FBI Gains Access to Suspected Trump Shooter’s Password Locked Phone

https://www.404media.co/fbi-gains-access-to-suspected-trump-shooters-password-locked-phone/

by jbegley • 2 years ago

32 35 2 years ago

chatmasta• 2 years ago

The article doesn’t say much. The device brand and model has not been disclosed.

bell-cot3• 2 years ago

If true (and lying in this case would be high-risk), then there probably isn't much of interest on the phone. Otherwise, they'd be busy with leads from the phone. Not telling Mr. Perp's shady associates to expect a knock on the door soon.

quantified• 2 years ago

Why can't they also be busy with leads and just tight-lipped?

bell-cot3• 2 years ago

In this particular case, there may be a burning-hot political need for the FBI to be publicly perceived as making very fast progress.

jki2752• 2 years ago

I think it's extremely likely there are no leads and there is nothing to actually investigate beyond a radicalized young adult who did something terrible.

sandworm101• 2 years ago

Maybe there are no leads. The guy is dead. This could easily have been a true loan wolf situation. Not every killer has a convenient manifesto documenting their motivations. Some just kill people and we will never know their internal minds on the matter.

bangaladore6• 2 years ago

This is a massive deal if a big company like Apple or Samsung produced the Phone.

Modern "secure enclaves" found in nearly every phone and computer should be impossible to brute-force or leak secrets.

Unless, of course, the phone allowed fingerprint / face-id and the corpse was used. I believe on Android, you still have to use a PIN with every restart. Presumably, Apple is the same. Unsure if time since last unlock is also a factor.

laidoffamazon• 2 years ago

It's not implausible that the parents of the deceased simply knew and provided the password.

bangaladore6• 2 years ago

I agree, in my opinion in order of likelihood:

1. Face-id / touch-id was still available to be used

2. Old phone without modern security measures (can brute force offline)

3. Someone else knew the pin/passphrase

...

∞. They bypassed a modern/certified secure enclave

Someone• 2 years ago

That there even is a working phone shows the shooter either didn’t worry about the feds finding out what’s on that phone, or didn’t think things through well.

Given that, there’s a decent chance the phone’s password is 1234 or some day of the year that’s relevant for the phone owner.

OutOfHere2• 2 years ago

Odds are high that the password wasn't very strong or long. Who really wants to type a long and complex password every time. This means the phone can be imaged, then brute-forced on a server.

bangaladore6• 2 years ago

This means the phone can be imaged, then brute-forced on a server.

No, it cannot be, which is what I'm saying in my comment.

You cannot clone "secure enclaves." They are hardware mechanisms, not software.

Additionally, things like secure-enclaves have made pin length/commonality being a significant risk factor largely a thing of the past. If you only have ten tries, you will likely miss the correct pin, no matter the statistical likelihood you might find it.

Jtsummers• 2 years ago

https://web.archive.org/web/20240715193420/https://www.404me...

andrewla• 2 years ago

FBI statement without blogspam is at [1]

[1] https://www.fbi.gov/news/press-releases/update-on-the-fbi-in...

sillysaurusx• 2 years ago

Since then, a company called Grayshift launched the GrayKey, a small device that was capable to breaking into modern iPhones. Those devices proliferated across the country, to federal, state, and local law enforcement, and are now a mainstay in forensic investigations.

Anyone know about GrayKey? Curious how it works.

Their website (https://www.magnetforensics.com/products/magnet-graykey/) claims “ Magnet Graykey can provide same-day access to the latest iOS and Android devices – often in under one hour.”

Gabriel_Martin• 2 years ago

change some config files to prevent attempt limit lockout then brute force?

sodality2• 2 years ago

Modern iOS devices have a hell of a lot more than a simple config file (see: secure enclave)

jki2752• 2 years ago

It works on certain models and certain OS release levels that have known exploits. That's all it is.

bangaladore6• 2 years ago

Given that all their marketing material is extremely old IPhones, I would bet money this is a bunch of marketing jargon to trick police departments into giving them money.

gnfargbl2• 2 years ago

Without further information there are really no useful security conclusions to be drawn. The technical experts in question may have an advanced lock screen bypass, or they may have tried entering his birthday as the passcode.

lukas0992• 2 years ago

Yeah, highly doubt they'd leak info about some exploit in a high-vis press release like this.

gnfargbl2• 2 years ago

They haven't leaked anything even if they do have a capability, because we can't know what they did. From a Bayesian point of view the information we gained here does nothing to help us distinguish between potential alternatives like "FBI has a zero day", "vendor has a secret backdoor" and "turns out you can face unlock a phone using a corpse".

typeofhuman• 2 years ago

Don't they have his body? Couldn't they replicate or use his actual fingerprint/face/eyes?

ChrisArchitect• 2 years ago

tl;dr

The FBI made a note that they accessed the phone, posted by NYT etc, https://www.fbi.gov/news/press-releases/update-on-the-fbi-in... , there isn't any other information.

webninja• 2 years ago

Isn’t the basic attack method:

  A) make a copy of the memory and hard drive (encrypted with a pin).

  B) try a few pins until you’re locked out.

  C) revert back to the copy you made in step A.

  D) Try a few pins until you’re locked out.

  E) Then after a day or two after all pins have been automatically tried and it has been unlocked, you’re in.

I bet they have faster and more efficient methods than this via some secret unpatched vulnerabilities or exploits but if they ever run out of them, this tried and true method works too.

tommiegannert• 2 years ago

That's why we have TPM chips now.

If you could brute-force memory, you don't need (C), because it would be easier to automate than doing on-device.

FBI Gains Access to Suspected Trump Shooter’s Password Locked Phone

Related Stories