be using NAND mirroring, a method that's been demonstrated as a proof of concept. They de-solder the memory chip, clone it thousands of times, and then install an external interface on the phone so the chip can be easily replaced. Each chip gets six passcode tries before lockout, then they swap it out for the new one.
that sounds far too expensive to do for 1500 bucks a phone.
Considering that the Shenzhen black market can swap out your iPhone's flash memory chip for less than $100, I'd say that removing the memory chip (to clone it) is not a big deal.
Pretty much any security measure can be defeated given enough time, money, or jumper cables & car batteries.
Unfortunately that’s very true. Usually the best we (Apple, etc.) can do is increase the cost enough that “they” go after someone else. The “They” is usually hackers, but unfortunately (or fortunately) depending upon your perspective ‘nation states’ have essentially unlimited funds. Lately, the discussion of security, privacy, backdoors, etc. have become (devolved to?) PR battles.
Yeah, this is really a non-technological problem that is rooted in human trust, or lack thereof. No system or technology that depends on or is influenced by humans in some way will ever be 100% trustworthy. There are of course times when this inherent human failing has worked to the advantage of one side of the trust relationship over the other. Without crypto cracks and code breakers the post WWII world would be a much different place than it is today. Unfortunately we are confronted with many more trust boundaries today than at any time in human existence and they reach down to nearly everyone and involve dependencies that affect many critical facets of our personal lives. I have no problem admitting that I have no idea how we're going to address these complexities that I believe are much more challenging than any public official at any level would purport to understanding, which are in turn a small fraction of the staggering number of real issues that actually exist. We're just nibbling around the edges. A reasonable first step to me would be to come up with non-absolutist compromise solutions that improve the situation until a better solution is found. These compromises may involve making some things that authorities desire harder to get at and some of the things individuals want to keep secret more accessible to authorities. Without compromises each side will keep trying to beat the other one into submission, which never ends well. Historically, the authoritarian side usually emerges victorious and everyone else has to fall into line. That's not a good outcome but it is an increasingly probable one.
We can only hope that they won't perform the service for countries with less then stellar record for human rights... (rhymes with prussia, rina and audi)
hahaha, because the US is any better?
Well, the USA has been better for now, at least *in* the USA (though there are powers trying to change that). If you happen to live in a country that has 'US interests' then you're pretty expendable. Ask the millions fleeing Syria, for example.
Comments
that sounds far too expensive to do for 1500 bucks a phone.
To put it another way if you buy apple products because you think they are secure you completely misunderstand the technology.
Or let them carry on attempting to hack new iPhones so they can sort those issues too.
The Terms of Service is a "contract" between Apple and the owner of the phone, not Apple and the FBI, or any other agent of the government, and as such is in no way binding on any third party. There is no "breach of contract." If the FBI has probable cause or a warrant to search the phone, no TOS has any legal force to stop them.
In addition, a court issued warrant trumps any contract that doesn't involve national security, and even then a FISA warrant will do the trick. No matter what terms to which you and another party have agreed, if a warrant's terms require you to violate them, you will, or you'll potentially go to jail, suffer fines, or worse, for not doing so.
This break doesn’t sound like something that is going to be packaged in an app any time soon. You send the phone to Cellebite and their trained specialists handle the break. If it requires dismantling the phone then I’m not sure knowing how it’s done is going to mean Apple will think it’s worthwhile guarding against it.
And if Cellebite is dismantling the phone then it’s not a flaw in iOS.
https://9to5mac.com/2016/02/03/iphone-flash-storage-upgrade-shenzhen/comment-page-1/