Apple Used DMCA Takedown to Temporarily Remove Tweet With iPhone Encryption Key

[davidg4781]

Far more than you would imagine. You can turbocharge your iPhone including quick animations, faster opening of apps, and better performance on the home screen. My personal favorite is ability to downgrade apps, no YouTube ads, changing the app splash screen to black, no silly swipe to unlock, and battery percent instead of an icon. And up until iOS13 it was the only way to get dark mode, unobtrusive volume hud, and better control center functionality. You can thank the jailbreak scene for the improvements Apple makes painfully slowly via each yearly iOS iteration. The truth is a lot of the innovation Apple claims as their own happens by developers working behind the scenes on a jailbreak.

Thanks. I can see how some would want that, but it’s definitely not for everyone. Maybe because I’m older? Maybe I don’t want to fiddle with all that?

Don’t get me wrong. There was a time I built my own PCs, had custom installs of Windows XP, and apps for almost every tweak on my PC and Trēo 650. Now, I leave iPhone with most of its defaults in place.

 

[Analog Kid]

Honestly, you don't know how security works.

Good security has layered defences. For example: First layer: You keep it a secret that there is a key. Second layer: You make it hard to find the key. Third layer: You make it hard to extract the key. Fourth layer (non technical this time): You go after anyone who extracts the key and tries to publish it. There will be several layers after that.

You are basically telling Apple to throw away layer four of their defences. This makes whatever their system does less secure.


Layered defences. One layer of defences has come down. It's like you stored important information in a safe at your bank. The bad guys have found out that you have important information that you want to keep secret, and they just found out the address of the company that built the safe that the bank uses to store your secrets. Yes, they are one step closer to finding your secrets. But now they have to break into that company, find their plans for building the safe, and try to find out if there is anything in the plans that allows them to break into the safe. If they find something that allows them to open the safe (and that's a big "if"), then they still have to break into the bank.

Not that I don't love a good bank robber analogy, but this doesn't give me a lot of confidence in the security of today's state. I don't know how much you know about the actually security structure of the Secure Enclave, but If I take your two comments together it sounds like they've already blown through the "know there's a key", "find the key", "extract the key" and "survive Apple's legal onslaught" layers.

Do you happen to know how vulnerable the SE is right now? Someone mentioned changing the keys with an update, but if the enclave is hacked before the key change can they prevent the update?

I'm hoping the worst case scenario is that the next update just wipes the Secure Enclave completely and forces us to re-register our biometrics. Best case, of course, is that this is all nothing.

Nevermind, this seems to explain it:

I am losing brain cells at reading these replies.

That key is to decrypt the SEP firmware and in no way makes actually compromising user data easier.

So many conspiracies and people who don’t know Siguza commenting on it, but you should actually take the time to educate yourself on the topic before making yourself look stupidly uninformed on the internet.

@Jamie Bishop, if you have a link that could make us less stupidly uninformed, it would be appreciated. Just knowing it's a key to decrypt the firmware is enough to know it's not a huge risk itself-- assuming the firmware is well written.

 

[Kabeyun]

In that case.... no- that is incorrect.
It is my understanding that since the 5S came out, there have still been myriad jailbreaks without hacking the secure enclave; which is NOT a necessary step in jailbreaking.

Good, and exactly. People in this thread are discussing hacking the secure enclave as if it were jailbreaking, which it isn’t.

 

[dominiongamma]

I will keep my iPad jailbroken (with checkra1n) no matter what kind of crap Apple tries to do against it. Jailbreaking = freedom to do what i want with my device.

Isn’t that called an android ?

 

[Jamie Bishop]

Yojr

I agree. That key should not be published and should be removed by all means. The user who posted it should suffer quite a bit too.

There is no benefit (except negative) to reverse engineering the Secure Enclave. He just made every iPhone vulnerable with this ****. It's not funny, cool or edgy. It's ****ing stupid.

Real or not.

you’re spreading fake news — please actually lookup what the key is for. it’s a decryption key for the firmware of one specific beta of iOS 13. It doesn’t allow for decrypting of data, only decrypting of the firmware.

