Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Ah I get it now. But how would Apple know what's a trusted wifi network? Via iCloud Keychain?

Yes
[doublepost=1455929508][/doublepost]
Again, you miss the point. The point is that you don't go to the destination to get what you are looking for. You go to the intermediary: The WiFi hotspot. Sniff there to get what they were looking for, not the destination (iCloud).

BL.

You sound like the guy who'd take a picture of his feet to see them.
 
I don't think you can "remotely" turn on iCloud backups. I thought if you changed the password on your iCloud then you had to input it again on your device. If the device wasn't on a known wifi network then it would not have prompted for the new password.

I don't know. There are holes here that I think my mind is trying to fill, unsuccessfully at that.
So I'm wondering, did they change the password so they could access information via icloud.com? And they didn't know that changing the password would require it to also be changed in the settings app on the device?
 
I read this early this afternoon and was going to post but didn't understand how this was done.

Excerpt from the Washington Post article below:
"According to the Justice Department’s filing, the county health department, which owned the phone, had remotely reset the iCloud account’s password while seeking information in the hours after the attack. As a result, the phone could not be automatically backed up to that account after the password was changed."

https://www.washingtonpost.com/news...-due-to-worry-about-impact-on-its-reputation/

Interesting read.
So how does one remotely reset your iCloud account password?

Found the DOJ's pleading that was filed today:
https://assets.documentcloud.org/documents/2715926/Motion-to-Compel-Apple-Compliance.pdf
 
Last edited:
So I'm wondering, did they change the password so they could access information via icloud.com? And they didn't know that changing the password would require it to also be changed in the settings app on the device?

The fbi didn't change the password. His employer did.
 
So how exactly does these backups work?

Can the FBI see everything Apple puts in your backups? I mean, almost everything goes to your backups.
 
Nobody knows what's on it. It was not a personal phone (that was destroyed already). This was the work phone that belonged to his office. To be honest it's doubtful there's anything of importance connected to this case. As much planning as was involved, why would they leave evidence on this phone since it could be confiscated at any time because it wasn't his.
This matter is more likely a test. The authorities are using this as a test to see if they can circumvent security via the courts, which would open up a huge can of worms. It's not just this phone they are after. If they can force apple to unlock this phone and create a backdoor through the court system then this, by extension, will allow them to force all companies to create back doors in all OSs as precedence. As stated elsewhere, if the US govt can have it, every other govt will want the backdoor also. AS unscrupulous as the authorities in the US have seemed, imagine a situation where much less benign powers had the same ability. And It wouldn't be long until he process fell into the hands of NGO's as we hear daily about govt networks being compromised. This is a much bigger issue than one phone.
The majority of information on this phone can be recreated with information already at their disposal via the phone companies however the work involved would take analysts much longer to piece together than if they just had a master key.

That fact they have no idea what is on this phone, the fact that it's his work phone and the likelihood that it has no related information on it is high, shows me that it's less about the phone, and more about the future of encryption in the US.


Everything from October 19 to the point they died (and beyond perhaps, if there's incoming communication?)
 
I read this early this afternoon and was going to post but didn't understand how this was done.

Excerpt from the Washington Post article below:
"According to the Justice Department’s filing, the county health department, which owned the phone, had remotely reset the iCloud account’s password while seeking information in the hours after the attack. As a result, the phone could not be automatically backed up to that account after the password was changed."

https://www.washingtonpost.com/news...-due-to-worry-about-impact-on-its-reputation/

Interesting read.
So how does one remotely reset your iCloud account password?

Iforgot.apple.com ; another device logged into the same account ; I assume there's some kind of way to do it though MDM also?
 
From my understanding of this, Apple suggested creating an iCloud backup by taking the phone to a known wifi network, plugging it in and letting it do its thing. But because the password had been changed on the Apple ID, that wouldn't work - the password would need to be entered first (so that's now two things to crack. Yay).

Is this spin on apples part? The fbi say they have access to the backups up until 19 October. That means the only way that plan would have worked anyway was if he hadn't left the phone plugged in on a known wifi network for SIX WEEKS. Or, as the suggestion was in earlier articles, he deliberately disabled it, in which case this plan would not have worked.

I support Apple on this but this seems like using a get out of jail free card.
Most likely scenario is that the suspect's measly 5GB of icloud storage was full. Apple upped the icloud storage available to the account on their end, then told the FBI to connect to known wi-fi network and plug in the phone. That would have created a new backup had some dumb-ass not changed the Apple ID password.

Once the backup had been created, a new device could have been set up with the Apple ID and password and restored from the new iCloud backup - no passcodes and backdoors required.
 
  • Like
Reactions: spinnyd and beebarb
Nobody knows what's on it. It was not a personal phone (that was destroyed already). This was the work phone that belonged to his office. To be honest it's doubtful there's anything of importance connected to this case. As much planning as was involved, why would they leave evidence on this phone since it could be confiscated at any time because it wasn't his.
This matter is more likely a test. The authorities are using this as a test to see if they can circumvent security via the courts, which would open up a huge can of worms. It's not just this phone they are after. If they can force apple to unlock this phone and create a backdoor through the court system then this, by extension, will allow them to force all companies to create back doors in all OSs as precedence. As stated elsewhere, if the US govt can have it, every other govt will want the backdoor also. AS unscrupulous as the authorities in the US have seemed, imagine a situation where much less benign powers had the same ability. And It wouldn't be long until he process fell into the hands of NGO's as we hear daily about govt networks being compromised. This is a much bigger issue than one phone.
The majority of information on this phone can be recreated with information already at their disposal via the phone companies however the work involved would take analysts much longer to piece together than if they just had a master key.

