Am I missing something or are all these device secure enclaves and fingerprint protection or key protection now moot?
This exploit allows flashing unsigned firmware, so by stealing the phone the attackers won’t be able to decrypt your data, but an evil maid attack is now (or will be) feasible.
Also, stolen iPhones are now more valuable, as you will be able to bypass iCloud Lock.
I hope we get some word from Apple about this.
Only for older models, the newest series is not vulnerable.
Only A12 and A13 devices are unaffected (XS/XR, 11).
What prevents unauthorized firmware from requesting that the Secure Enclave decrypt all data? Similar to having control over an HSM - you can’t extract the key but you can perform cryptographic operations.
The only ways around this are:
* physical extraction of the embedded memory in the SE (I'm not sure if this is actually feasible, it's certainly a destructive attack)
* "updating" the SE firmware - this is what the FBI wanted Apple to do in that terrorism case, that Apple develop a SE firmware that leaks the secret key
* exploiting bugs in the SE firmware - this is what the FBI ended up doing by hiring either Cellebrite or some anonymous hackers (depending on which source one believes).
Of course, none of that matters if you can reflash the device or exploit the boot ROM.
why not both?
Honestly, I find the malicious attack scenarios for this pretty far fetched.
Android devices could allow you to do this out of the box if Google allowed you to upload your own keys and sign your own boot image by providing the tools to developers / power users. They haven't and they won't.
Sadly that means Apple is unlikely to do it either given how much more strict they are on these things.
The security benefits are real, but the implementations are poor. On Android devices, a locked bootloader guarantees your device will be e-waste within 2 years.
These seem like a fair compromise.
Must we continue to drag things out and design for the lowest common denominator?
If you try to visit a site in Google Chrome that Google thinks is hosting malware, they pop up a huge red message saying the site will harm your computer. There is a continue link, but... well, I don't have access to any analytics on this, but I would guess not many people visit those sites.
https://www.sciencedaily.com/releases/2016/08/160817142911.h...
Why does everyone on HN act like this phenomena? I’m often talking about the HN bubble and this is another example.
How many people in other context like cars ignore warning lights?
If my primary device is the one displaying the warning, the only way I can find out what it means is to dismiss the warning and then 1) google it or 2) ask someone.
1) doesn't tend to happen outside of the tech bubble. 2) happens way way later, if it happens at all, as the odds of someone you can ask being around when it happens is slim. And more importantly, you need to make a phone call / check your email / do something with social media which is more important than the warning, as the warning can be dismissed and life can go on.
Odds are you forget about it entirely, and remember weeks later to ask a friend about somethingsomething boot warning insecure and then hand over your phone to them to have a look, at which point your friend loses their mind over what's happened, while the phone owner remains unconvinced it's really an issue since everything is still working correctly, and refuses to let their friend rebuild their phone for them as it'll take too long.
Source: happened to my friend's android phone. they still wont let me fix it.
You can sign your own firmware and re-lock the bootloader. It goes into the yellow state, and re-unlocking will wipe it again.