Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Just for context, Apple made $30,000 every 4.13 seconds in Fiscal Year 2017.
[doublepost=1521150945][/doublepost]

That is pretty smart. So 7+ length passcodes don't have the empty dots while you type?
Nope. Just a rectangular box. Dots only appear as you type the code.
 

Attachments

  • C21F5B6A-3716-4040-B666-9008A195D329.png
    C21F5B6A-3716-4040-B666-9008A195D329.png
    2.4 MB · Views: 325
Not saying it’s impossible, but it’s not going to be easy walking away with one of these from a police station. And then hoping they didn’t buy a geofenced version which won’t work outside the police station.

And even if someone gets one, how does that affect the hundreds of millions of iPhone users?

In short, people have nothing to worry about. Security is always cat & mouse with someone like Apple on one side and hackers on the other constantly plugging security holes or looking for new ones. For the rest of us it means we get to use some pretty secure devices.

Yeah I'm not exactly pleased with how secure it is inside the police station either.

Let me paint a picture for those who lack imagination or maybe have never lived in a small town and dealt with small town politics...

Sheriff Joe is a "law and order" kind of guy favored by about half of the voters. However, Sheriff Joe is known to occasionally color outside of the lines to protect the Security of the Community from those Bad Hombres.

I decide to run against Joe as is my right in an effort to provide an alternative candidate. Now Joe doesn't like the fact someone is running against him. Hasn't happened in the last two elections and shouldn't be happening now. Heaven forbid some weenie, liberal gets elected, the Bad Hombres will run the place over.

So, it's Joe's Responsibility to the good People of the Community to have someone steal/borrow my phone and hook it up to that fun new toy he bought with his homeland security money. Joe now has details about my business, my schedule, my family, maybe even some tasteful, but not pornographic, boudoir photos of my significant other. Things that can be used to intimidate and/or harass me.Its the least he can do to protect the Security of the People of the Community.

This is why I stand 100% behind companies like Apple who comply with legal warrants and inquiries to the best of their ability but make every effort to prevent some hack, even an elected one, from getting into peoples private business.

If you truly believe that LEO should have access to peoples devices, you have a Responsibility to do everything you can to move forward legislation that requires companies to install backdoors on their devices and software. Then everyone can stop believing these devices are secure and truly understand they should never put anything on them they don't want to potentially go public.

As long as Apple keeps playing Whack-A-Mole at the best of their ability, they'll have my business. The exploits need to be closed. Expensive black boxes need to be turned into paperweights.
 
The joke flew over your head. It’s ok. We can’t all be the brightest bulbs. lol

It flew over everyones head then. Probably because you forgot to put anything funny in the comment. Which is kinda important if you claim the comment was a 'joke'
 
The exploit is that they bypass the locking function after x tries. It allows them to brute force. This is feasible for 4-6 or perhaps even 7-8 digit numerical passcodes. Above that they need to be very patient for the result.

The remedy is to set a longer passcode, 10-12 digits or more.
 
The 4th is what applies to divulging what you know, ie passcodes, to prevent unreasonable search and seizure. The 5th applies against testifying against ones self.
[doublepost=1521158136][/doublepost]

There are many stupid folks out there, so yes, a subset exists that would do and think that. Of course the smarter and better prepared criminals would use better methods to the extent they have the means and access.


Google "Phone password 5th amendment" for some details. The idea is that the act of providing your password is testifying or providing information about yourself. It also relates to being deprived of your personal property without due process.

https://cyb3rcrim3.blogspot.com/2015/09/the-sec-company-smartphones-and.html
[doublepost=1521163522][/doublepost]
Can this thing remove iCloud lock? If so, one of these + dirt cheap iCloud locked iPhones from eBay/Craigslist = PROFIT
It would provide access to any/all sites that you store the passwords for in your iCloud Keychain, if you do that, including iCloud, your bank, your car's telematics tracking site (for those with fancy cars).
 
  • Like
Reactions: dabotsonline
It's one or the other. If this company only sells to law enforcement then Apple won't be able to get one. It also means criminals won't be able to get one either. If these are easy for regular people (or criminals) to get, then Apple will also be able to get one and it'll be patched.

You can't have your cake and eat it too (worry that everyone and their dog will be cracking open iPhone AND that Apple won't be able to patch it).

You can’t eat your cake and have it too - the Unabomber.
 
It attaches via lightning, and there are only so many vectors that you can use to get in that way. It also looks like it doesn't rewrite the firmware, since the normal iPhone status bar is visible on-screen.

What's fascinating is that it doesn't actually unlock the phone, the end-user does. I wonder if that's a required forensic step.
 
