FBI Makes Official Its Decision to Keep Apple iPhone Hack Secret

http://www.bloomberg.com/politics/articles/2016-04-27/fbi-makes-official-its-decision-to-keep-apple-iphone-hack-secret

by spuiszis • 10 years ago

158 112 10 years ago

danenania• 10 years ago

If the FBI can pay a million for the hack, what's stopping Apple? I'd expect them to be fully aware of it by now.

Someone2• 10 years ago

I would think the fact that they don't have an official bug bounty program makes it unlikely they have an unofficial one. If you are buying, it doesn't harm to make that public.

On the other hand, cases like these may make them consider starting a bug bounty program. and of course, they may already be advertising where it matters (e.g. by calling various hackers, or by using an intermediary to buy hacks) without telling the whole world.

Rumudiez• 10 years ago

I think it would be against Apple's brand image to publicly invite people to break their software, but your last point could be the case in a very limited fashion.

Apple has persisted its appearances in shipping stable, valuable software and hardware the first time quite well. No hiccups allowed here.

Admitting they can't catch every last bug before release would be killing this advantage in public perception they have over competitors like Microsoft.

anfedorov2• 10 years ago

I would think the fact that they don't have an official bug bounty program makes it unlikely they have an unofficial one.

Why is that? It seems to me that there are a lot of ways to run bug bounties, although I haven't thought through the details of Apple keeping theirs official / unofficial, it seems one could have arguments for having none, both, or either, depending on who you are and what kinds of bugs you are trying to get people to tell you about.

mjolk• 10 years ago

Well, even if they're buying, that doesn't mean someone is selling.

If I owned an apple tree and merchants were willing to give me $5 per piece of fruit, why would I sell the tree to a farmer for $10? That's assuming that I even want the farmer to know how I grew the tree.

chinathrow• 10 years ago

It might be a hardware flaw/hack what the company they contracted with had exploited.

joering2• 10 years ago

If the FBI can pay a million for the hack, what's stopping Apple?

Apple is not a government and does not act "in good faith of all - we the people".

In other words - its okay for the GOV to pay a company to extract data from someone's phone (aka "hacking"), it is illegal for a citizen to do so, whether you're paying to crack a phone, or paying to break into someone's house.

pygy_• 10 years ago

They can do it all they want on their own hardware, it's called 'pen testing' (short for 'penetration').

Matt3o12_2• 10 years ago

Organizations can also legally do that to their employees (assuming that that phone is a company phone). I've heard that some companies are very interested in restoring phones from former employers

nashashmi2• 10 years ago

I don't think Apple would pay. It is a previous gen phone, and Apple isn't going to work very hard to try to secure it.

The big question that looms in everyone's mind is if the hack can be used against next gen phones.

gherkin0• 10 years ago

It Apple paid for the exploit, then they could assess if it's usable against next-gen phones.

Matt3o12_2• 10 years ago

Maybe they don't want to sell it to apple because, assuming Apple hasn't already fixed it and it is found in further generation phones, they could sell this exploit once to Apple or to quite a few big companies, governments and other entities. Please keep in mind that we still don't know how they did that. They could have just dumped the flash memory And flashed it again if 10 passcodes failed (my guess), or they might have exploited a software bug.

antihero2• 10 years ago

In a fun turn of events, if Apple bought the exploit and it could be proven that they did, they could be expected to use it at the FBI's request in the future.

Zhenya• 10 years ago

You buy it to learn its function and then patch. The whole idea is to make attack method worthless.

intrasight• 10 years ago

I expect that the FBI bought an exclusive

lysp• 10 years ago

If I was the 3rd party and was being paid $1m a pop to use the exploit, why would they want to give the details to Apple to get it patched and lose their pay-day?

digler9992• 10 years ago

Micro-probing the bus lines, to disable the self-destruct or time-delay counter ? Or perhaps "glitching", sending badly-timed signals to the specific part of the asic that keeps count of the number of bad tries, causing it to lock up. Then brute forcing it at high speed.

j1vms• 10 years ago

sending badly-timed signals to the specific part of the asic

I would imagine that sort of thing would be very expensive to do correctly, unless you are only talking about feeding badly-timed signals at the asic pins.

digler9992• 10 years ago

someone out there helped design the asic/MCU that does this. individuals on that team would know how to do it very easily because they built the freakin' thing.

nodesocket• 10 years ago

I assume Apple already knows the hack/vulnerability. Apple should announce they know it, fix it, and give the FBI a big F-U.

unlinker• 10 years ago

What makes you assume that?

mhurron• 10 years ago

Why would you assume that?

lostgame• 10 years ago

Uh...this is probably a hardware flaw.

