Hacker News Reader

Comment by georgespencer | Hacker News Reader

One of three things is true:

1. The FBI is lying to save face,

2. Someone -- but probably needs to be some people -- from Apple is willing to help them,

3. There is an undisclosed vulnerability in iOS which Apple is unaware of.

I find it really hard to believe that someone would disclose a zero day exploit to the FBI without charging significant $ for it.

Am I missing something obvious?

View on HN

I am guessing they caught wind of possibly losing the case and don't want the precedent set. That's what this was always about, right?

Thats my guess. They are waiting for another "golden" case to use.

Yup, FBI wants a do-over next time one of the "Four Horsemen of the Infocalypse"[1] emerges.

1. https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...

Yup, and they've been called out on it, too, by others in the government even: http://arstechnica.com/tech-policy/2016/03/former-cyber-czar...

The ACLU showed a plausible path forward by just desoldering the storage and just rewriting it and trying again when the phone wipes it.

John McCafee and others (ex US govt officials IIRC) have mentioned decapping as a serious option for the NSA.

Snowden and Richard Clarke (advisor to bush on cyber security, advisor to Bill Clinton on counter terrorism, etc) have said the NSA has ways without being specific about how.

I don't think this counts as a serious vulnerability. If you have access to the kind of hardware and technical ability the US govt does, Apple probably isn't too concerned about you being able to break one phone at a time with significant effort involved.

4. They don't want to allow precedents to be set that aren't the precedents they were looking for.

Could you elaborate on what you mean here?

They don't want to lose and have a precedent set that doesn't allow them to do what they want.

This is exactly what I mean.

The issue was never that the magistrate judge would be setting the precedent. No matter who prevailed, there is going to be an appeal and that's when precedent would be set. Even at that point, a negative ruling wouldn't necessarily be an insurmountable problem for the FBI as it wouldn't be binding until the issue has been decided by higher authority. It could still be cited as an example of persuasive authority (i.e. something other courts may follow) before then, but that's not the same as being binding.

So the FBI would have a lot of time before they had to worry about the consequences of a negative ruling, and they could drop the matter well before any precedent was set. Apple is in a trickier situation, in that once they've done the work, it becomes more likely that they'll face additional demands in other courts, or--and this is the worst case scenario--a few boneheaded legislators try to pass legislation on this issue. They've got a lot less room to work in, so if they could make this go away in front of a district magistrate without ever having to worry about setting any precedent (even if in their favor), they probably would.

0. http://www.law.georgetown.edu/academics/academic-programs/le...

1. http://faculty.law.lsu.edu/toddbruno/mandatory_v__persuasive...

That may all be true and I don't dispute the duration and the fact that it wouldn't be binding at this level. However, what the FBI need is something to get the ball rolling, the golden case that would set a precedent; that would almost definitely become binding in the higher court. They want a good foundation from which to proceed and I believe this case is now not it for them. They will wait for something that galvanises the general public and the courts more so than the current case, which will ultimately have a higher likelihood of setting the ball rolling towards a precedent. There's no other reason for this misappropriation of the All Writs Act other than to try and ultimately set a precedent.

Yeah, but this was that case. I made the point in another comment, but this case had all of the emotional pull the FBI could ask for because it was a terrorist attack on US soil. Fear, anger, hate, even elements of Islamophobia combined to slant the PR field significantly in the FBI's favor. Even judges would be hesitant refuse the request unless it was blatantly flawed. Criminal cases aren't going to offer them anywhere near that sort of counterweight to the strong privacy concerns Apple has raised. So unless we're talking about Osama bin Laden's iPhone, and since he's dead that's kind of a non-starter, I don't see there being a better case.

But if there's an alternative method that's been proposed and the FBI is aware of it, the FBI can't claim that forcing Apple to act is the government's last resort. So that's the most likely reason they've halted proceedings and not any fear that they may lose.

Sure, there's an extremely well known vulnerability in the iPhone 5C hardware.

Lacking the features introduced in later ARM releases it has an unsecured AHB or AXI bus allowing any device that can connect to perform arbitrary DMA (which can in turn allow arbitrary code execution).

It would require a certain degree of technical sophistication to execute that attack, but the resources required would be well within the reach of a state-level investigative service.

Do you have a link to the paper? I have a friend that was commenting about something similar the other day, but he couldn't find the sauce.

