Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Communications Encryption Government IOS Iphone Privacy Security Software The Internet United States Apple Technology

FBI Paid Professional Hackers One-Time Fee To Crack San Bernardino iPhone 149

Posted by msmash from the fbi-vs-apple dept.
There's another new wrinkle in the never-ending FBI vs Apple saga. The Washington Post is claiming that FBI did not require Cellebrite's assistance in hacking San Bernardino iPhone. Instead, the report claims, the government intelligence organization bought a previously unknown security bug from a group of professional hackers. According to the report, the hacker group provided FBI with at least one zero-day flaw in the iPhone 5c's security, which enabled FBI to circumvent the lockscreen and other security features. The bug hasn't been disclosed. FBI has previously noted that the technique it utilized in breaking into the iPhone 5c does not work with any new iPhone models (iPhone 5s or newer).
This discussion has been archived. No new comments can be posted.

FBI Paid Professional Hackers One-Time Fee To Crack San Bernardino iPhone More

FBI Paid Professional Hackers One-Time Fee To Crack San Bernardino iPhone

Comments Filter:

  • And Vindicated.... (Score:5, Informative)

    by Lumpy ( 12016 ) on Wednesday April 13, 2016 @09:42AM (#51899643) Homepage

    i was telling people that the FBI was lying and Cellbright did not sell them anything to do this...

    Remember kids, DO NOT TRUST law enforcement. they are not there for your protection.

    • Re:And Vindicated.... (Score:5, Funny)

      by bill_mcgonigle ( 4333 ) * on Wednesday April 13, 2016 @09:47AM (#51899691) Homepage Journal

      It's OK, the FBI eventually, after it's caught and cornered, tells the truth.

    • Re:And Vindicated.... (Score:4, Insightful)

      by Anonymous Coward on Wednesday April 13, 2016 @09:51AM (#51899751)

      i was telling people that the FBI was lying and Cellbright did not sell them anything to do this...

      Remember kids, DO NOT TRUST law enforcement. they are not there for your protection.

      Neither are the software providers. Apple, Microsoft, Google, Facebook, Amazon, etc. are not there for your protection.

      TRUST NO ONE.

    • Arn't they? Oh ok. (Score:2, Insightful)

      by Viol8 ( 599362 )

      So tell us great sage, who should we turn to for help against criminals, Apple?

      • Re: (Score:1, Flamebait)

        by wvmarle ( 1070040 )

        Get a gun, be your own cop. Shoot first, ask questions later, That's the American way, no?

      • So tell us great sage, who should we turn to for help against criminals,

        You probably have no recourse. If someone breaks into your house, the police aren't even going to take fingerprints, if they even come out at all [telegraph.co.uk].
        If you get death threats, the police will tell you they can't protect you [jezebel.com]. They have no legal obligation to do so [fee.org].

        • Re:Arn't they? Oh ok. (Score:5, Interesting)

          by rgbatduke ( 1231380 ) <`ude.ekud.yhp' `ta' `bgr'> on Wednesday April 13, 2016 @02:42PM (#51902449) Homepage

          This is precisely my experience. Every time I've been broken into and called the police, a bored looking cop comes out, takes a statement, looks at the point of entry and then leaves, never to be heard from again. They only do this much so you can file your insurance, if you are stupid enough to file your insurance (since the insurance company will then just upgrade your risk and raise your rates enough to cover your payout plus an indefinite bleed of additional profit for them for the rest of eternity. No fingerprints. No searching area fences or eBay for your lost goods. No questioning likely suspects. If they are feeling enormously helpful, they may suggest that you get the broken lock fixed as the bad guys might come back and steal some more, and no, they aren't going to stake the joint out to find out.

          Law enforcement is almost non-existent. Police are often called on to "keep the peace" -- to intervene in potentially dangerous situations involving human conflict or risk -- but they don't go out of their way to arrest anybody even then. They do arrest shoplifters, but that is because there is usually hard evidence and the perps are caught in the act. They do arrest anybody who rubs drug usage in their face and spend at least some time arresting the merely unwary. They do a decent job at pulling drunk drivers, when they catch them for obvious driving errors. Outside of that, by far -- far -- my most common interaction with Law Enforcement is getting pulled with a car tag a month out of date. Damn, they are hell on car registration. Makes me feel safe at night, knowing that no scofflaw is able to drive around without properly registered tags, unless of course they are an illegal alien without any driver's license or insurance at all driving a company truck.

          Sigh.

          The two laws that get en

          • The only way I know to get police to act is to have your lawyer contact them. It's really frustrating, actually.

