Hacker News Reader

Comment by dmix | Hacker News Reader

My house got burglarized and my work iPhone got stolen in addition to oddly a cookbook in an opened Amazon box on the counter. It seemed so dumb in retrospect... at least after I spent a day or two turning over my place looking for it (blaming myself for losing it) before reading in the press that a 40yr old got caught in the act robbing 10 houses in my neighborhood. He just went in and grabs whatever he could see then leaves quickly, and I happened to leave my iphone on the counter that night.

I never got it back but I also realized it was basically a useless brick. Is there any value in stealing an iphone/modern android these days? They are so locked down what's the point?

The only regret I had was I didn't turn on "Find my phone" because I'm so privacy paranoid but at least the password was a much more complex alphanumeric one than most people's plus w/o an icloud backup (pre-2023 before it became encrypted).

View on HN

> The only regret I had was I didn't turn on "Find my phone" because I'm so privacy paranoid [...]

Your government and phone company already track you. Turning on 'Find my phone' doesn't really add any more tracking on top, it just allows you to benefit from the tracking, too.

Find my iPhone, when enabled, gives you approval options towards locking down or remotely wiping the phone. It’s not to do with stopping others tracking you.

Yeah I read into it more following this and I regret it now.

Do they strip them for parts?

Can someone confirm if that is viable?

Certainly I'd imagine all smart-phone parts ranging from the camera modules, batteries, screens and cases are all worth money!

The logic boards might be tied to some sort of security?

I say this, as I use a small back-street phone repair guy who has drawers of various genuine and non-official parts for iPhones, and I've used him to replace smashed screens and camera modules!

Apple pairs individuals hardware parts now. The camera, screen, boards, etc will not work in another iPhone unless Apple authorizes it and has their servers grant a new pairing.

The short answer is, yes they do.

It's true that Apple has paired hardware on newer phones, and that combined with Find My has really taken a huge bite out of how many iPhones are stolen, but Shenzhen is Shenzhen.

It is a mecca of technology, and you will find things that we'd generally otherwise consider impossible, like building your own iPhone piece by piece just walking around a market:

https://www.youtube.com/watch?v=leFuF-zoVzA

So even if they can't take a given part as-is, they can always find something useful. We'd think "the logic board is paired so it's useless": they'd think "ICs X,Y, and Z on the logic board commonly fail and now we got spares".

There's been more than one case of stolen stuff ending up at the same place in Shenzhen: https://metro.co.uk/2023/02/02/find-my-iphone-app-discovers-...

The screens alone cost $150 to replace when they crack so that alone might be worth it.

Same experience here, my stolen iPhone's last FindMy ping was in Shenzhen, too. A bit surreal

Parts make it more profitable compared to a bike.

That's a good point. The junkie-looking guy (at least from the press photo) may have known as much or found out later, and still managed to sell it. I guess making $40-50 is enough for the risk for these people.

The police found caught him in-the-act with a backpack full of stuff from a house down the street so he's certainly getting punished. The funny part is the police saw him before he entered the house but decided it was worth waiting until he left to get proper evidence.

I was home at the time sleeping and so was allegedly the last family he burglarized. Which makes it feel creepier.

Phones are frequently snatched out of people's hands in London. They are sold in countries that don't blacklist them, mainly in Africa.

I'm pretty sure Google/Apple OS boot locks are not simply geo-locked by mobile service vendors, so even in Africa it would be pretty limited in value for any modern phone. This happens when you start up the phone and it requires auth via the existing password and/or login to a Google/Apple account to deauth it from the primary account. Even after attempting to reinstall an ASOP boot OS on Android this will happen.

That wasn't always the case though and thieves may not realize that.

But otherwise for some reason I didn't consider selling it for parts to one of those tiny cellphone chop-shops. I assumed since it was a valuable iPhone it was ultimately mostly useless to them as a non-operational phone, but I guess $20-100 for parts is more than enough.

iPhone vulnerabilities are a dime a dozen. Even if it’s not breakable now all an attacker has to do is wait for the next 0-day and they’re in all your accounts, bank, etc. if my iPhone was stolen I’d be changing passwords and 2FA on everything ASAP. The value is your data not the phone itself.

Can you expand on what you mean here. I'm not entirely convinced you understand the security situation (nor what "0-day" means in this context) but I'm willing to accept I'm the one being naive here.

Say they have an old powered down iphone with an alphanumeric PW (or a temporarily powered-on locked iphone). What's the realistic risk for a run of the mill burglary? You think they can bypass the PW prompts, exploit an up-to-date OS, and decrypt the HD with a vulnerability available to the general public? And local data on my old phone, ie, some photos and some old iMessages on my device are a serious personal/financial risk?

I already changed the (tiny) set of relevant passwords not-2FAd immediately and everything else relevant is 2FA'd. My SIM card was delisted immediately by my telecom after I found out and the phone theft was reported to a national hotline/database, so not sure why I need to "change" my (phone number-only) 2FAs...

I mean you're kind of setting the parameters with hindsight here. On paper alphanumeric was always known to be more secure. But there was a very long time where there was no way that your run of the mill thief was going to get the equivalent of a GreyKey and break into your pin protected, activation locked iPhone 7 by hopping on AliExpress...

https://www.aliexpress.us/item/2255800833252942.html?gateway...

I agree a run of the mill burglar wouldn't have the foresight to sit on your phone for years and years, since the value of breaking in probably diminishes almost immediately as you get a new phone, Wallet deactivates, etc. but it's not a reach to imagine that in a few years we'll see the equivalent of the current Cellebrite tech become widely available.

> but it's not a reach to imagine that in a few years we'll see the equivalent of the current Cellebrite tech become widely available

Yeah, it very much is a reach. $100 says it won’t happen, feel free to come back and collect within 5 years if I’m wrong.

If you're the kind of person to bet that a company that already got hacked for most of their data once... already has their hardware leaked on eBay because they partner with notoriously unreliable government partners... and relies on open vulnerabilities won't have their tech reverse engineered any time soon? You should save that $100 for a rainy day.

Will their tech leak, sure, that’s possible. Will equivalent tech for a future device a few years from now exist and be freely available, not as given as you seem to believe.

I find that (the prevalence of iPhone vulnerabilities) hard to believe, but I’m not an expert. What evidence do you have in support of this position?

To be clear, I believe there are vulnerabilities, just not they are as common or as easy to come by as you claim.

Even if they are they rarely bypass an already locked device. Unless they are paying big money for the latest Cellebrite. Which I'm not sure is even available commercially like that.

> iPhone vulnerabilities are a dime a dozen

Does "dime a dozen" mean "6-7 figures USD per each on the global exploit market, with a dozen well-known regular buyers"?

Reply on news.ycombinator.com