Hanlon's Razor: "never assume malice when stupidity will suffice"

The possibility that the Bureau is just plain dumb is not on your list. They are on record, many times, and in front ofa very serious congress, being very very stupid. Though I do not believe they are being stupid here, the possibility is not an edge case and should be considered.

Maybe they're willing to consider attacking the hardware now. If you desolder the flash memory then you can bypass the brute force limitations. Just block writes, or equivalently back up the contents and reload them, and the device has no way of knowing that you previously tried any passcodes. This will allow you to make perhaps 2-5 attempts per minute, which worst case will take three or four days to brute force a four-digit passcode.

replacing the flash w/ an FPGA would remove the need to solder/replace (or even restore).

hell pulling ground on the flash's write-block pin might even do it.

https://support.apple.com/en-us/HT206166

Given the existence of these is disclosed now and the suspect's iPhone can be prevented from auto updating I think the FBI will have an easier time attacking it?

Looking at the first one itself they might just have to attach a malicious USB device to execute arbitrary code.

My money is on #3.

While it is likely true that nobody will give zero days to the FBI without charging, it is also basically certain that the NSA has a collection of them. And the NSA has enough interest in this problem, and enough willingness to share with the FBI, that that may be a tractable solution.

Furthermore the FBI certainly doesn't want to create a precedent they don't like, and the fact that we're only in this situation thanks to THEIR incompetence is not helping them.

It doesn't even have to be an undisclosed vulnerability.

iOS 9.3 was released today and included several fixes to vulnerabilities which allowed arbitrary code execution, including one with "kernel privileges" [1]

Now that these vulns are out in the open, maybe someone has offered to help the FBI use them to gain access to the phone.

[1] https://support.apple.com/en-us/HT206166

>Am I missing something obvious?

John McAfee did promise to do it for free. /½ s

The guy is eccentric but I don't think he's an idiot and I do think he is likely talented, or at least rich enough to hire those who are.

That being said - he admits he was full of shit [0] and then claims that he has a proper method that isn't full of shit but which he didn't want to disclose. Chances are he's probably full of shit on that one too, given the track record, but who knows?

[0] http://www.dailydot.com/politics/john-mcafee-lied-iphone-app...

He is an eccentric idiot. I am just enough not of an idiot not to bet my shoe for dinner that he had nothing to do with this, but I'm really close. If I had smaller feet, I'd take that bet.

I'm a size 8 and willing to let you eat one from my pair of favourite shoes, if that is more amenable.

But of course, only if The Most Interesting Douchebag In the World™ is even remotely involved.

Earlier, he claimed he would use social engineering to unlock it, not some technical hacking [1]. Much more believable in my opinion. But the timestamp on the parent's article makes me skeptical that that proposal stood much ground.

[1] http://www.businessinsider.com/john-mcafee-ill-decrypt-san-b...

In a later statement, McAfee explained that he'd do it in "a half an hour" by finding the location in flash where the passcode is stored. (Never mind that the passcode is used as an encryption key, not as a password.)

http://arstechnica.com/security/2016/03/john-mcafee-better-p...

McAfee is a confirmed idiot man. He's just rich, so people admire him for some dumb reason.

It's not an undisclosed vulnerability. The iPhone 5 is not particularly difficult to crack. It requires mucking with the hardware, but a skilled amateur could do it.

(3) isn't at all implausible.

Perhaps the FBI has long had an exploit and this is all just an elaborate ruse to make unsuspecting targets feel safe using iPhones. Quite unlikely, but it's in the realm of possibilities.

4. Someone from NSA with easy access to the serious tools needed to decap the chip - became available (remember, this is a 5C, so no secure enclave).

That's almost certainly not it because it destroys the chip in the process and if the key isn't recovered the data is forever locked (even with Apple's best assistance).

> “Testing is required to determine whether it is a viable method that will not compromise data on Farook’s iPhone,”

Who said they aren't paying for the exploit?

It's weird that the offer to help was publicized before any solicitation for offers to help. Assuming that number 3 is the case, that ups the likelihood that the exploit is coming from a government insider (likely NSA, although ex-government security researchers are also likely).

Are you saying that if you were happy to work with them and had the ability to crack that iphone, you wouldn't get in touch with them? You can pretty much set the terms in that case. Everyone knows about this case already, so they don't need to explicitly ask.

Reply on news.ycombinator.com