          • And yet (Score:1)

            by Anonymous Coward

            And yet, they're clearly spread thin and underfunded in a lot of places. The same places defeat community policing measures. Because taxes. And the public is outraged, just outraged, that things are then relegated to minimal police response due to this reality. Reminds me of the nursing profession. Snake head? Meet snake tail!

      • Re: (Score:2)

        by Lumpy ( 12016 )

        Winchester.

      • The police are there to arrest criminals, but you are responsible for your own safety.

        Call the police when you see criminals that they can arrest, but be prepared to defend yourself until they can get there.

        It's supposed to be a team effort...

        And, "Trust but verify".

    • Re: (Score:2, Interesting)

      by UnknowingFool ( 672806 )
      I found the timing suspicious at first. Cellebrite's previous known technique was to copy the entire NAND RAM contents then use the copies to repeatedly try the code. That would take a while even with 10000 number combinations.

      • Re:And Vindicated.... (Score:4, Insightful)

        by wonkey_monkey ( 2592601 ) on Wednesday April 13, 2016 @12:12PM (#51901045) Homepage

        That would take a while even with 10000 number combinations.

        I hear they have computers that can count up to 10000 now.

        • Well considering their technique would require
          1. trying 10 codes
          2. de-solder the chip
          3. re-flash the chip
          4. re-solder the chip
          5. repeat step 1

          That would take a long time.

          • Re: (Score:2)

            by Lumpy ( 12016 )

            dont have to desolder and resolder the chip.. Desolder existing chip, solder on advanced chip simulator connection. Run phone using the simulator hardware and reset image every attempt. It's not hard at all to have a modern PC completely simulate a chip with some extra hardware. Hell an FPGA could do the job easily.

            • It would still take a while to go through the combinations. A few weeks. I was suspicious that it took a few days (including time to get the phone to Cellebrite).
    • I've really been wondering lately whether the FBI has ever done anything good. They must have done something, but I can't think of anything good they've done. Maybe stop some bank robbers in the early 1900s?

    • Hard to lie when you don't say anything. The FBI using Cellebrite's service was only ever a rumor, they never actually said they used them. I know the Slashdot article indicated it was the way it happened, but other news sources listed the connection as presumed.

      http://www.bbc.com/news/world-... [bbc.com]

      If you read the article carefully, an Israeli newspaper said Cellebrite helped the FBI, the FBI did not state that, nor did Cellebrite.

  • In two weeks they'll come out and say that the phone was never cracked at all and that they just wanted to set a precedent.

    Just kidding, why would they lie. /s

  • proving the point: (Score:3, Insightful)

    by Anonymous Coward on Wednesday April 13, 2016 @09:54AM (#51899789)

    if these guys can do it, and the FBI can now do it, then ANYONE can do it. The chinese, north korea, data theives -

    and the american government wants to force companies to put shit like this in their software on PURPOSE?

    • Re: (Score:2)

      by Creepy ( 93888 )

      According to the article, they had to craft specific hardware to retrieve the PIN and I'm guessing you need to not only possess the phone, but pull it apart to use this exploit. I had a suspicion that the firmware security in that phone could be exploited with a hardware hack and it turns out that is true. From the sound of it, a remote exploit isn't possible using the method described.

  • I know!!! (Score:4, Funny)

    by Lab Rat Jason ( 2495638 ) on Wednesday April 13, 2016 @09:55AM (#51899807)

    It was John McAfee! The FBI didn't admit it because they still want to see him eat a shoe!

  • Do the same (pay a hacker to break a giant's product) and go to jail.

    • Re: (Score:1)

      by Anonymous Coward

      The warrant is what makes it legal. With a warrant the FBI can legally ransack someone's house. Do the same without a warrant and you're called a burglar and you may go to jail.

  • jes sayin'

  • Undercover AD? (Score:1)

    by Anonymous Coward

    "FBI has previously noted that the technique it utilized in breaking into the iPhone 5c does not work with any new iPhone models (iPhone 5s or newer). "
    GO GET ONE!!! (And we already broke 5s, so don't bother expecting better provacy)

  • Give them a little time - assuming the phone has actually been cracked - and they'll come out and say that they found all kinds of terrorism-related material on the phone. Then they'll start telling us that this is why we shouldn't be able to have encryption or privacy and restart the fight to get laws passed banning it, because terrorism and for the children.

  • Why did FBI claim they would start helping police? (Score:5, Interesting)

    by JoeyRox ( 2711699 ) on Wednesday April 13, 2016 @10:06AM (#51899903)
    After they "cracked" the San Bernardino phone the FBI publicly came out and said they would use the information they gleaned to start assisting local law enforcement agencies to crack iPhones for their cases as well. I guess that was a bold-face lie, told to make Apple look bad to their security-conscious customers who are concerned that the FBI now has the ability to crack iPhones.

