FBI Can't Win: Apple Engineers Will Quit Before Unlocking iPhone
- Thread starter LJ Ellis
- Start date
Recommended Videos
I hate apple, I really do. But in this case, I'm totally on their side. The FBI is looking for a frankly dangerous court precedent here: namely one that allows them to legally compel anyone to do anything in the name of preventing terrorism or face trouble in court. Basically, it would give them carte blanche to make internet and phone providers do what they were doing before under the patriot act.
I think a lot of people tend to forget that the constitution was put in place to protect us from the government. Keeping them from coming into our homes and businesses and forcing us to do what they want would definitely qualify.
I think a lot of people tend to forget that the constitution was put in place to protect us from the government. Keeping them from coming into our homes and businesses and forcing us to do what they want would definitely qualify.
It's a hypothetical situation. It's that way because I said it was, I created it. It doesn't have to conform to anything you accept or even hold up to iron clad logic. A dissection of the question is not the purpose of most hypothetical situations and serves no purpose here.Deathfish15 said:
The point is - would they and should they still say no in that situation? Where does the line get drawn, I wonder. It's not a question to argue for or against it, it's just a hypothetical question.
Except it isn't that simple. Encryption services, such as telegram or WhatsApp, are readily and freely available, with new ones popping up every day. There was one a while ago that was essentially a heavily encrypted version of snap chat, wherein the message would be deleted after an amount of time determined by the sender. So even if Apple were to lose this court case, it still would NOT ultimately help the issue you so sarcastically brought up. The issue here is regarding the legal precedent the case will set.Rastrelly said:
That's the thing. There's no evidence that these people are a part of an organized terrorist cell. Claiming that the evidence might be inside the phone is a bad argument. You can say that about anyone who committed any act of violence or civil disobedience. And we've already seen how the government labels people terrorist with ease. Who the fuck would in their right mind give the authorities such a power? It's insane. Setting such a strong precedent that gives the government overwhelming power based on an assumption that it might kind of sort of maybe be useful is a TERRIBLE idea.Rastrelly said:
It's not just about Apple. This would affect every other tech giant and not just in the US. And it wouldn't be a very good publicity stunt. Imagine all the people who could be buying an iPhone right now but they might be waiting to see what becomes of this. Apple is right to raise such a ruckus over this. A part of their defense is educating people on the importance of strong encryption.Arnoxthe1 said:
You're somewhat right. 2048 bit encryption only refers to asymmetric key cryptography, which is not what's being used here. I haven't had a chance to work with iPhone Decryption, but based on literature in the field it basically works as follows:iseko said:
Step 1: Provide a Passcode (usually a 4 to 6 digit number)
Step 2: The passcode is hashed with a unique identifier on the phone. At this point the OS will add one to the number of login attempts. If this number exceeds 10 wipe the iPhone encryption key used in step 3.
Step 3: This hash is used as a key to decrypt the iPhone's storage key which is unique to the phone. This key was generated in a secure manner when the phone's file system was first formatted.
Step 4: Verify a hash of the decrypted key to ensure that the decryption was successful. If it was successful reset the login counter to 0. If it failed check if the login counter is now ten if so erase the iPhone encryption key used in step 3.
Step 5: You're either logged in or back to step 1.
Odds are the iPhone uses some AES256 variant like they were back in 2014, which is hard to crack, but brute forcing a 6 digit number isn't. However to brute force this number you would need to get access to the encrypted key, which is possible by physically removing the chip a technique known as chip-off.
This does have a few hard parts to it which are:
1. You risk damage to the chip and thus the data.
2. You need to know how the flash controller works so you can emulate the flash translation layer (FTL).
3. You need to know how the file system works.
4. You need to write a tool to decrypt the encrypted file system once you have the key since putting back on a flash chip once it was removed is nearly impossible.
Assuming a competent team was starting from scratch this process would take about a year... which is likely less time than this issue will sit in the courts. If the team had access to Apple engineers who were willing to share details about the flash translation layer and file system it would take significantly less time.
Yeah... a company like... pApple.Gorrath said:
They are a new company that makes cell phones, and cell phone accessories.
I'm so confused about this subject. So if I get hammered because my wife left me and fat finger my passcode too many times in an attempt to drunk dial her, does my iPhone just lock me out permanently? Erase everything? If I take it to a Genius bar will they just tell me to eat shit and buy a new one?
