Hacker News Reader

Comment by ChuckMcM | Hacker News Reader

I suspect this is a "Strategic Retreat" on the Justice department. The ability to reflash the phone and avoid triggering the unlock erase was a pretty obvious workaround.

So after investing a lot of time and money in trying to get case law to expand the DoJ's power over corporations to conscript them into the War on the 4th Amendment, it become possible that they would see a judgement against them (especially if the Supreme court becomes more liberal with the next appointment).

So I suspect the risk/reward outcomes of pushing this to a conclusion flip flopped into more risk than reward and someone fairly high up said, "Ok kill this whole effort before it makes things worse than they are."

Just an opinion of course but I think it fits the observed actions.

View on HN

> So after investing a lot of time and money in trying to get case law to expand the DoJ's power over corporations to conscript them into the War on the 4th Amendment, it become possible that they would see a judgement against them (especially if the Supreme court becomes more liberal with the next appointment).

Scalia would have hated the DoJ's argument here, honestly. If the Supreme Court even agreed to hear the government's appeal here it might well have been 9-0 against.

And I say this as someone with a low opinion of Scalia, in general.

Yup this would have been a continuation of Scalia's majority opinions like Jones, Kyllo, and Jardines.

Also his dissent in Hamdi v. Rumsfeld was and will be fantastically important.

especially if the Supreme court becomes more liberal with the next appointment

This is the only thing I'm not so sure about. This issue doesn't seem to divide neatly along liberal/conservative lines.

Yeah, this is one of those issues where Democrats and Republicans both just assume that their party is the "good guys" and the other party is the "bad guys," when in fact it's not a particularly partisan issue at all.

("Free speech" is another one of those--both parties have been pretty shitty on free speech since 9/11, but everyone plays down their own party's sins and screams about the other's.)

Specifically, the current appointee has a history of siding with the DEA.

You seem to be unaware, but just FYI, the strongest justice on this kind of privacy right and limited search and seizure is the one who just died, and the candidate being considered to replace him has a well deserved record of cozying up to law enforcement agencies - in particular in the way that the guy who just died found unconstitutional.

This doens't make sense to me. The FBI wants this precident, and they want it badly. I don't buy for a moment that they would back down here.

I am aware.

   > The FBI wants this precedent, and they want 
   > it badly. I don't buy for a moment that they 
   > would back down here.

They do, they are also very cognizant of the ramifications if their motion is overturned. There is a constant calculus that goes on weighing the odds. It is very common to withdraw when that calculus indicates a possible loss.

I just wish that calculation was in service of something other than maximizing federal power.

> The ability to reflash the phone and avoid triggering the unlock erase was a pretty obvious workaround.

Or just replace one of the off-chip AHB/AXI devices and inject code via DMA. It won't work beyond the iPhone 5C, but I have yet to come up with a plausible reason why it wouldn't work there.

> The ability to reflash the phone and avoid triggering the unlock erase was a pretty obvious workaround.

Could you explain that a little for me?

It was discussed in detail here: https://news.ycombinator.com/item?id=11248320 but the TL;DR version, you desolder the NAND flash component (its holding all the secrets) and you copy the contents out. Then you attempt to unlock the phone 9 times, then recopy the contents of the NAND flash chip back into the chip, and do that again, and again. Until the phone unlocks and you have a look around.

Is it possible to screw that up and lose everything? Sure. Would they? No. Could you just send the data from the NAND flash to the NSA and have them brute force it? Maybe. Could you compel Apple to give you a copy of the source code to IOS so that you could write a simulator for yourself? Probably.

J.D. here. The SCOTUS becoming more conservative would have helped your limited-government view (and mine). Not more liberal. On balance the group most likely to find hard limitations on the power of the government to control people, capital, and companies are the originalists.

Sometimes it seems as though in Silicon Valley everyone assumes conservative = bad, liberal = good. The truth is always more complex.

Supposedly it's not possible to reflash the phone without the new code being signed by Apple, which is why the FBI needed Apple to do it in the first place.

The GP isn't talking about flashing an unsigned image. They're talking about physically connecting to the NAND flash chip, making a disk image, and then every 9 attempts, resetting the state of the flash back to its initial state. The image as the phone currently exists is already signed by Apple, so no cooperation from Apple is necessary.

The major weakness with this model of iPhone is that it keeps the number of failed attempts stored in the NAND flash, not on the CPU die, and is therefore vulnerable to having its state reset like this. It's a fairly obvious attack that the FBI must have known about, but failed to mention in order to try and set precedent.

Precisely - this seems (or seemed originally) like a best-case scenario for Justice: it's a terrorist's iPhone, rather than a drug dealer's or some other "lesser" criminal's, where the public's fear might not be on the side of the FBI. It definitely feels like fishing for a precedent for other phones (especially the later models where this attack isn't feasible).

Isn't it pretty possible to mess up this and brick the device though?

Bricking is on the 'flash', so if you have a copy and/or install an FPGA to replace the flash. There is nothing to 'brick'

I'm also not sure if the OS would notice if you tied the flash NAND chip's write-enable pin to ground. The OS would almost certainly notice the failed writes, but might try to make a best effort at error recovery and allow you to keep trying PINs.

Reply on news.ycombinator.com