 

[57004]

That's not necessarily true. Apple could ask fifty developers to each write a little (copyrightable) poem, then create a key based on these poems. That could quite easily be protected by copyright. Apple could get a copyright registration for it. And for a DMCA takedown notice: Obviously the person making the post is free to take Apple to court about it.

In fact, that's exactly what they did in a previous case. That poem wasn't just a warning to pirates, it was actually used to authenticate the GUI module when running on the open-source darwin kernel. By copyrighting it they could protect it. Not that it actually deterred the hackintosh community however...

 

[Freida]

I agree with you but Apple has a legitimate reason for the annual release. Every time they release a new flagship iPhone (i.e. every September) they need a new iOS to take advantage of the new hardware as last year's iOS would not know what to do with the 3rd camera on iPhone 11. The "simple" solution would be to release the new hardware when the new OS is ready but that creates significant financial challenges as Apple wants to have the new phone available in time to catch people who just paid off their 2 year old phone they have been financing for the past 24 months.

Yeah, I know but I would assume that instead of focusing on new iOS they could focus on additions. Ie. if the new hardware needs new software for the camera then add that first. Then if you have time focus on other stuff. Have new iOS out less often so its worth it whist you also don't overload your coders so in the end the result is more refined overall. I'm sure the cam features could be easily added to .1 release especially when everything is done inhouse and you know what your pipeline looks like so with good planning your iOS could be future proof ready
[automerge]1576170103[/automerge]
I'm not saying that. I'm just saying that Apple should be more focused on the first 3 layers first. And yeah, I get your point too.

Honestly, you don't know how security works.

Good security has layered defences. For example: First layer: You keep it a secret that there is a key. Second layer: You make it hard to find the key. Third layer: You make it hard to extract the key. Fourth layer (non technical this time): You go after anyone who extracts the key and tries to publish it. There will be several layers after that.

You are basically telling Apple to throw away layer four of their defences. This makes whatever their system does less secure.

 

[Analog Kid]

I agree. That key should not be published and should be removed by all means. The user who posted it should suffer quite a bit too.

There is no benefit (except negative) to reverse engineering the Secure Enclave. He just made every iPhone vulnerable with this ****. It's not funny, cool or edgy. It's ****ing stupid.

Real or not.

You do realize that the best defense against bad guys hacking the Secure Enclave is good guys hacking the Secure Enclave first, right? If this didn't hit the front page of MR, it would still be happening-- you just wouldn't know about it. Better to keep Apple's feet to the fire, otherwise complacency leads to lax security.

 

[bsolar]

In fact, that's exactly what they did in a previous case. That poem wasn't just a warning to pirates, it was actually used to authenticate the GUI module when running on the open-source darwin kernel. By copyrighting it they could protect it. Not that it actually deterred the hackintosh community however...

Uhm, AFAIK the poem was just a warning message inside the kernel extension doing the validation, but the validation itself was performed by using keys contained in the SMC. I could very well be wrong though.

PS edit: I actually checked this out and although the poem mentioned is not itself used as key, the actual key is indeed a copyrighted 64 byte string stored in the SCM.

Anyway, even if they used the poem as actual key, it being copyrighted would not mean Apple would be able to completely censor it from the internet since it would still be possible to publish it under fair use in many circumstances.

It would actually make a DMCA takedown notice appropriate, but this would not solve much for Apple, since it takes only a counter-notice to get the content back online unless Apple files lawsuit for copyright infringement within 14 days... which can be done only if the copyrighted work is registered. Obviously registering the copyright would defeat the whole idea of having it as secret key...
[automerge]1576171746[/automerge]

There is no benefit (except negative) to reverse engineering the Secure Enclave. He just made every iPhone vulnerable with this ****. It's not funny, cool or edgy. It's ****ing stupid.

It's very naive to believe he was the only one in the World who was able to compromise the key. You should assume that if he managed to compromised it, others could have managed to do just the same.

What would you rather have, the false sense of security that the key is still a secret only Apple knows when it's not?

 

[MarioPhone96]

Yes, there's a much bigger picture involved.