Without recalling all iPhones prior to the Secure Enclave, I'm not exactly sure how they would 'fix it'.

yuzi• 10 years ago

It's more likely that Apple did the work for them and they are both hiding it.

Rantenki• 10 years ago

There is no reason to assume that apple is either aware of the bug, or that they assisted the FBI in breaking the phone.

It is not only common, but NORMAL for hackers to have unknown exploits before the vendor is aware of them. Where do you think 0-days come from? In fact, there is an annual competition to break these devices with previously unknown attacks at CanSecWest.

Example: http://9to5mac.com/2014/11/13/iphone-5s-samsung-galaxy-s5-ne...

Someone2• 10 years ago

How would Apple know that _a_ vulnerability they know of is _the_ vulnerability that the FBI used, and that the FBI does not want to talk about, other than that it gave it access to one iPhone 5?

Esau• 10 years ago

I personally don't have a problem with this, just as I had no problem with Apple not wanting to help the government with an investigation. I don't think it is right to want it both ways.

ksdale• 10 years ago

I'm not sure I have a problem with this, but I think it's perfectly consistent to want it both ways. There are plenty of rights that accrue to citizens that don't accrue to government actors and vice versa.

nashashmi2• 10 years ago

rights that accrue to citizens that don't accrue to government

Apple should not be compelled to help the government break into one of its devices. But they can "choose" to help the government break in. Likewise, government should not be compelled to help secure its companies by buying zero-days off the black market for public security. But again they can "choose" to.

The cooperation of corporations and goverments is a symbol of trade and teamwork. The lack of cooperation is a symbol of distrust and hostility.

r0m4n0• 10 years ago

The government doesn't get to play by the same rules as private companies. They don't get to operate under a veil of secrecy unless they can justify why so. They really didn't provide useful details in this article but claiming ignorance seems absurd and a bit of an eye for an eye mentality...

Johnny555• 10 years ago

If the FBI were a private organization, I'd agree with you, but the FBI is paid by the public and is supposed to be protecting the public, so they should not leave the public open to a gaping security hole in a product that millions of people use.

They can't even pretend that the technique would never be utilized by "bad guys" outside of the USA government since whatever the technique is, it's already available for purchase.

nickpsecurity• 10 years ago

They are protecting the public. Just a question if it's the best decision to make for the public. Without backdoors, 0-days are a legit tool for law enforcement. Even Bruce Schneier likes it as a compromise IIRC.

wildmusings2• 10 years ago

Yeah, and British intelligence should have just called up the Germans to tell them that their Enigma machines weren't configured correctly.

haberman• 10 years ago

I've never seen government decision-making work first-hand, so I wouldn't claim that this speculation should carry weight.

But if I was someone on the FBI side who wanted to "win" this somehow, I could imagine how this might look like a victory. Apple wanted for its phones to look so secure that they will even stand up to the government to protect them. In response, the FBI made Apple's phones look so weak that anyone who has $1M to spend on the black market can get in.

simondedalus• 10 years ago

spending $1m to get into a 5c isn't exactly a PR disaster for apple.

nxzero2• 10 years ago

Agree, Is anyone even able to cite another singlural exploit that was solid for over a million?

r00fus• 10 years ago

Exactly - anyone security conscious and even partially informed (or relying on those who are informed) would see this as a reason to upgrade to secure-enclave enabled device (ie, iPhone5S or better).

dexzod• 10 years ago

I don't think this is a victory. They wanted to backdoor every future IPhone. They did not get that. If they had to pay 1M+ to break an iphone, it means it is not cheap to break an IPhone which is the whole point of encryption.

dimino• 10 years ago

Just seems petty of the FBI to actually make an official announcement like this. I get if it's understood that they're not releasing it, but why make a formal press release about it?

mikx007• 10 years ago

What would stop one or couple of apple engineers from creating a backdoor and then selling a "unlock service" trough some foreign intermediary making $1 mil each time?

eumoria• 10 years ago

probably the threat of being caught and subsequent consequences probably stop them. also (not saying Apple does and it's hard to do) but companies compartmentalize portions of software making it difficult for an individual to go rouge and break apart the security. higher up engineers probably could but the risk is pretty crazy especially with the new "we can just do whatever we want" terror laws that they would probably lay on them

therein• 10 years ago

not saying Apple does and it's hard to do) but companies compartmentalize portions of software making it difficult for an individual to go rouge and break apart the security

Apple does this to an extreme. You can't even see the code to projects you are not on. Oh someone else's code has a bug? Well, you can do symbol search across the entire codebase but you will get the line featuring the symbol, the line above it and the line below it.

zeckalpha3• 10 years ago

What would stop one or couple of TLA agents to get jobs as apple engineers, create a backdoor and then selling a "unlock service" trough some foreign intermediary making $1 mil each time to avoid VEP?

