News for hackers. Stuff that matters.
Re:It's your device, you should be able to repair it by KozmoNau7 on Saturday May 01, 2021 @01:18PM (#27007953)
How is Apple's decision to no longer support the original iPad and also refuse to open the platform not deliberate?

It is still a perfectly viable piece of hardware for many uses, no matter how much technology has improved.

Re:It's your device, you should be able to repair it by zepto on Saturday May 01, 2021 @01:22PM (#27007995)
The reason they haven’t opened the platform is to protect the security model.

That is deliberate, but has nothing to do with planned obsolescence.

Re:It's your device, you should be able to repair it by KozmoNau7 on Saturday May 01, 2021 @02:54PM (#27008789)
That is complete nonsense, and a cop-out at best.

Opening up the original iPad to other operating systems and/or DIY software does not mean handing over the signing keys for currently supported platforms. In case of a running iPad, an Apple-authorized update could be pushed to the OS to unlock it and allow it to run binaries directly.

Apple could also document any hardware features that would allow someone to put an iPad into "free-for-all" mode. Presumably this would require opening up the device to attach a serial cable to a JTAG connection or something similar.

There are many options for Apple to open up unsupported devices for hobbyists to tinker on, and it would completely in line in the original hacker-friendly Apple spirit.

Instead Apple refuses to do so, and insist that opening up an 11 year old, long unsupported device, by claiming that it would somehow compromise their current security model.

Re:It's your device, you should be able to repair it by zepto on Saturday May 01, 2021 @04:39PM (#27009614)
What you have described completely destroys the security model.

> In case of a running iPad, an Apple-authorized update could be pushed to the OS to unlock it and allow it to run binaries directly.

Which of course an attacker would be able to do too.

> Apple could also document any hardware features that would allow someone to put an iPad into "free-for-all" mode. Presumably this would require opening up the device to attach a serial cable to a JTAG connection or something similar.

Which of course a police department, the FBI, or the agents of an oppressive regime or anyone who bought a JTAG device off ebay would be able to do too.

These are exactly the reasons they don’t do these things - if they did, they would be opening attack vectors.

Security is hard. I’m not saying it’s impossible to achieve this, but it’s not simple.

Re:It's your device, you should be able to repair it by KozmoNau7 on Saturday May 01, 2021 @06:00PM (#27010282)
We're talking about a device that is completely unsupported by its manufacturer. You already have no expectation of security or integrity when the last available OS and security update is over 5 years old by now.

Opening up access to install your own software would have great potential to increase the security of the device, not least because you can actually run current and patched versions of any software.

What you're arguing for is security by obscurity.

Re:It's your device, you should be able to repair it by zepto on Saturday May 01, 2021 @10:31PM (#27011881)
The unlocking mechanisms you proposed would have to be present in devices right from the start. Not just in devices that are unsupported.

Nobody is talking about security through obscurity. This is about not introducing easily explored weaknesses into all devices, supported or not.

Re:It's your device, you should be able to repair it by KozmoNau7 on Sunday May 02, 2021 @03:21AM (#27013022)
If you have physical access to a device, you can already tap the memory bus or countless other places. Relying on a device itself to be secure when it is in your adversaries' hands is futile.

Open the hardware, use secure software and keep your storage encrypted, preferably on removable storage.

Re:It's your device, you should be able to repair it by zepto on Sunday May 02, 2021 @09:32AM (#27015141)
> If you have physical access to a device, you can already tap the memory bus or countless other places

This is complete bullshit.

iOS devices use an SOC so there is no way to ‘tap the memory bus’ without destroying the processor.

iOS decides do in fact resist access even when they are in the hands of an adversary.

Also it seems like you don’t know that the storage on iOS devices is already encrypted.

Re:It's your device, you should be able to repair it by KozmoNau7 on Sunday May 02, 2021 @10:28AM (#27015609)
So an SoC-based device is simply impervious to physical attacks? That's impressive! The power of the RDF is still strong.
Re:It's your device, you should be able to repair it by zepto on Sunday May 02, 2021 @10:37AM (#27015669)
> So an SoC-based device is simply impervious to physical attacks?

This is a straw man - nobody said ‘impervious’.

You said this:

> If you have physical access to a device, you can already tap the memory bus or countless other places

It is complete bullshit.

If it wasn’t, you’d be able to post a link to someone doing it.

Re:It's your device, you should be able to repair it by KozmoNau7 on Sunday May 02, 2021 @11:12AM (#27015957)
Backdoors into iPhones already exist, here's one that was used for a while, before Apple closed it: https://www.nbcnews.com/tech/tech-news/cat-mouse-fight-fix-e...

If you think that is the only way into an Apple device, and that police or even nation states are now helpless against the mighty "hack resistant" iPhone, then you may be interested in this bridge I happen to have for sale.

Re:It's your device, you should be able to repair it by zepto on Sunday May 02, 2021 @12:18PM (#27016442)
> Backdoors into iPhones already exist, here's one that was used for a while, before Apple closed it: https://www.nbcnews.com/tech/tech-news/cat-mouse-fight-fix-e...

I presume you know that isn’t an example of someone “tapping the memory bus”, which seems to be still just bullshit.

Yes, security flaws exist.

Generally we close them, not argue for abandoning security altogether as you are doing.

Police generally are helpless against the iPhone.

Nation states may well not be, but it is still going to cost them a lot.

Your argument - that because nation states can compromise the iPhone, we should make it so everyone can, seems very odd.