FBI paid professional hackers one-time fee to crack San Bernardino iPhone

https://www.washingtonpost.com/world/national-security/fbi-paid-professional-hackers-one-time-fee-to-crack-san-bernardino-iphone/2016/04/12/5397814a-00de-11e6-9d36-33d198ea26c5_story.html

by molecule • 10 years ago

122 125 10 years ago

washingtonpost.com

x5n12• 10 years ago

Yes, yes that's exactly what happened. Apple had nothing to do with it. And that charade they put up about suing then not suing, etc, was not a charade at all. /s

janekm4• 10 years ago

I'm continually baffled by the pathological disdain some people like yourself seem to show towards Apple... Is it the cognitive dissonance that "Google does no evil", therefore if Apple is seen working for the privacy of their users (which they have both sound business reasons and I have no reason to doubt moral convictions to do), where Google does not, then they must have a hidden agenda?

x5n12• 10 years ago

i said nothing about google, i am cynical about the whole industry in terms of its collusion with the government. you sound like an apple fan boy.

antidaily• 10 years ago

Apparently the code was 6969. Got it on the third try.

jessaustin2• 10 years ago

Missing from TFA: any consideration of whether the "work phone", which was subject at all times to repossession and inspection by San Bernardino County, stored any information about terrorism, particularly information worth overturning fundamental assumptions about the duties of electronic device manufacturers.

janekm4• 10 years ago

It's implicit, the equivalent of a warrant canary, if there had been anything of remote interest (which nobody expected) there would have been a lot of noise about that.

ikeboy7• 10 years ago

Iirc comey said in one interview that they wanted to know which path they went on during missing minutes on the day of the shooting when the phone was with them, and hoped the phone had location data.

Edit: see http://nytimes.com/2016/03/02/technology/apple-and-fbi-face-...

matt_wulfeck• 10 years ago

That data is easily available via tower pings without needing to unlock the phone. Who sets up their phone to record constant GPS coordinates?

janekm4• 10 years ago

Am I the only one who reads the quotes in this article as "see Apple, if you don't give us what we want then we may just have operational reasons to not disclose vulnerabilities to you, wouldn't that be a shame..."?

beams_of_light• 10 years ago

Yep. The phone has still not been cracked, I'd bet. This is all posturing.

mturmon• 10 years ago

It does come off a bit like a multidimensional pissing match - with the FBI alternately saying, "We can force you to break this phone", "We can break it ourselves if we want to", "We will break it and not tell you how", "We can insert a succession of stories in the media that will call your security into question."

williamcotton4• 10 years ago

It is of course a territorial pissing match. Apple, and most of Silicon Valley, thinks and acts like they are more important and powerful than the country that granted them a corporate charter and the public infrastructure with which to do business.

nodesocket• 10 years ago

"The U.S. government now has to weigh whether to disclose the flaws to Apple..."

Apple is going to find the flaw. They wrote all the code and have some of the smartest people in the world working there. No reason for Apple to even ask the government to disclose the vulnerability to them.

mkoryak• 10 years ago

Thats assuming that this flaw exists, and that the FBI is telling us the truth...

piyush_soni• 10 years ago

Well, the same smartest people unknowingly put the bug there. It's not as easy to find a security flaw (without someone telling about it) as you think. They'll eventually figure it out, but may be not immediately.

zxv• 10 years ago

Responsible disclosure involves notifying the vendor (Apple) first.

https://en.wikipedia.org/wiki/Responsible_disclosure

If the FBI wanted to protect the public, responsible disclosure of the exploit is a first step.

Sigh.

coderdude• 10 years ago

Responsible disclosure isn't the FBI's most effective way of protecting the public.

CiPHPerCoder• 10 years ago

As much as I'm inclined to agree with this line of argument in this particular case, I do take issue with the term "responsible disclosure" for many of the reasons outlined here: https://adamcaudill.com/2015/11/19/responsible-disclosure-is...

wcummings3• 10 years ago

I don't like what the FBI has done, but I'll say what I always say when "responsible" disclosure comes up, for consistency.

Responsible disclosure is a courtesy. Exploits are valuable. Information asymmetry is the name of the game. Apple is not entitled to free labor. If they don't like it they should hire researchers, as the FBI has.

hueving7• 10 years ago

Weapons are also valuable, that doesn't give you a free pass to sell arms to gangs.