It erases the decryption key for your phone, which effectively erases everything. The difference is that it takes far less time.LetalisK said:
Only if you have that turned on. It's under Settings>Touch ID & Passcode> Erase Data.LetalisK said:
It's about setting a precedent. As soon as the courts say the F.B.I. is in the right, they'll use that example for all other cases (think they have 12 right now) to force compliance down the road. They're not trying to win this one fight, but all the others down the road. The F.B.I. is using this case in particular to argue because it sounds so good in the media. (Apple wont help us fight terrorists!!)BoogieManFL said:
The argument I've heard is that they ARE able to work together to hack a cell phone but the technology they would have to use to do it would be in the hands of the CIA if it does exist, if it does exist it would be very much in the interests of the CIA to keep it secret. If they do in fact find the threads of another terrorist plot the FBI would have to reveal how it is they know what they know to a court in order to get warrants and such things and then the technology and the way it works would no longer be secret.Deathfish15 said:
So even if they could they can't, it makes no sense to spend millions developing top secret tools and then immediately reveal their capabilities, of course you could also argue that if you can't lend them out to different agencies why spend so much developing them?
The solution would almost be to let the FBI create their own tools with an additional budget but if they share the same capabilities and modes of operation of the CIA tools then it won't matter because everybody else would still know what to look out for and perhaps develop a means of defeating them.
It's a very strange problem.
I just asked this in another thread but this one is more directly set on this. Let me propose a specific solution to our concerns and I'd love it if an expert could tell me why this wouldn't work (I will admit to having extensive pc security training though my job does not revolve around setting up security so much as getting through it on an upper level so I wouldn't consider myself an expert but would call myself familiar):
Let's say that they created a back door for new phones and such from the start. Something like bit locker that a key word could unlock. If left there, anyone who knew the word would get in. Now, let's say that the key word was tied to an algorithm that itself was under encryption with no back door. If left there, if the encryption ever got out or was successfully reverse engineered (not sure if non-back door encryption on it would prevent that) then anyone having it would be in. Next, let's include safety measures like it unlocking requiring second and third factor authentications that could include encrypted communication with a machine that has to be in physical range. Second and third factor authentications virtually remove the possibility of external success in cracking something. If it was even tied to specific machines that had to be physically present then that would destroy almost any kind of access I could think of even if an employee stole and released the algorithm.
Sure, you'd have workers on site that could abuse their access to the key algorithm and the physical devices for multi-factor communication, but they would be under incredibly close scrutiny and would be let go pretty darn fast by the people watching them and then that would be it (not to mention the employee would actually have to be the sort of person that can obtain a device containing information they'd want to hack). Combine it with stringent human management like making any device go through two random employees for the process and individuals may not even actually have access to both parts.
Surely there are ways like this that would ensure phone security for many years if not a decade. Two-factor authentication is currently amazing successful and if they tweaked it in the ways I specified then there would be nothing more secure on Earth that I know of. Even an offline machine you have to manually log into would be less safe than this.
Let's say that they created a back door for new phones and such from the start. Something like bit locker that a key word could unlock. If left there, anyone who knew the word would get in. Now, let's say that the key word was tied to an algorithm that itself was under encryption with no back door. If left there, if the encryption ever got out or was successfully reverse engineered (not sure if non-back door encryption on it would prevent that) then anyone having it would be in. Next, let's include safety measures like it unlocking requiring second and third factor authentications that could include encrypted communication with a machine that has to be in physical range. Second and third factor authentications virtually remove the possibility of external success in cracking something. If it was even tied to specific machines that had to be physically present then that would destroy almost any kind of access I could think of even if an employee stole and released the algorithm.
Sure, you'd have workers on site that could abuse their access to the key algorithm and the physical devices for multi-factor communication, but they would be under incredibly close scrutiny and would be let go pretty darn fast by the people watching them and then that would be it (not to mention the employee would actually have to be the sort of person that can obtain a device containing information they'd want to hack). Combine it with stringent human management like making any device go through two random employees for the process and individuals may not even actually have access to both parts.
Surely there are ways like this that would ensure phone security for many years if not a decade. Two-factor authentication is currently amazing successful and if they tweaked it in the ways I specified then there would be nothing more secure on Earth that I know of. Even an offline machine you have to manually log into would be less safe than this.
Lightknight said:
For the sake of clarity this amounts to:
1. Generate the encryption key
2. Using a public key to decrypt the encryption key.
This part isn't possible. Cryptography doesn't respect physical demarcations. While the code you wrote to unlock the key could respect it if anyone got their hands on it they could easily remove these sections or fake them.Lightknight said:
This leaves you with the much simpler and well examined approach of using a government held public key to encrypt and store a copy of your encryption key. In general this is how encrypted backup solutions work, and the approach has some merit. However from a technical standpoint it opens up two additional attacks:
1. Compromising the government's private key compromises all devices. This can be mitigated by limited the number of devices encrypted with each public-private key pair, but as private companies aren't supposed to hold these key the issue can not be negated.