1. Consumer buys iPad.
2. Consumer jailbreaks/hacks iPad because it's "their" device, right?
3. iPad stops working properly.
4. Consumer takes iPad, still in the warranty period, to Apple for support.
5. Apple has to spend money supporting that hacked iPad, at no fault of their own.

Apple has a responsibility to all of its customers to keep their support services affordable. Anyone that tries to circumvent that for their own personal benefits (jailbreaking, hacking) only raises the costs for everyone, and that's not right.

Today's macOS and iOS is already super capable without going down the road of jailbreaking.

I agree with you that there isn’t really a need to jailbreak iOS anymore. And Apple should focus on security 100%. iOS has come a long way. I don’t agree with that list you wrote, though. I’ll just respond to your points.

1. Ok, someone buys an iPad.
2. Well yeah, under US law, this person can jailbreak their iPad because it’s their device. Nothing really wrong with that, right?
3. It would only stop working if that person installed malware from an untrusted source (from Cydia or anywhere else hosting tweaks and stuff) or just installed too many incompatible tweaks to cause an error. You have to do some research here. Yes, jailbreaks can cause errors. Most of the time simple troubleshooting, an unjailbreak, or even an iTunes restore fixes that.
   
   
4. They might do that, except Apple would immediately turn away this person because, yes, under their EULA, you can’t modify the software and receive support from them. It’s one or the other. And again, a simple iTunes restore or unjailbreak would remove the modified software and you’d be totally fine! I’ve done this lots of times to get my iPhone serviced.
5. Well, maybe, but I think jailbreaking doesn’t necessarily cost Apple anything because they won’t service jailbroken devices. So I think the loss is for the consumer, technically.

I’m just speaking from experience and observation here. I’m not trying to dismiss your post, just think it’s a bit misinformed.

 

[Wildkraut]

Yes, that is what it used to mean. But now it basically means:
Jailbreaking = I don't give a crap about my personal security

Sorry, but this is a very close minded point of view.

Of course a locking down a device adds an additional security layer.
But it doesn't mean that Jailbreaking is about giving up personal security and privacy.

Jailbreaking is e.g. about opening the boot process to become like the other few billion devices(e.g Windows Clients & Servers, Unix/Linux Clients Servers, etc.) out there, and they all aren't locked like iOS & Co. I would say that all the companies using these "non-locked" devices, aren't more exposed to security and privacy threats than a jailbroken iOS or macOS device.

Instead you should worry about, if the whole privacy and security of an operating system relies on device locking. Well, in that case I say, the Apple engineers didn't do their homework.

But hey trading off freedom with privacy and security myth and excuses, dude their marketing strategy clearly worked on you.

Greets...

 

[wigby]

We both know that Apple is about image first. Its evident everytime Tim Cook has an interview but then when you cross check those stories where developer or hacker reports an issue and Apple takes its sweet time then that kinda paints different story, don't you think?
I love Apple, don't get me wrong but I am not happy with some of their choices (which is fine).
To me, privacy is important too so if it takes a controversial step for Apple to improve then so be it. These days the most common action is that everyone sues everyone but very few people focus on what really matters. Apple is building an image so they should also take actions that back their "mentality".
Example: look how long Apple spends on Memoji or Slofies vs how much time they spend on privacy etc.
When they present something, the focus on privacy is secondary but then they put a billboard talking how it all stays on your device.
It should be the other way around. Memoji, Slofies etc. should get the little time privacy has each keynote and privacy should get the spotlight.
Yes, I understand that the society these days is so obsessed about self gratification, instant attention etc. that unfortunately those stupid Memoji, selfies, Slofies etc. simply is what people really want. Heck, even my mum started doing this nonsense and she is almost retired.
So yeah, let the hackers expose as much as possible because thanks to those guys we will most likely get better and more secure systems. Anything that touches Apple's image is usually fixed fairly quickly. Apple is obsessed about the right image so its the only way how to get stuff done fast

For years, Apple was the only tech company talking about privacy and security at every event just like they were the only company talking about environmental issues too. They started that trend. You can take the cynical view of that and spin it that they only care about their image but what does that say about every other company that followed their lead? Also remember that reacting to security breaches and mistakes cannot and usually should not be fast. Knee jerk fixes and reactions to security issues tends to create more problems. It's much safer to quickly address a Memoji bug because there's no downside. I agree that Apple is very concerned with their image and should be and yes, they've pivoted much closer towards security and privacy ever since they've been criticized for falling behind in AI. Marketing plays a role in every decision they make just like it does for every company. Just because Apple is the best at it does not mean they are the worst at execution or delivery great products with great security too.