JustSomeNobody• 10 years ago

Would FOIA apply here in any way?

djrogers4• 10 years ago

They could just reject the FOIA claim, stating it's part of an 'active investigation' for the next decade or so.

pcl• 10 years ago

This is a scary precedent.

From the bits I've seen of it, the Vulnerabilities Equities Process is a really great bit of government transparency, run by a group of people who understand that the best interests of different parts of the government and the citizens of the country often end up at odds. The process allows for vulnerabilities to be periodically reviewed so that the costs and benefits of not disclosing can be weighed over time, and by an at-least-somewhat independent group.

Just skipping it altogether because "we paid a contractor" completely subverts the process. What's stopping all the TLAs from simply routing all their vulns through a private third party and bypassing the VEP altogether?

nxzero2• 10 years ago

Makes you wonder who is really "Public Enemy No. 1" now.

ilyanep• 10 years ago

Public: enemy no. 1

kodablah• 10 years ago

How are they supposed to submit a vulnerability they don't know about? I'm willing to bet they chose to remain willfully ignorant of the details. Are you saying they should not be allowed to outsource the work but instead must obtain the full exploit or nothing?

The real scary precedent is that they paid that much without obtaining the vulnerability exclusively and the technical aspect behind it. Or maybe it's not a scary precedent (except in tax monies) that they outsourced the vulnerability without obtaining the know-how to reuse it on a whim.

Either way you look at it, it is opaque, regardless of whether it goes through the VEP (and the ERB within) or they use a secret company. Were one way more transparent than the other then we should definitely favor that approach.

bhuga• 10 years ago

It's bad enough that the VEP was bypassed, but the high-profile, 7-figure payout for the security researchers who had their hands on the bug is a problem too. Plenty of bug bounty programs have remote code execution at $10k, but the FBI paid _100 times_ that. That's an amount of money that some bug hunters might find very challenging to turn down. And this is "above board", with no shady bitcoin payments from dingy IRC channels.

zeckalpha3• 10 years ago

Even with it 100 times more, its still cheaper than the legal fees they were facing.

ryanlol• 10 years ago

The payout wasn't particularly big, bug bounty rewards are just a bit of a joke.

madaxe_again3• 10 years ago

You assume they were "security researchers" and not, say, a black-hat syndicate based out of Anonymouskaya Oblast.

bsder• 10 years ago

Why do you think SAIC has so many government contracts?

Part of it is that the government can have SAIC or their subcontractors do the shady things that the government might actually get taken to task for.

madaxe_again3• 10 years ago

Well, what I read this as is "the FBI supports organised crime".

I mean, they've paid black hats for an exploit, and are now protecting their identities.

What if the FBI colluded with a mobster - oh, Bulger. Yeah, nothing new here, just the same old crooks being the same old crooks.

taildrop• 10 years ago

This might be great for the FBI right up until they actually try to use the evidence in court. The defense attorney can claim (rightly so) that unless they can examine the unlock method to verify it doesn't tamper with any of the data on the phone, the evidence is inadmissible.

The only way the FBI will be able to use this data in court is if they turn the process over to the defense so they can have the process independently verified. Since the article states that they don't have access to the "technical details" of the hack, they have no way to prove the method doesn't manipulate the data on the device.

djrogers4• 10 years ago

This was never intended to be used in court - the guy who carried the phone is dead, as is his wife and partner-in-slaughter.

dantillberg• 10 years ago

Information obtained from the phone could have been used to implicate a third party, though.

djrogers4• 10 years ago

https://www.whitehouse.gov/the-press-office/2015/02/13/execu...

Then again, goose!=gander

Claudus• 10 years ago

Not to be a conspiracy theorist, but maybe they don't actually have a hack. Maybe they just want people to think they do.

delecti2• 10 years ago

That seems like the most likely explanation to me too.

meddlepal• 10 years ago

Really the most likely explanation is that Apple writes security bug free code? My guess is the FBI found someone who knew how to exploit the phone or asked a 3rd party with connections to the NSA so there is a level of plausible deniability on the origins.