  • Like
Reactions: dabotsonline
If you truly believe that LEO should have access to peoples devices, you have a Responsibility to do everything you can to move forward legislation that requires companies to install backdoors on their devices and software. Then everyone can stop believing these devices are secure and truly understand they should never put anything on them they don't want to potentially go public.

I never once said LEO should have this kind of access. I've also been strongly opposed to the FBI wanting a "back door" into iOS devices or weaker encryption (that they have the master keys to). In fact, this is a million times worse as something like a set of master encryption keys can be stolen and rapidly distributed to numerous people.

These exploits (because they could be rendered useless overnight simply by Apple issuing an iOS update) are far too valuable to the companies that discover them (and the agencies that use them). It's in their interest to use this particular exploit on specific (and likely difficult) cases they are currently investigating ASAP before time runs out. And given the time it takes to crack an iPhone (hours to days) they literally don't have the time to just open up every iPhone they see. Only serious cases will get access to their "magic box" because they have no idea when it will stop working.

My point is that I'm not worried about the police having access to some device a company created to access iPhones. It's not going to harm me, I'm not worried about people/criminals getting access to them, and it's very likely it will only work for a short period of time until Apple plugs whatever exploit it's using. And then someone else tries to come up with another method. Rinse and repeat.
 
Apple has a lot of money. Obscene amounts of money. More money than any of us could imagine spending. They’ll find a way to get their hands on the non-geofenced version and reverse engineer what is going on to fix it.
 
In other words, when our intelligence agencies cry foul about encryption, it's a thin cover for the fact that they can easily get into your phone anyway. They just want to make a lot of noise about it so that people are lulled into a false sense of security, thinking they can keep incriminating evidence on their phones without worrying.
 
Haha, like Apple is going to “do something” about this device, they don’t even “do anything” about their own products & services anymore.

“Good enough” is the new “It just works.”
 
...Apple will not do that for legal and ethical reasons.

This is an assumption that may not be accurate.

Apple could conceivably "find" a device, or "borrow" one, or they could just hire (create) a company whose sole purpose is to acquire one -- by having it done by a third-party, they could have plausible deniability.
[doublepost=1521168500][/doublepost]
No, but it does support rapid wireless charging.


Oh good - so the device is fully charged as it's hacked.... very handy...
 
  • Like
Reactions: dabotsonline
It attaches via lightning, and there are only so many vectors that you can use to get in that way. It also looks like it doesn't rewrite the firmware, since the normal iPhone status bar is visible on-screen.

What's fascinating is that it doesn't actually unlock the phone, the end-user does. I wonder if that's a required forensic step.

This device did the same for iOS 11 beta versions : https://appleinsider.com/articles/1...-screen-passcodes-but-could-take-days-to-work

I wonder if there are still holes in the DFU/restore/update paths that are being exploited?
 
Time to remind everyone posting about Apple protecting our privacy at any cost one word CHINA. Just look at how they followed the law there. Apple never said they weren't cooperating with law enforcement or even blocking their efforts anywhere in the world, quite the opposite. Any cloud data is fair game as an example. In USA their are some pretty severe penalties for disclosing certain portions of anti-terrorism laws that cover far more than just tech sector. All countries have similar laws, so we don't know what we don't know. Deal with that or move to Luddite status.

In the case of China, Apple was in a position where not only the customer base, but their manufacturing facilities were at risk if the didn't comply. They apparently negotiated quite vigorously but eventually had to back down. Consider that Apple was in a position where the Chinese government could be the bully by increasing taxes, increasing inspections (thus exposing trade secrets), and generally being intrusive and disruptive. The lesser evil (from a business perspective -- I won't comment on the moral aspect) was to move the data to China.

It should also be pointed out that many jurisdictions are looking into requiring data to be stored locally rather than in some other country, ostensibly for security of their citizens, but more likely to simplify access for the relevant intelligence agencies.
[doublepost=1521169688][/doublepost]
...

Furthermore, I say Apple should shift strategy of manufacturing to India - a peaceful country that would use the inflow of our money for good. And that could be what helps Apple sell its future products in India and make it the powerhouse rather than China!

If Americans only knew how bad the inflow of money into China is, and what the government uses it for, it seems like we could just stop allowing business and cash to flow there. Free trade with India and governments that mean no harm to USA.

I am South Asian, but I wouldn't want this to occur.

India is a country mired in red tape and bureaucracy. The South Asian workforce has a different approach to efficiency and consistency as compared to the Oriental workforce. As a shareholder, I would also be concerned regarding increased costs of manufacturing and decreased productivity.

And given recent interactions, I'm not sure that India holds such a benign view of the US.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.