That fact they have no idea what is on this phone, the fact that it's his work phone and the likelihood that it has no related information on it is high, shows me that it's less about the phone, and more about the future of encryption in the US.

I don't disagree, I was just answering a rather obvious question. :)
 
I doesn't seem like the government is coming clean and transparent with information.
They make it seem in the Intro (of the Motion) that Apple is not co-operating to help them with the investigation (see Intro of the Motion to Compel). And then go on to paint Apple as being "bad", while in fact, we are now hearing:
  • Apple was in discussions with them and did try to help the FBI
  • The password Apple ID was changed while in the device was in government hands (FBI blames the health dept)
Regardless, the fact the FBI did not come front and center with this info, leads to more distrust in the government.

Instead, we hear them making accusation like "it's all marketing ploy by Apple" (as mentioned in the Motion)...
Also "the government subsequently sought Apple's help in it's effort to execute lawfully issued search warrant. Apple refused". Well we are hearing a different story, and that Apple did help initially.

Everything written in the motion may be factual, but it doesn't present a truthful representation of what happened.

More transparency is needed.

.
 
Last edited:
Most likely scenario is that the suspect's measly 5GB of icloud storage was full. Apple upped the icloud storage available to the account on their end then told the FBI to connect to known wi-fi network and plug in the phone. That would have created a new backup had some dumb-ass not changed the Apple ID password.

Once the backup had been created, a new device could have been set up with the Apple ID and password and restored from the new iCloud backup - no passcodes and backdoors required.

I hadn't thought of the backup being full; but I doubt it greatly. My primary phone back up is 3GB. this is his work phone - how many pictures and things will he have on it?

If that is the case, let's hope bean counter Tim is billing them for the increase
 
So is there stuff in the Oct 19 and prior iCloud backups that lead the government to believe there is valuable information on this phone? What if the guy erased all content and settings and stopped using the phone? Would Apple have record of that? This was a Verizon phone. Do they have phone records from this device after the 19th? Unless he was using other means to make phone calls.
 



Shortly after the U.S. Department of Justice filed a motion demanding Apple comply with an order to help it unlock the iPhone 5c of San Bernardino shooter Syed Farook, Apple executives shared key information with several reporters, including BuzzFeed's John Paczkowski, about government missteps that may have led to reduced access to the iPhone in question.

2015-10-01-tim-cook-0019edit_wide-da972704bfb8889652c3befb6c814e3b465055f9-s1600-c85-800x450.jpg

According to Apple, the Apple ID password on the iPhone was changed "less than 24 hours" after being in government hands. Had the password not been altered, Apple believes the backup information the government is asking for could have been accessible to Apple engineers. The FBI has said it has access to weekly iCloud backups leading up to October 19, but not after that date, and it is seeking later information that could be stored on the device.Apple executives said the entire backdoor demand could have potentially been avoided if the Apple ID password not been changed, as connecting to a known Wi-Fi network would have caused the device to start backing up automatically so long as iCloud backups were enabled. Instead, with the information inaccessible, the FBI has requested tools that set what Apple calls a "dangerous precedent." The FBI wants a version of iOS that accepts electronic passcode input and removes passcode features like time limits and data erasure following failures.

Apple says the software would be the equivalent of a master key that could be used to access millions of devices (including Apple's newest iPhones and iPads) and has called the demand an "overreach" with chilling implications. Apple executives today also refuted the DOJ's claim that the company's refusal to comply is a marketing tactic, saying it was done based on "love for the country" and "desire not to see civil liberties tossed aside."

Article Link: Apple Says Government Changed Apple ID Password on Shooter's iPhone, Losing Access to Data
so the FBI screwed up and Apple has to put at risk all its customers data ie bank details Apple Pay ect sounds about right
 
Have you guys ever thought that the FBI provoked this San Bernardino incident with the sole purpose of forcing Apple to make a backdoor for their devices?

Just the way the government provoked the 911 incident.

Bad reputation is building up for the FBI right now.
Have you ever thought maybe Turkey and ISIS were trading oils during that time?
 
I doesn't seem like the government is coming clean and transparent with information.
They make it seem in the intro that Apple is not co-operating to help them with the investigation (see Intro of the Motion to Compel). And then it seems like Apple is painted "bad", while in fact, we are now hearing:
  • Apple was in discussions with them and did try to help the FBI
  • The password Apple ID was changed while in the device was in government hands (FBI blames the health dept)
Regardless, the fact the FBI did not come front and center with this info, leads to more distrust in the government.

.

And, in typical form, now there's a ton of mud slinging at the non-government party. Government agencies do it all the time; I've read horror stories of the IRS doing audits on the wrong people, essentially taking everything they have, and while there's even the paperwork to prove what happened, the door is closed and nothing gets done.

It's the government. I say props to Apple for sticking to their guns on the issue, and the idiots who haven't read all the facts (at least those made public), are just trying to make a spectacle - á la Trump: "Boycott Apple."
 
I hadn't thought of the backup being full; but I doubt it greatly. My primary phone back up is 3GB. this is his work phone - how many pictures and things will he have on it?

If that is the case, let's hope bean counter Tim is billing them for the increase
Everyone I know who's still trying to get by with the 5GB free iCloud storage has experienced the "backup full" issue. Have an iPad and iPhone? You just doubled how much space you're using. Have more than one iCloud backup of your phone saved? Same story. The backups aren't always smart about chipping away at unecessary data and sometimes bloat much larger than they need to be. I've sometimes had to delete backups that were 3GB, then create a new backup that only resulted in 1.2GB. Even then, it doesn't take long to use up 5GB with photos and HD video.

It's the most probable answer to why the backups stopped in October.
 
What if they change the iCloud password back to what it was before they changed it....wouldn't the iCloud backups then resume as if nothing happened (if they are indeed turned on)?
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.