    • Re: (Score:1)

      by Anonymous Coward

      They paid a one time fee for an exploit. That exploit could in theory work on any iPhone 5c (unpatched), and there are plenty of those waiting around in evidence lockers.

      If the article stated somewhere that the FBI paid for a one-time crack only, not the exploit itself (which is stupid beyond belief for a government agency) then I'm sorry.

      • They paid a one time fee for an exploit. That exploit could in theory work on any iPhone 5c (unpatched), and there are plenty of those waiting around in evidence lockers.

        If the article stated somewhere that the FBI paid for a one-time crack only, not the exploit itself (which is stupid beyond belief for a government agency) then I'm sorry.

        Actually, that was one of Apple's less-successful models in terms of sales numbers. So, I would imagine that, while there are undoubtedly some in evidence rooms, they are not as prevalent as some of the other models.

      • But it also needed some custom hardware created to make use of the exploit. So unless they are going to build hardware for all the police departments out there, or have them send the phones off to the FBI, it isn't going to do much good.

    • and a potential boon for Apple as all these customers still using last year's model now have to upgrade to this year's models!

      • and a potential boon for Apple as all these customers still using last year's model now have to upgrade to this year's models!

        The 5c was three revisions ago at this point. Do try to keep up.

    • And the information they'll provide is: "Here use these guys. Don't tell anyone who you paid."

    • As likely as not a bald-faced lie to make Apple look good. They can probably hack into any Iphone now, but made a big show about a legal case against Apple and now to buy an exploit into an almost obsolete phone as a distraction. People especially bad actors will stay with Apple thinking they are secure.

  • I really wonder which hackers they hired... someone they are investigating, or just a dark web personal ad from Estonia. The more they say the more idiotic they sound. The FBI sounds as inefficient as the TSA and Congress. A bunch of blowhards with authority that can't get the job done properly because nobody trusts or likes how they operate. Public servants that are always at odds with the public, and never have any good news to report. Nevertheless, never getting the job done is the only job security

    • Re:Did they call The Hackers R Us Store? (Score:4, Interesting)

      by macs4all ( 973270 ) on Wednesday April 13, 2016 @11:15AM (#51900533)

      I really wonder which hackers they hired... someone they are investigating, or just a dark web personal ad from Estonia. The more they say the more idiotic they sound. The FBI sounds as inefficient as the TSA and Congress. A bunch of blowhards with authority that can't get the job done properly because nobody trusts or likes how they operate. Public servants that are always at odds with the public, and never have any good news to report. Nevertheless, never getting the job done is the only job security that exists anymore.

      Since they have changed their "post-hack" story at least once, I submit that the FBI either already had the phone hacked (sans Apple's help), OR they never DID get into the phone (more likely); but needed a plausible excuse to sabotage their own legal efforts, since it was pretty clear that the Court case was NOT going to go their way, and they didn't want to set THAT Precedent.

  • NAh it ws a two-fer for the fbi (Score:1)

    by Anonymous Coward

    They then arrested the cracker for DMCA violations and got their money back through civil forfeiture. Whilst at the same time being able to claim they reduced computer crime and cut off funding to terrorists and strike a blow against child pornography rings.

  • Ethics kick in on this one. (Score:4, Interesting)

    by TheHawke ( 237817 ) <rchapin @ s t x.rr.com> on Wednesday April 13, 2016 @10:38AM (#51900197)

    You know the director will be dragged in on the carpet by congress on the ethics of using hackers at this level.

    If they paid them using gov't funds, lets hope they kept track of the funds used.

  • Because encryption alone won't stop the state, who will find a way to get in somehow. Especially considering they have access to all the other data products a telecommunications device like a phone produces, without needing one.

  • My question is: Have they said whether they found useful information on the phone? (Not that I necessarily trust them to answer that truthfully at this stage.)
  • Keep in mind that the exploit could be as simple as brute forcing the PIN and cutting the power after each unsuccessful attempt: http://blog.mdsec.co.uk/2015/0... [mdsec.co.uk]

    At the machine's rate of one PIN every 40 seconds, that's only about 111 hours to brute force a 4 digit PIN.

  • Apple has no interest in running afoul of the US government. What they are concerned about is letting the public know that they cooperated. Do they really care if the FBI gains access to this phone? Of course not. I'd have to guess that Mr. Cook is opposed to terrorism and would like it stopped.

    My guess is that this was a shady, unofficial back-alley deal between Apple and the FBI. "Here's how you do it. Here's some hardware to help. You never saw us. We don't exist."

  • The agency they should have turned to for help in the first place?

Slashdot Top Deals

Heisengberg might have been here.

Close