February 19, 2016

Apple vs FBI

It can be done. Apple can access the Farook phone.

Here's the tech blog post that outlines how to do it. Farook had an iPhone 5C, which doesn't have a secure enclave, making the task much easier:-


>>CLICK HERE<<


Quotes:


As many jailbreakers are familiar, firmware can be loaded via Device Firmware Upgrade (DFU) Mode. Once an iPhone enters DFU mode, it will accept a new firmware image over a USB cable. Before any firmware image is loaded by an iPhone, the device first checks whether the firmware has a valid signature from Apple. This signature check is why the FBI cannot load new software onto an iPhone on their own — the FBI does not have the secret keys that Apple uses to sign firmware.

<clip>
Even though this 80ms limit is not ideal, it is a massive improvement from guessing only one passcode per hour with unmodified software. After the elimination of passcode delays, it will take a half hour to recover a 4-digit PIN, hours to recover a 6-digit PIN, or years to recover a 6-character alphanumeric password. It has not been reported whether the recovered iPhone uses a 4-digit PIN or a longer, more complicated alphanumeric passcode.

<clip>

I believe it is technically feasible for Apple to comply with all of the FBI’s requests in this case. On the iPhone 5C, the passcode delay and device erasure are implemented in software and Apple can add support for peripheral devices that facilitate PIN code entry. In order to limit the risk of abuse, Apple can lock the customized version of iOS to only work on the specific recovered iPhone and perform all recovery on their own, without sharing the firmware image with the FBI.

The way I read this is, first you get access to the phone in recovery mode using a signature from Apple, then as there is no secure enclave to worry about on this model of phone, you force your way in, but the hardware key query on each attempt slows things down. It could take years without Apple's help in that regard if Farook used a long alphanumeric. If he didn't use an alphanumeric then it would take minutes or possibly hours.


No comments:

Post a Comment