AnthonyMouse3• 10 years ago

Responsible disclosure is a courtesy. Exploits are valuable. Information asymmetry is the name of the game. Apple is not entitled to free labor. If they don't like it they should hire researchers, as the FBI has.

This seems a lot like saying, if someone pays you to do a structural analysis of a parking garage because they want to know if they can profit by shorting the company that owns it, and you discover that the garage is likely to collapse, you don't have any obligation to disclose the vulnerability.

williamcotton4• 10 years ago

Apple used the FBI hearings as a public relations project. They lost all sympathy from the Feds after that. They really should have played their card differently but instead wanted to rally the public against a federal law enforcement agency so they can prove to customers that they take privacy seriously.

I'm not sure if Apple intended to rile up the Snowden/tin-hat wearing crowd who thinks the government is out to get everyone, but that sure didn't leave a nice aftertaste in the FBI's mouth.

Looking at this objectively, Apple shouldn't expect the curtesy of responsible disclosure. If this makes the public wary of Apple ability to protect their privacy, well, so be it. The FBI's duty is to actually protect the public, not to protect the customers of a single corporation.

I think this is brilliant counter-marketing on the part of the FBI and a real "fuck you" to Apple for turning a criminal investigation of a mass murder in to some fucking sideshow circus where they could show the public just how much more they care about privacy than the government.

EDIT: I'm sorry, but I have a rate limited account because my conservative opinions are not valued by the HackerNews community. I have some follow ups to your comments:

---

That includes protecting the public's communication from criminal eavesdropping, which they are undermining when they keep an exploit secret instead of responsibly disclosing it.

I'm sorry, but this is not how the courts see things. Please see https://en.wikipedia.org/wiki/Third-party_doctrine

As far as I'm concerned and as far as the US government is concerned, as soon as you broadcast radio and electrical signals from your private person or property, it's been published. That's how it's been since the beginning of the country and that why Apple and Facebook are even allowed to sell your information to third-party marketers. Everything that leaves your devices legally has to be made public so our data can be legally sold.

This is also related to credit reports, doing-business-as, and many other kinds of public record keeping. You should not expect privacy when buying and selling goods in a public marketplace. How could you possible stop someone from monitoring what you're buying and selling? Consumer reporting, public record keeping, and public census data are incredibly important parts of our institutions.

We're going to need a newly defined set of laws and regulations to actual define what I've been calling "privished" works, that is, information that a third-party is liable to both the individual as well as the government, to make sure that the 4th amendment is still a two-way contract.

I suggest you brush up on some of your constitutional and common law interpretations of what privacy actually means with regards to mass communication. I think most of the HN threads are missing half of the social contract and fail to see the importance of granting the government the right to warranted search and seizure.

krapp• 10 years ago

I'm not sure if Apple intended to rile up the Snowden/tin-hat wearing crowd who thinks the government is out to get everyone, but that sure didn't leave a nice aftertaste in the FBI's mouth.

I prefer the theory that they wanted to improve their reputation in the international market with a show of defiance demonstrating that they weren't going to act as a front for US intelligence.

Although I have no idea whether Apple's reputation has actually been damaged overseas by increased awareness of American spying, it seems likely that American technology companies in the post-Snowden age will face a PR problem in the international market that Apple and other US tech companies should have a strategy for.

duaneb5• 10 years ago

wanted to rally the public

Source? Preferably the press release in question.

It's FBI who was pushing the polemic, and that's the same polemic you are now pushing.

Also, this isn't a show. These are legitimate privacy concerns that require active protection. The FBI is hardly in the business of protecting information from hackers. If they were, they probably wouldn't need Apple's help in the first place to penetrate their security. They simply don't have the expertise.

Again, I'd like to point out that it was the FBI who took to the PR stand to address the public directly in a political manner.

pdkl953• 10 years ago

the Snowden/tin-hat wearing crowd who thinks the government is out to get everyone

Insults are not good discussion.

The FBI's duty is to actually protect the public

That includes protecting the public's communication from criminal eavesdropping, which they are undermining when they keep an exploit secret instead of responsibly disclosing it. The idea that they can keep it secret and nobody else will rediscover the exploit - and the "nobus" (nobody but us) attitude in general - is hubris.

not to protect the customers of a single corporation.