 

[revmacian]

But you’re not really buying a device are you? You’re essentially buying a software license.

Yeah, many people don't realize that iOS running on their device does not belong to them. The TOS that you need to agree/decline specifically states that ownership of iOS always remains with Apple. What consumers actually own is a license to use the iOS system IAW Apple guidelines. Some people think they own the hardware and the software, this simply isn't the case.

 

[Somian]

This is the case According to corporate lawyers and lobbyists. The question is how legal it is to sell something to somebody and the tell them that they don’t actually own it and don’t have the right to perform maintenance or circumvent planned obsolescence. Just because lawyers put in these terms a lot of things they would like (stuff like „we reserve the right to modify these terms at any time without notice“) it doesn’t make it enforceable.

Also, security through obscurity does not work. Each device’s actual data should be encrypted with a user key. Unlocking the firmware enables security researchers to know what’s going on. If it’s properly implemented, Apple has nothing to worry about.

 

[msp3]

“Security researchers” my ass. Actual researchers win research grants and advance the frontiers of scientific knowledge.

Let’s call software thieves, criminals, hacks, and people who aid and abet police states around the world what they are: scum.

 

[revmacian]

This is the case According to corporate lawyers and lobbyists. The question is how legal it is to sell something to somebody and the tell them that they don’t actually own it and don’t have the right to perform maintenance or circumvent planned obsolescence. Just because lawyers put in these terms a lot of things they would like (stuff like „we reserve the right to modify these terms at any time without notice“) it doesn’t make it enforceable.

It's called respect for other people's property. iOS is owned by Apple. Apple specifies how I can use iOS. If I'm not happy with their guidelines, then I shouldn't use their property.

It sounds like you're trying to find a loophole because you don't want to give up what you cherish. You're letting a device control your behavior and character, that shouldn't be allowed to happen. Just because you can get away with it doesn't make it right.

 

[I7guy]

...Also, security through obscurity does not work.

That’s what they say, but it seems to have been working very well.

Each device’s actual data should be encrypted with a user key. Unlocking the firmware enables security researchers to know what’s going on. If it’s properly implemented, Apple has nothing to worry about.

Corporate espionage has enabled bits and pieces of the underlying tech to surface. It’s not about Apple having nothing to worry about. It’s about the bad actors (whether they be bad guys or governments) getting hold of knowledge.

 

[Tech198]

It was a fake person who did it was not Apple:
https://torrentfreak.com/fake-dmca-...e-jailbreaks-on-reddit-was-fraudulent-191213/

 

[PickUrPoison]

Look at all these Boomers in the comments wanting to be limited by Apple. These people are so uninformed it's unbelievable and they still believe you lose warranty even when the device is out of warranty period lol

Lol why would you think it’s Boomers that want to be limited? Ageist much?

 

[MacOSExustio]

see nothing wrong with hacking my own device to customize what i do on it. Also, jailbreaking ends up helping apple as they take ideas from jailbreaks

Exactly. Just why Apple should release an official jailbreak API - tethered but will survive a restart, that has security (require it connected to the user's computer for 24 hours continuously). Same with Apple Watch jailbreaking (that's possible with S3, is it still possible (JelbrekTime,

, https://github.com/tihmstar/jelbrekTime).

I don't know if this can be run without an i*Phone* (as opposed to iPod), so I may need a jail-breakable iPhone as well.

Who can we write to at the EU for their massive-company-interfering-bureaucratic-machinery to do something useful and pass a "Right To Use Your Own Technology" bill?