DriveSavers launches passcode-beating iPhone cracking service for the public

Comments

• Reply 1 of 35

  georgie01 Posts: 437member

  November 28, 2018 1:32AM

  I am really pleased to see these companies producing products like this. We need genuinely secure encryption but we also need people trying (and succeeding) to break that encryption. These products also prove that law enforcement isn’t helpless in the face of encryption and therefore need backdoors, and so they rather should be investing in techniques to legally break the encryption.

  edited November 2018
• Reply 2 of 35

  radarthekat Posts: 3,898moderator

  November 28, 2018 2:00AM

  The company hasn’t provided info on the manes by which the unlock works? Could it be you have to install something on the device when you sign up, so that it can be accessed when you later find yourself locked out?  Because if this is a vulnerability, for sure Apple will close it.  

  
• Reply 3 of 35

  ericthehalfbee Posts: 4,488member

  November 28, 2018 2:38AM

  So, is someone from AI going to call them and see if they can recover data from a “test” device? Or at least report back what they are told about the procedure and how much it costs?

  
• Reply 4 of 35

  MplsP Posts: 4,006member

  November 28, 2018 2:39AM

  AppleInsider said:

  For some law enforcement agencies it may be more practical to force a suspect to unlock a device via Face ID or Touch ID. U.S. police can't legally demand that someone turn over their passcode, but they can use biometrics. In some cases this approach has even been used with the dead.

  That may not be practical - you can force a FaceID iPhone to require the password by pressing the side buttons for 2 seconds and it will automatically require it after it after 48 hours/.

  
• Reply 5 of 35

  evn616 Posts: 28member

  November 28, 2018 2:41AM

  I call BS on anybody that claims “100 percent success rate” for anything. Snake oil until they show us a PoC with a random security configuration sample set (audited by a 3rd party to ensure no funny business). Also, what is the use case here for a consumer that supposedly has legal access to the data? Dementia, death of a family member, an underage member of the family, etc? The legal ramifications alone make this a sketchy proposition.

  
• Reply 6 of 35

  mfryd Posts: 221member

  November 28, 2018 3:18AM

  All they need is Apple's private encryption key.  With that they could run whatever software they want on the device.   This would allow them to bypass delays between subsequent password attempts, disable auto-erase, and turn off the remote wipe feature.
  
  If they have reverse-engineered Apple's private key from the public key, then their claims are quite believable.  If they've been using their corporate spare computer cycles over the past few years to look for this, perhaps they have gotten lucky?
• Reply 7 of 35

  viclauyyc Posts: 849member

  November 28, 2018 3:51AM

  Their website seems legit and professional.
  
  We need a volunteer which some spare money.
  
  
  
• Reply 8 of 35

  bestkeptsecret Posts: 4,276member

  November 28, 2018 5:42AM

  I'm sure Apple will send someone and figure out the "how" and the "how much".

  
• Reply 9 of 35

  hammeroftruth Posts: 1,349member

  November 28, 2018 5:43AM

  viclauyyc said:

  Their website seems legit and professional.
  
  We need a volunteer which some spare money.
  
  
  

  They have been around since 1985. So yeah they’re legit and professional.  They can retrieve data off of liquid damaged and dead iOS devices, but they’re pricey. 

  
• Reply 10 of 35

  brisance Posts: 63member

  November 28, 2018 6:25AM

  mfryd said:

  
  If they have reverse-engineered Apple's private key from the public key, then their claims are quite believable.  If they've been using their corporate spare computer cycles over the past few years to look for this, perhaps they have gotten lucky?

  A few problems with this thesis:
  
  

  1. Apple's private encryption key is more valuable on the black market than having to solicit orders from random end users with questionable means to pay.
  2. The sale of a company's private encryption key on the black market is likely to attract law enforcement.
  3. The computing power necessary to derive Apple's private encryption key is unlikely to be found in a single, non-state actor.
  4. If a solution to #3 can be found, the solution is more valuable than the private key itself. Indeed, it would make the person who discovered it the richest person alive.

  
  

  
• Reply 11 of 35

  racoleman29 Posts: 86member

  November 28, 2018 10:51AM

  Soon to be blocked by Apple...end of story.

  
• Reply 12 of 35

  davidlewis54 Posts: 119member

  November 28, 2018 11:46AM

  What an extraordinary thing to produce, presumably only to show you can.  All very odd.

