Waiting for the End of the World (Apple)
April 1st, 2016Apple can never do anything right. Not sure what I mean? Well, don’t you remember that silly little gadget known as iPod? When Apple first announced that you could put 1,000 songs in your pocket for a mere $399 in 2001, they weren’t taken seriously. But it didn’t take long for digital music players to be referred to as iPods, and for the product to embrace Windows, and for Apple to overwhelm the market.
I will not bother to remind you about iPhone and iPad skepticism, not to mention the Apple Watch. In each case, Apple gear became the standard for an industry. Microsoft has tried hard to make the Surface gain traction, but sales are, at best, in the low millions to this day.
Over the years, having an Apple product also meant superior security. Sure, in the days of the original Mac OS, there were some notable Mac malware outbreaks, and using security software wasn’t a bad idea. But it never became near as bad as Windows.
With the arrival of Mac OS X — the word “Mac” was removed later — there were no malware threats. The theory went that, as the Mac platform grew, they’d come in volume. A few did, but the damage was minimal. It’s not even certain there’s a need to install security software, although that doesn’t mean you shouldn’t be careful about the sites you visit, or clicking links in an email, even if it appears to come from someone you know.
With iOS, again there’s no need for security software. There have been potential exploits, but it’s not as if they are exploited, and they are generally fixed before long. Contrast that to Android, where security problems are almost never fixed, because the chances of getting an OS update with that fix, if available, are slim to none.
Now the issue of security came up again in the recent FBI dustup with Apple. They claimed in a court filing that the only way to unlock an iPhone 5c used by a deceased terrorist was for Apple to do it. How? Well, evidently by creating a so-called govOS that would defeat brute force protections. So in iOS 8 or iOS 9, you have 10 shots at entering the correct passcode, after which the data is deleted. The special OS would, in theory, no longer contain that limitation.
On the day before a court hearing on the matter, the FBI said that they had been in touch with an unnamed third party that had a solution. A week later, and it was disclosed that not only were they able to unlock that iPhone, but it was accomplished in 26 minutes. Or at least that’s what one published report claims.
The method used was not disclosed, but it has been reported that the same method may be employed to unlock other iPhones used by alleged criminals. So while the authorities generally would disclose security flaws that are discovered, it doesn’t appear there’s any incentive to do so this time.
So how was it done?
Several published reports claim that the FBI contracted with an Israeli firm, Cellebrite, which performs forensic analysis on mobile devices to retrieve data. So was this the result of a previously undisclosed security flaw in iOS, or some sort of gadget that otherwise tricks a mobile device into revealing its secrets.
Some suggest the scheme involves something known as NAND mirroring, which puts the contents of the flash memory in memory. So up to ten passcode attempts can be made, after which the RAM disk, or whatever it is, is reloaded. The attempts continue until success is achieved.
Supposedly the FBI has contracted with Cellebrite over the years to help recover mobile data. As part of it offerings, Cellebrite sells a device, the UFED Touch, to perform such an analysis in the field.
According to the information on Cellebrite’s site, “UFED Touch is a comprehensive, standalone mobile forensic extraction device that combines outstanding mobile device support with unrivaled data extraction technology. With its intuitive GUI and easy-to-use touch screen, the UFED Touch enables physical, file system, and logical extractions of all data and passwords, included deleted data, from the widest range of mobile devices.”
Sounds pretty impressive.
But does it mean there’s a security flaw that Apple must address to ensure the security of iOS users, is this a one-off exploited by a machine that few people outside of security firms or law enforcement authorities would use, just a fluke? What?
Some fear-mongering articles imply that all iOS users must now be fearful that their gear no longer has almost bulletproof security, and that Apple needs to act pronto! Apple’s marketing message has been shown to be false, they say, and they are fated to suffer as a result. At least until you compare Apple’s hardware encryption to the method used in Android, which is to engage encryption strictly in software.
Now maybe the UFED Touch, if that’s the device used, accomplished this task on a black box basis, without a way to retrieve the method. You can actually buy from a security dealer for around $10,000 or so I gather. It’s not that it’s restricted to law enforcement agencies.
Regardless, if the FBI has worked with Cellebrite before, and their methods have succeeded in the past, why was it necessary to raise a public brouhaha with Apple in the first place? I can be charitable and suggest Cellebrite’s gear failed to recover the data on the iPhone, but that they devised a way to do so and thus reached out to the FBI with a solution. Perhaps it involved some sort of software update, or maybe this device wasn’t used after all.
Perhaps the FBI doesn’t want to reveal its use of off-the-shelf hardware, and how it was used, in order to prevent criminals from employing the same schemes to recover data from stolen smartphones.
Regardless, the world is not ending for Apple users. It is still hard to unlock iPhones, but it’s apparently a whole lot simpler to recover data from Android phones. Maybe that’s why the FBI hasn’t had a need to go after Google.
Print This Post