I suggest reading older HN threads on this topic, because the fight against the FBI's order was not about a "single corporation".

ryanlol• 10 years ago

Responsible disclosure, despite it's name is often not the most responsible course of action to take.

And in any case, what does the FBI even have to disclose here? An exploit that they may or may not have that wold undoubtedly be contractually obligated not to share. In any case, everyone already knew that the crypto on that particular iPhone model was broken.

huuu• 10 years ago

What exploit? From the article:

"... according to people familiar with the matter."

There is absolutely no proof of an exploit here. There are a lot of people 'familiar with the matter' that talk BS. For example I heard some expert say that they just bought 1000 iPhones and copied the ROM on each phone to try each pin combination.

Edit: to be clear: I'm talking about a software exploit. I think it's more likely the phone was cracked via a hardware exploit.

spacecowboy_lon3• 10 years ago

Would not the FBI and the Subcontractor be bound by the US version of the offical secrets act.

na85• 10 years ago

I'm shocked to know that people still think law enforcement wants to protect the public.

lawnchair_larry• 10 years ago

The industry has rejected and abandoned the term "responsible disclosure". Like most cases, it doesn't make any sense here.

beedogs• 10 years ago

I knew those clowns couldn't have done it themselves. The FBI are more or less inept.

droopybuns2• 10 years ago

Philosophical rudderlessness: Fidelitry, Bravery, Integrity.

If you want a successful career in public service, don't serve the public. The FBI does not want the public protected from this vulnerability.

themartorana• 10 years ago

The FBI is willing to protect you how they see fit only, notwithstanding how that may fit within the bounds of Constitutionality. If you are not willing to give up such rights, the FBI will protect you through any means necessary - through force if it comes to it.

smegel• 10 years ago

I suspected as much. Those guys who kept jailbreaking time after time seem like good candidates.

rasz_pl2• 10 years ago

geohot is busy doing car AI

PascalsMugger• 10 years ago

I wonder what the price was.

Azkar• 10 years ago

How come the FBI isn't afraid these guys are going to sell the same exploit to foreign governments which will use them to break into US government phones?

roel_v3• 10 years ago

? The FBI probably assumes that yes, other actors do have access to unknown exploitable vulnerabilities.

It's 2016. Any data that hasn't been airgapped for the entirety of its existence needs to be considered if not public, then at least known to the enemy. (if accountants in tax havens would take that to heart, they wouldn't be in the predicament they are in now...)

madaxe_again• 10 years ago

Sorry, but selling to corrupt governments for personal profit makes you black, not grey, hat.

ComodoHacker• 10 years ago

So not the NAND mirroring thing, right? Just a software exploit?

bogomipz2• 10 years ago

Whats the NAND mirroring thing? Could you explain?

john_reel• 10 years ago

You copy the storage of the phone (the NAND) and then put it into a bunch of iPhones and try all 10,000 possible pins. If a phone gets locked out, you just restore the mirrored (the copied) NAND.

facepalm• 10 years ago

Just had a thought: couldn't you copy the encrypted phone, run it in 10000 emulators and try a different PIN in every emulator? If the problem really is just a 4 digit PIN, that should work?

Or is the flash memory and the flash memory controller doing the decryption entangled on a single chip so that they can not be physically separated?

zakarum009• 10 years ago

FBI also paid professional researchers to deanonymize the Tor network, so I don't see how this comes as a surprise to anyone.

wdr1• 10 years ago

Working under the assumption the FBI works for us, the people, I would hope two things:

1) They disclose the vulnerability to Apple and make us all safer

2) Having now unlocked the phone, disclose if there was additional information that materially helped the case.

I'm cynical about them doing either, but I think they're both reasonable requests from the population.

begemotz• 10 years ago

Did the FBI pay for them to hack or pay for the (exclusive rights to the) exploit? The rest of the article implies the latter- but if the former, what is stopping Apple from paying the "hackers" for the exploit?

bogomipz2• 10 years ago

Does any suspect that this might all just be PR posturing? They found a zero day exploit but they don't have to say what it was. They don't have to whether or not more interesting data was found. Nothing. Could it be they are just trying to save face? Granted they've looked quite foolish in all of this but still.

FBI paid professional hackers one-time fee to crack San Bernardino iPhone

Related Stories