  
• Reply 13 of 35

  1983 Posts: 1,225member

  November 28, 2018 12:29PM

  georgie01 said:

  I am really pleased to see these companies producing products like this. We need genuinely secure encryption but we also need people trying (and succeeding) to break that encryption. These products also prove that law enforcement isn’t helpless in the face of encryption and therefore need backdoors, and so they rather should be investing in techniques to legally break the encryption.

  Interesting point.
• Reply 14 of 35

  hailthehamster Posts: 17member

  November 28, 2018 1:33PM

  georgie01 said:

  I am really pleased to see these companies producing products like this. We need genuinely secure encryption but we also need people trying (and succeeding) to break that encryption. These products also prove that law enforcement isn’t helpless in the face of encryption and therefore need backdoors, and so they rather should be investing in techniques to legally break the encryption.

  So which law enforcement agency do you work for? 
  In an ideal world, sure, I get it. Regrettably, state actors have consistently and determinedly ignored our collective right to privacy. Any ability to break encryption will be disseminated faster than the Salt Bae meme. Due process and legal oversight will be dispersed just as frivolously. 

  
• Reply 15 of 35

  lkrupp Posts: 10,557member

  November 28, 2018 2:55PM

  viclauyyc said:

  Their website seems legit and professional.
  
  We need a volunteer which some spare money.
  
  
  

  That would be AppleInsider submitting a locked iPhone to them for their service, followed by a complete analysis of what actually happened, if the claims are true, and if there any “yeah but” conditions that must be met first. How about a pole to encourage AppleInsider to do just that?

  
• Reply 16 of 35

  DAalseth Posts: 2,978member

  November 28, 2018 2:59PM

  I worked in IT for a couple of decades. I am exceedingly dubious of any tech firm that claims 100% success on anything. First rule of IT: no matter how good you are s*** happens.

  
• Reply 17 of 35

  jimh2 Posts: 657member

  November 28, 2018 3:22PM

  brisance said:

  mfryd said:

  
  If they have reverse-engineered Apple's private key from the public key, then their claims are quite believable.  If they've been using their corporate spare computer cycles over the past few years to look for this, perhaps they have gotten lucky?

  A few problems with this thesis:
  
  

  1. Apple's private encryption key is more valuable on the black market than having to solicit orders from random end users with questionable means to pay.
  2. The sale of a company's private encryption key on the black market is likely to attract law enforcement.
  3. The computing power necessary to derive Apple's private encryption key is unlikely to be found in a single, non-state actor.
  4. If a solution to #3 can be found, the solution is more valuable than the private key itself. Indeed, it would make the person who discovered it the richest person alive.

  
  

  #4 says it all. No one would give a crap about unlocking iPhones if they could break encryption keys.
• Reply 18 of 35

  BuffyzDead Posts: 358member

  November 28, 2018 3:46PM

  Just a guess BUT It would not surprise me IF you have to enroll the device before taking advantage of the service. Perhaps installing something on your device now, in case you need to use this retrieval method, later. Perhaps a monthly subscription and such

  
• Reply 19 of 35

  gatorguy Posts: 24,605member

  November 28, 2018 4:42PM

  lkrupp said:

  viclauyyc said:

  Their website seems legit and professional.
  
  We need a volunteer which some spare money.
  
  
  

  That would be AppleInsider submitting a locked iPhone to them for their service, followed by a complete analysis of what actually happened, if the claims are true, and if there any “yeah but” conditions that must be met first. How about a pole to encourage AppleInsider to do just that?

  Rather than a poll how about a collection plate? Since it's a $3900 service maybe all those interested AI members will pony up a couple hundred each towards it to make it happen?
  
  Anyway this looks like it's geared more towards someone who's suffering dementia, comatose, or passed away and family members need access to that person's phone. There's a whole bunch'a hoops to jump thru proving the need (ex. Death certificate for a deceased, several forms of personal ID for the living, etc) before the device is accepted. 

  edited November 2018
• Reply 20 of 35

  Rayz2016 Posts: 6,957member

  November 28, 2018 5:09PM

  DAalseth said:

  I worked in IT for a couple of decades. I am exceedingly dubious of any tech firm that claims 100% success on anything. First rule of IT: no matter how good you are s*** happens.

  
  I attended a presentation once where the company sales director said his development team could guarantee their software was 100% bug free.
  
  We didn't partner with him because he was obviously lying.