FBI Gains Access to Suspected Trump Shooter’s Password Locked Phone | Hacker News Reader

FBI Gains Access to Suspected Trump Shooter’s Password Locked Phone

404media.co

32 pointsjbegley35 comments

> Since then, a company called Grayshift launched the GrayKey, a small device that was capable to breaking into modern iPhones. Those devices proliferated across the country, to federal, state, and local law enforcement, and are now a mainstay in forensic investigations.

Anyone know about GrayKey? Curious how it works.

Their website (https://www.magnetforensics.com/products/magnet-graykey/) claims “ Magnet Graykey can provide same-day access to the latest iOS and Android devices – often in under one hour.”

change some config files to prevent attempt limit lockout then brute force?

Modern iOS devices have a hell of a lot more than a simple config file (see: secure enclave)

Yep! To add, Apple details this in their security whitepaper.

It used to be, years ago, that the limit was a purely software function. For many years this limit has been enforced in firmware/hardware.

The paths between memory, storage, and CPU are now protected by the Secure Enclave hardware which is responsible for enforcing passcode entry attempt limits. These limits can only be configured after a mandatory passcode prompt (or via MDM).

It is certainly possible that certain elements of the U.S. government have developed more advanced exploits beyond what GreyKey could have done, that they aren’t going to publicize.

It works on certain models and certain OS release levels that have known exploits. That's all it is.

Given that all their marketing material is extremely old IPhones, I would bet money this is a bunch of marketing jargon to trick police departments into giving them money.

FBI statement without blogspam is at [1]

[1] https://www.fbi.gov/news/press-releases/update-on-the-fbi-in...

Without further information there are really no useful security conclusions to be drawn. The technical experts in question may have an advanced lock screen bypass, or they may have tried entering his birthday as the passcode.

Yeah, highly doubt they'd leak info about some exploit in a high-vis press release like this.

They haven't leaked anything even if they do have a capability, because we can't know what they did. From a Bayesian point of view the information we gained here does nothing to help us distinguish between potential alternatives like "FBI has a zero day", "vendor has a secret backdoor" and "turns out you can face unlock a phone using a corpse".

Yep, sorry if my comment was confusing but I agree with you.

Don't they have his body? Couldn't they replicate or use his actual fingerprint/face/eyes?

https://web.archive.org/web/20240715193420/https://www.404me...

Isn’t the basic attack method:

  A) make a copy of the memory and hard drive (encrypted with a pin).

  B) try a few pins until you’re locked out.

  C) revert back to the copy you made in step A.

  D) Try a few pins until you’re locked out.

  E) Then after a day or two after all pins have been automatically tried and it has been unlocked, you’re in.

I bet they have faster and more efficient methods than this via some secret unpatched vulnerabilities or exploits but if they ever run out of them, this tried and true method works too.

That's why we have TPM chips now.

If you could brute-force memory, you don't need (C), because it would be easier to automate than doing on-device.

This is a massive deal if a big company like Apple or Samsung produced the Phone.

Modern "secure enclaves" found in nearly every phone and computer should be impossible to brute-force or leak secrets.

Unless, of course, the phone allowed fingerprint / face-id and the corpse was used. I believe on Android, you still have to use a PIN with every restart. Presumably, Apple is the same. Unsure if time since last unlock is also a factor.

It's not implausible that the parents of the deceased simply knew and provided the password.

I agree, in my opinion in order of likelihood:

1. Face-id / touch-id was still available to be used

2. Old phone without modern security measures (can brute force offline)

3. Someone else knew the pin/passphrase

...

∞. They bypassed a modern/certified secure enclave

They could have had him added as a 'child' in the family settings

> If you have an iPhone, iPad or Apple Vision Pro with the latest version of iOS, iPadOS or visionOS and two-factor authentication turned on for your Apple ID, you can change the Apple ID password for a child account in your Family Sharing group.

> Tap Settings > Family > your child's account.

> Tap Apple ID & Password.

> Tap Change [Child’s Name] Password.

> Enter your device passcode and follow the onscreen instructions.

https://support.apple.com/en-gb/101567

That there even is a working phone shows the shooter either didn’t worry about the feds finding out what’s on that phone, or didn’t think things through well.

Given that, there’s a decent chance the phone’s password is 1234 or some day of the year that’s relevant for the phone owner.

Odds are high that the password wasn't very strong or long. Who really wants to type a long and complex password every time. This means the phone can be imaged, then brute-forced on a server.

> This means the phone can be imaged, then brute-forced on a server.

No, it cannot be, which is what I'm saying in my comment.

You cannot clone "secure enclaves." They are hardware mechanisms, not software.

Additionally, things like secure-enclaves have made pin length/commonality being a significant risk factor largely a thing of the past. If you only have ten tries, you will likely miss the correct pin, no matter the statistical likelihood you might find it.

I find the security of the secure enclave to be a bit overrated. It sounds too good to be true. Ultimately, the phone has disk storage. Once the disk is imaged, the secure enclave can be simulated in software, also without the limitation of the number of tries. Only the password is missing.

> Once the disk is imaged, the secure enclave can be simulated in software, also without the limitation of the number of tries. Only the password is missing.

Yes, good luck breaking a 256-bit or similar key. I'll see you and your quantum computer in 2.29*10^32 years

The disk storage is encrypted with a key and not the password directly, so you're not guessing a PIN/password with that method, you're trying to guess the decryption key. The key is impractically harder to brute force with current technology - even a million dollar of AWS spend won't do it.

If you're interested in the crypto(graphy) used, Apple has a white paper, among other resources that makes this "too good to be true" anything but.

More than likely, a quantum computer over many times the age of the universe won't do it.

If you're talking T2...[0]

Glossary entry:

>Unique ID (UID) A 256-bit AES key that’s burned into each processor at manufacture. It can’t be read by firmware or software, and is used only by the T2 chip’s hardware AES engine. To obtain the actual key, an attacker would have to mount a highly sophisticated and expensive physical attack against the processor’s silicon. The UID isn’t related to any other identifier on the device including, but not limited to, the UDID.

Directly contradicts

>Because the UID is unique to each device and is generated wholly within the Secure Enclave rather than in a manufacturing system outside of the device, the UID key isn’t available for access or storage by Apple or any Apple suppliers.

on page 5.

In cases of ambiguity, I always assume the case least favorable to the end consumer, which is the case whereby there is a database somewhere someone is not willing/able to admit to for fear of burning all the muggle goodwill to ground.

Tis much easier to lie and force someone else to prove you wrong as long as you don't show the strength you have without having a plausible alternative explanation; it's one of the oldest techniques in the King's Game. We also know this by another name: parallel construction. That old turkey shows up in DEA training materials; no need to even reach as far as the Intelligence Community/Military Industrial Complex.

[0]https://www.apple.com/mideast/mac/docs/Apple_T2_Security_Chi...

If true (and lying in this case would be high-risk), then there probably isn't much of interest on the phone. Otherwise, they'd be busy with leads from the phone. Not telling Mr. Perp's shady associates to expect a knock on the door soon.

Why can't they also be busy with leads and just tight-lipped?

In this particular case, there may be a burning-hot political need for the FBI to be publicly perceived as making very fast progress.

I think it's extremely likely there are no leads and there is nothing to actually investigate beyond a radicalized young adult who did something terrible.

Likely true.

But a "lone kidiot" narrative would be near-useless for meeting a whole lot of burning psychological, political, institutional, and financial needs.

And emotionally-charged belief in counterfactuals is "normal" behavior in modern America.

Maybe there are no leads. The guy is dead. This could easily have been a true loan wolf situation. Not every killer has a convenient manifesto documenting their motivations. Some just kill people and we will never know their internal minds on the matter.

The article doesn’t say much. The device brand and model has not been disclosed.

tl;dr

The FBI made a note that they accessed the phone, posted by NYT etc, https://www.fbi.gov/news/press-releases/update-on-the-fbi-in... , there isn't any other information.

Reply on news.ycombinator.com