Answers to your questions about Apple and security

Re:Answers to your questions about Apple and security by matthewmacleod on Monday February 22, 2016 @10:39AM (#11151494)

That's not the case – if Apple produce a signed iOS version that allows the passcode retry limit to be bypassed on a single device, then in what meaningful sense does it operate on another device?

[ Parent | on HN ]

Re:Answers to your questions about Apple and security by msbarnett on Monday February 22, 2016 @12:44PM (#11152659)

> if Apple produce a signed iOS version that allows the passcode retry limit to be bypassed on a single device, then in what meaningful sense does it operate on another device?

What prevents the iOS image from being loaded onto another device?

Apple isn't magic; the code they write to verify device identity isn't going to be the first perfect, unbuggy, unexploitable code written in human history. if(device_udid == terrorist_id) {...} might seem infallible, to you, but the reality is that the device_udid is just SHA1(Wifi MAC + Bluetooth MAC + ECID + Serial). All of those are writable, some via the Baseband and some via physical access. Generating SHA1 collisions is completely feasible for ~$1,000,000 of computing time, which is chump change to nation states.

There is no infallible way for Apple to make an iOS version for one single device.

Edit: And stories like http://abcnews.go.com/Technology/york-da-access-175-iphones-... make it absolutely clear that this is not stoping at a single device.

[ Parent | on HN ]

Re:Answers to your questions about Apple and security by JoeAltmaier on Monday February 22, 2016 @10:44AM (#11151543)

I guess when the FBI compels them again. Or once they have a foot in the door, compels them to remove the signing requirement, or wants their own ability to sign.

This is not mysterious. Can the FBI require a software company to subvert their own security guarantees? Should they? Do bank vaults have back doors for the FBI?

[ Parent | on HN ]

Re:Answers to your questions about Apple and security by matthewmacleod on Monday February 22, 2016 @10:58AM (#11151665)

I guess when the FBI compels them again

That's a bit of a specious argument though – of course, if they produce different software in the future, it could be used again!

If the FBI want their own ability to sign Apple updates, then that's obviously a different situation. But the point you were making – that it's not possible to write software that will run on only one device – is not true in this case.

This is not mysterious. Can the FBI require a software company to subvert their own security guarantees? Should they? Do bank vaults have back doors for the FBI?

I don't really know the right answer.

[ Parent | on HN ]