CaptSpify• 10 years ago

Although I'm skeptical of that idea, it does follow the popular narrative of "The actual goal of this was to force Apple to make a back-door, not to get info from the phone"

coherentpony• 10 years ago

Oh, now they care about privacy.

justinlardinois2• 10 years ago

Did any of the commenters here actually read the article?

Although the FBI paid more than $1.3 million for the method, Amy Hess, the agency’s executive assistant director for science and technology, said Wednesday that it didn’t purchase the rights to the technical details and therefore doesn’t have the necessary information to submit the method for an Obama administration review known as the Vulnerabilities Equities Process. "The FBI assesses that it cannot submit the method to the VEP," Hess said in a statement. "We do not have enough technical information about any vulnerability that would permit any meaningful review.”

...

The law enforcement agency bought the hacking tool from an entity it hasn’t identified and then used it to access data on an encrypted iPhone

It sounds like the FBI doesn't actually understand the details of how the crack worked and was hand-holded through the process.

sprucely• 10 years ago

How could any information obtained in such a way be useful to them, as there is no way to prove it is not tainted (chain of custody and all that?)

uxp• 10 years ago

It's not useful for them for any specific investigation, but it certainly can tell them where they might stick their fingers next.

ikeboy2• 10 years ago

https://news.ycombinator.com/item?id=11585324

tl;dr tainted refers to evidence obtained illegally and is not applicable here.

williamscales• 10 years ago

I think the general implication that's being suggested is that the FBI is all too happy to not know the details. It sets a dangerous precedent where these sorts of things are routed through contractors so that safeguards like the VEP are bypassed.

equalarrow• 10 years ago

Exactly. The 3rd party will hold this method (until patched some day in the future possibly) and they FBI will keep coming back, paying an initial seed round equivalent for possibly no usable data, claiming the same 'defense'.

This just shows typical contempt for the public in general. Why should we be surprised?

themartorana• 10 years ago

Is there any sort of path to holding the FBI responsible for aiding and abetting a criminal organization, or even working with domestic terrorists? I imagine that's what I'd be labeled by the FBI if I hacked someone's phone (or many peoples' phones) with this exploit.

davesque• 10 years ago

So, if I understand correctly, the FBI doesn't really know how the phone was hacked? Wouldn't that also mean that they don't really know if the data their contractors retrieved from the phone is really from the phone?

awqrre• 10 years ago

"randomly" generated data, to assure accuracy

CamperBob2• 10 years ago

Translation: We got taken for a $1M ride, and have neither a valid exploit nor any data to disclose.

pfista• 10 years ago

Isn't this title a little misleading if they never knew the actual technical process of hacking the iPhone? They can't share what they don't know.

zmmmmm• 10 years ago

I hope that the security community reciprocates: if the FBI won't disclose security flaws to the community, then neither should the security community give the FBI any special privilege or notice in disclosing flaws in FBI software. The FBI might then learn about the benefits of disclosure the hard way.

icpmacdo• 10 years ago

These times are so interesting. The FBI is making policy that they wont expose the 0 days they bought for over a million USD. We need to consider the amount of cool things we learn right now and appreciate it.

yeukhon• 10 years ago

Are we sure the FBI is not bluffing?

namelezz• 10 years ago

Is FBI faking again [1]?

[1] https://news.ycombinator.com/item?id=11578240

mattnumbe• 10 years ago

Ive got a friend at Sun Corporation who, a few weeks ago, when I congratulated her on the recent (unconfirmed) news of her company, she said it was Cellebrite's news and not theirs.

krisgenre• 10 years ago

I am really beginning to think if the FBI actually used a hack. There were reports that the passcode was changed when in FBI's possession, what if this was just a deliberate attempt to force Apple to create a backdoor?

madaxe_again3• 10 years ago

You mean they had access in the first place, and this is all smoke and mirrors to cover the fact that they were bluffing when they were trying to subvert apple, and there is no hack?

Plausible, actually - and if they wanted a cover story that would cause apple as much collateral damage as possible, they've chosen well - as blowback doesn't matter to the FBI. They're untouchable gods, above the law, above public sentiment.

FBI Makes Official Its Decision to Keep Apple iPhone Hack Secret

Related Stories