2. Phones would still need to generate their own symmetric encryption keys which would then have to be encrypted and transmitted. This process is error prone and a skilled attacker could prevent the encryption key from ever being received by a government system.
I'm sort of talking more about what World of Warcraft does. You don't have a single key so much as the two sides have a pre-arranged agreement to generate a certain key if given certain parameters at a certain time. So while one key works for five minutes, it may never work again.chimeracreator said:
So I'm not talking about the key word being "applerules" and suddenly everyone can get into phones.
1. What if the key generator remains on an encrypted partition that itself has no back door? Bit Locker doesn't have to encrypt an entire drive and to be honest at multi-terabyte drives that could take a hell of a long time to do. But it can encrypt folders and partitions without encrypting the rest of the drive. The 2nd and 3rd factor authenticators would also be stored on devices with no back door in their encryption either.
2. Why would they be able to remove the two and three factor authentications if those are required to gain access to the phone in the first place? Hypothetically, even if you already knew the key you'd only have one of three or more keys. Hell, Apple could make them have to undergo a hundred factor authentication process and really gum up people's ability to rip them off. It could even be crazy where the employee has to apply the machine factor keys in a specific order.
3. I'm not talking about these things being given to the government. I'm talking about Apple and Microsoft and whomever else having a department like this and being able to bill the government for their services of unlocking these phones. I think it's totally bogus for the government to force anyone to do a job. The government can't enact temporary slavery just because they don't know how to get into a phone. Hypothetically, this would also produce a side business for these companies if someone gets locked out of their own phone and can prove identification.
I'd love it if they code named their encryption Ring at this point and and their decryption department Mordor...
4. I know you say they don't respect physical boundaries. But all I'm saying is that in addition to email based two factor authentication, they could also set up entire machines that are fully encrypted (again, no back doors present on these key machines) that themselves have to shake hands with the phones. Machines that are never exposed to the internet and generally only shake hands with these phones. That could present a markedly more difficult challenge to spoof in that you'd literally have to be one of a handful of people who maintain these machines that could have any kind of serious access to them.
The future probably has a bunch of apps that encrypt your data instead. That would probably be impossible to police. But for the major carriers it's all about casting the widest net.
5. The initial symmetric key is really just to start the communication. The idea is to assume that this will eventually get out but to make it hard enough that it should be years before that is reverse engineered. Hopefully years after the next phone has already replaced it and made un-encrypting it pointless. If you really think about it, our current market only needs about 3 years minimum to delay things. If they can get to 5 or more years then for all intents and purposes it will succeed.
6. Is there any secure way to update security on phones? My guess is since it is transmitted that it might be impossible. But if there are secure connections that can be made or perhaps if they have people go into physical store fronts to update then it's not unreasonable that every couple of years they could change the algorithm and factor keys for the security conscious.
So I'm not talking about the key word being "applerules" and suddenly everyone can get into phones.Lightknight said:
These systems use encryption, but they aren't actually encryption systems themselves. These are authentication systems that use a shared symetric key which is generated at the time the device is initially synced. Both devices then generate a hash using their shared key plus a time epoch which lets them authenticate to each other.Lightknight said:
Unfortunately none of this helps to actually securely encrypt the device's encryption key. For that you need to use public key cryptography.
The security of the key generator isn't the primary problem with this scheme. This is part of Kerckhoffs's principle. Also to run the generator you would still need to decrypt it, and if the generator was in constant use it would need to stay decrypted. As such it could be harvested from memory if the host was compromised, which is a technique that's widely used to steal credit card numbers already.Lightknight said:
I'm not exactly sure what you're saying here. Authorization controls normal access to a system. Direct physical access allows you to bypass authorization layers, which leaves only encryption. If you're talking about adding authorization layers onto the server system which hosts it that can help, but that won't stop them from being a target for hackers.Lightknight said:
These companies honestly have a hard enough time securing themselves against everyone who wants to hack them now. They don't want to add an even more tempting target on their backs.Lightknight said:
Again, this has to do with the authentication phase to get the master key not encryption.Lightknight said:
Nope, the first symmetric key is for the phone itself. This is the only key which can actually decrypt data on the phone. Everything else is just a protection for it, including the fact that it is encrypted based on a much weaker user provided passkey.Lightknight said:
In general yes, it is possible to update the security on phones. However the most secure systems available use purpose built chips for this and as such they cannot be upgraded, but also aren't vulnerable to a host of attacks that the iPhone can be hit with.Lightknight said: