Law Firms Consider 'Error 53' Lawsuits Against Apple as Some Stores Authorized for Repairs

[oscarinkc]

....
...So yeah, it is totally technically possible to rip the TouchID sensor out of your phone and still be able to unlock it (assuming you have the passcode). TouchID is not essential to unlock the device; it is only ever a shortcut for entering the passwords you have already recently entered in to the phone.

Law firms? I just did all of your investigation work for you. Feel free to cut me a cheque.

Nice long explanation. I missed the part where if I used a "third party" home button without TouchID, I would conceivably compromise security even though I needed to enter in a passcode in order to use the phone in the first place after power-up.

I will repeat what another poster said, the passcode is the primary means of getting in to the phone and is required just to enable the TouchID/A7 processor "handshake" (as I understand it). When enabled, the TouchID and fingerprint scanner is just an alternative but convenient way to engage in sensitive transactions without re-entering the passcode; An option many iPhone users do not even use. So why "brick" the phone in the name of security when a "passcode" is always required at power-up just to use the device ??????

 

[DevNull0]

You're kind of going a little too far in the other direction though. Some laws especially regarding tech are definitely a little outdated and could use some amending.

I do agree with you 100%. But that has nothing to do with the age of the law automatically meaning they're not relevant today. Time goes on and things do change and need to be kept up to date.

What I'm objecting to are these idiots who think just because it's old, it's garbage to be thrown aside.

 

[springsup]

Nice long explanation. I missed the part where if I used a "third party" home button without TouchID, I would conceivably compromise security even though I needed to enter in a passcode in order to use the phone in the first place after power-up.

Well, maybe that 3rd-party home button contains a bugging device which is capturing your fingerprint data. That way, somebody can steal your phone while it's powered on and instruct the tampered sensor to replay the last fingerprint.

It's a pretty contrived example, and I'm not sure if it would actually work (Apple doesn't go in to such specifics about the hardware handshaking process AFAIK), but in the case of government surveillance, they have been known to do some pretty extreme things. Wasn't it the FBI who was intercepting laptops and smartphones in the mail and installing bugging devices and resealing them?

Now, you may be thinking "oh well, you'd need massive resources, like the FBI do, to pull this kind of thing off. They should just allow it". The thing is, there are state organisations in the world who are held to much lower standards of accountability than the FBI. What about if this was Russia or China bugging the phones of political activists or human-rights campaigners?

The phone should probably verify the secure components on every boot. There can be many months without an iOS update, and even then not everybody installs them right away. In that time, the user can restore a previous (non-bugged) phone backup to the tampered phone, log in to all of their email accounts, send iMessages (otherwise inaccessible to law enforcement), and whatever else.

If the components don't verify, it should disable TouchID and fall back to passcode-only authentication. I think everybody agrees with that. It doesn't compromise security at all, since the passcode would always have been an option, even if the TouchID sensor was there and valid.

 

[VresiBerba]

The hardware doesn't work you can't use Touch ID. Therefore to repeat the hardware doesn't work.

Your Macbook doesn't work without an installed operating system either, that doesn't mean the hardware in your Macbook is faulty.

The pairing between motherboard and the TouchID sensor is done by software and so is the bricking of the phone, therefore it's not a hardware issue, it's a software issue.
[doublepost=1455174438][/doublepost]

The flip-side of this equation is something many people here seem to ignore. If Apple were more 'relaxed' about this issue, the first time there was a real or perceived breach of the fingerprint data, Apple would be at risk of hundreds of millions or even billions in lost revenue.

You mean like basically the entire year between the launch of iPhone 6 and the release of iOS9? And this is touted as the most secure phone since handlebar moustaches was invented? And if Apple would be at risk of hundreds of millions or even billions in lost revenue, how come the potentially malicious homebutton/sensor can remain in the phone unchecked for months since it's only checked at system updates? And since those updates are not mandatory and can basically remain there for all eternity, it strikes you as a proactive security approach worth defending?

You know what, if I was an iPhone user, I would be seriously pissed off knowing how the security is being handled.

 

[VresiBerba]

What you call "a software update", we in the computer industry call "closing a hole".

Apparently that industry doesn't include Apple since they have not said that Error 53 is closing any hole whatsoever.

 

[H2SO4]

Well, maybe that 3rd-party home button contains a bugging device which is capturing your fingerprint data. That way, somebody can steal your phone while it's powered on and instruct the tampered sensor to replay the last fingerprint.

Maybe that Thunderbolt device you just bought has a rootkit in it too? Much more likely methinks.

 

[Gurutech]

Well. I would not have any problem Apple bricking my phone upon update if Apple, with more than once, warns ahead for possible security risk and repeatedly warns before each iOS update, with an option to disable update.

However, in this case, Apple forcefully did this without any warning.

And I believe I have every right to do 3rd party repair after warranty expires in order to continue using my phone which I paid for and I own.

I keep wondering how a company which is famous for 1984 Superball Ad that depicted revolution against big brother has fallen to this state?

 

[springsup]

Maybe that Thunderbolt device you just bought has a rootkit in it too? Much more likely methinks.

Can thunderbolt devices even contain rootkits? That would be news to me. USB devices can because of their shockingly insecure memory model.

EDIT: ahh yes they can. Bloody Option ROMs. The 80s come back to bite.

Regardless, iPhones don't have thunderbolt (they don't have PCIe or the other vulnerable components because it's a SoC), and that still wouldn't unlock an encrypted phone thanks to the Secure Element. It wouldn't be able to signal to the SE to give it the decryption keys. That is not a software-controllable thing.

There is probably some pre-emptive security behind this policy, too: they want to ensure nobody comes up with a clever way to spoof a TouchID sensor providing a fingerprint, however they do it.

Security is all about covering your bases, especially the unlikely ones. Those neglected areas are where people find loopholes that make the whole system redundant.

 

[SMIDG3T]

Wow, people will do anything for money nowadays, huh?

This is a SECURITY feature implemented by Apple.

 

[oscarinkc]

deleted

Well, maybe that 3rd-party home button contains a bugging device which is capturing your fingerprint data. That way, somebody can steal your phone while it's powered on and instruct the tampered sensor to replay the last fingerprint.

It's a pretty contrived example, and I'm not sure if it would actually work (Apple doesn't go in to such specifics about the hardware handshaking process AFAIK), but in the case of government surveillance, they have been known to do some pretty extreme things. Wasn't it the FBI who was intercepting laptops and smartphones in the mail and installing bugging devices and resealing them?

Now, you may be thinking "oh well, you'd need massive resources, like the FBI do, to pull this kind of thing off. They should just allow it". The thing is, there are state organisations in the world who are held to much lower standards of accountability than the FBI. What about if this was Russia or China bugging the phones of political activists or human-rights campaigners?

The phone should probably verify the secure components on every boot. There can be many months without an iOS update, and even then not everybody installs them right away. In that time, the user can restore a previous (non-bugged) phone backup to the tampered phone, log in to all of their email accounts, send iMessages (otherwise inaccessible to law enforcement), and whatever else.

If the components don't verify, it should disable TouchID and fall back to passcode-only authentication. I think everybody agrees with that. It doesn't compromise security at all, since the passcode would always have been an option, even if the TouchID sensor was there and valid.

Okay, so I have to have a fake button which can fake a legitimate TouchID paired to a specific phone plus the phone has to be already power-on, post-legitimate passcode entry in order to break the TOuchID /pass code security ? Under what scenarios could this "possibility" (??) occur ?

With a third party button or even OEM button, not paired with the original phone is used, the TouchID no longer works but the rest of the phone could still be operational (and is until iOS 9 update); the passcode entry is ALWAYs required (and represents the primary method of entry into the phone anyway) at power-up so I still fail to see a legitimate security concern.

If Apple is that paranoid of (imaginary?) security on their TouchId, they had an obligation to warn their customers that the iOS update could trash a phone with compromised home button/touchID, warn them about the possibility of a remote hack on touchID if they do not update, and ask them if they still wanted to continue.
Or better yet, offer them a different iOS update path which does not "brick" the phone and completely eliminates the Touch ID/Apple Pay function (does not an illegitimate pairing already do this???)

This still looks like an Apple attempt to monopolize a multi-billion dollar iPhone repair business. There are "consumer-friendly" laws which mandate that OEM manufacturers allow for the possibility of third party repairs. Apple likely has broken these law and there is a good chance they will be forced to change their iPhone design (software and/or hardware ?) to again support third party repairs associated with home buttons.

 

[samcraig]

deleted


Okay, so I have to have a fake button which can fake a legitimate TouchID paired to a specific phone plus the phone has to be already power-on, post-legitimate passcode entry in order to break the TOuchID /pass code security ? Under what scenarios could this "possibility" (??) occur ?

With a third party button or even OEM button, not paired with the original phone is used, the TouchID no longer works but the rest of the phone could still be operational (and is until iOS 9 update); the passcode entry is ALWAYs required (and represents the primary method of entry into the phone anyway) at power-up so I still fail to see a legitimate security concern.

If Apple is that paranoid of (imaginary?) security on their TouchId, they had an obligation to warn their customers that the iOS update could trash a phone with compromised home button/touchID, warn them about the possibility of a remote hack on touchID if they do not update, and ask them if they still wanted to continue.
Or better yet, offer them a different iOS update path which does not "brick" the phone and completely eliminates the Touch ID/Apple Pay function (does not an illegitimate pairing already do this???)

This still looks like an Apple attempt to monopolize a multi-billion dollar iPhone repair business. There are "consumer-friendly" laws which mandate that OEM manufacturers allow for the possibility of third party repairs. Apple likely has broken these law and there is a good chance they will be forced to change their iPhone design (software and/or hardware ?) to again support third party repairs associated with home buttons.

I wonder if Apple will go the MFi certified route like they did for lightening cables to get around the law. Remember that mess?

 

[H2SO4]

Can thunderbolt devices even contain rootkits? That would be news to me. USB devices can because of their shockingly insecure memory model.

EDIT: ahh yes they can. Bloody Option ROMs. The 80s come back to bite.

Regardless, iPhones don't have thunderbolt (they don't have PCIe or the other vulnerable components because it's a SoC), and that still wouldn't unlock an encrypted phone thanks to the Secure Element. It wouldn't be able to signal to the SE to give it the decryption keys. That is not a software-controllable thing.

There is probably some pre-emptive security behind this policy, too: they want to ensure nobody comes up with a clever way to spoof a TouchID sensor providing a fingerprint, however they do it.

Security is all about covering your bases, especially the unlikely ones. Those neglected areas are where people find loopholes that make the whole system redundant.

Way to split hairs. My point is that you can store even a malicious OS on a piece of hardware. It sits dormant until it recieves power, (you plugging it into your Mac), then it becomes a keylogger. At best.

 

[997440]

Sure. I don't even know that we disagree on these point in general. It would absolutely be nice for Apple to support a break in hardware security with a graceful fallback solution that still maintained data security.

I think our disagreement is in what is Apple's responsibility in causing the "bricking" of the phones and thus what should Apple do about it. At the least, I think they hold the lion's share of contributory negligence. Their corrective actions should be swift and the affected should be recompensed accordingly.

But to argue that it's simple or that they are required to do it by a warranty law is where I think people have gone overboard.

I don't think you meant me here because I mentioned neither. I think they're required to recompense the affected because it's right to do so. Irrespective of any particular law, rational or not, a company's ultimate judge is its reputation.

 

[dk001]

Nice long explanation. I missed the part where if I used a "third party" home button without TouchID, I would conceivably compromise security even though I needed to enter in a passcode in order to use the phone in the first place after power-up.

I will repeat what another poster said, the passcode is the primary means of getting in to the phone and is required just to enable the TouchID/A7 processor "handshake" (as I understand it). When enabled, the TouchID and fingerprint scanner is just an alternative but convenient way to engage in sensitive transactions without re-entering the passcode; An option many iPhone users do not even use. So why "brick" the phone in the name of security when a "passcode" is always required at power-up just to use the device ??????

sigh.... however if the repair shop used an original OEM (Apple) Home button and sensor salvaged from a busted iPhone - let's say same make/model, you will apparently get the same Error 53.

It's not just 3rd party parts.
[doublepost=1455211165][/doublepost]

I do agree with you 100%. But that has nothing to do with the age of the law automatically meaning they're not relevant today. Time goes on and things do change and need to be kept up to date.

What I'm objecting to are these idiots who think just because it's old, it's garbage to be thrown aside.

Old means it does need to be challenged in a court of law and applicability determined.
Or have the local legislative process update it
[doublepost=1455211526][/doublepost]

deleted


Okay, so I have to have a fake button which can fake a legitimate TouchID paired to a specific phone plus the phone has to be already power-on, post-legitimate passcode entry in order to break the TOuchID /pass code security ? Under what scenarios could this "possibility" (??) occur ?

With a third party button or even OEM button, not paired with the original phone is used, the TouchID no longer works but the rest of the phone could still be operational (and is until iOS 9 update); the passcode entry is ALWAYs required (and represents the primary method of entry into the phone anyway) at power-up so I still fail to see a legitimate security concern.

If Apple is that paranoid of (imaginary?) security on their TouchId, they had an obligation to warn their customers that the iOS update could trash a phone with compromised home button/touchID, warn them about the possibility of a remote hack on touchID if they do not update, and ask them if they still wanted to continue.
Or better yet, offer them a different iOS update path which does not "brick" the phone and completely eliminates the Touch ID/Apple Pay function (does not an illegitimate pairing already do this???)

This still looks like an Apple attempt to monopolize a multi-billion dollar iPhone repair business. There are "consumer-friendly" laws which mandate that OEM manufacturers allow for the possibility of third party repairs. Apple likely has broken these law and there is a good chance they will be forced to change their iPhone design (software and/or hardware ?) to again support third party repairs associated with home buttons.

Yep that scenario is oh so probable. Considering another non-sensor part, a salvage or new sensor (not paired), damage that has never been fixed, damage to the sensor cable that the user doesn't know about and the phone still appears to work correctly...

Stop focusing on only one aspect or potential trigger.
Still, why does this require bricking a device?

 

[jkaz]

Wow, people will do anything for money nowadays, huh?

This is a SECURITY feature implemented by Apple.

Yes, this security feature irreversibly bricks the phone which has the bonus side effect for apple of forcing people to give apple more money

edit: So yes, you are correct- Apple will do anything for money nowadays.

Anyone that has had their phone bricked by error 53 would be overjoyed if they had the option to undo the software update that bricked their phone.

 

[I7guy]

Yes, this security feature irreversibly bricks the phone which has the bonus side effect for apple of forcing people to give apple more money

edit: So yes, you are correct- Apple will do anything for money nowadays.

Anyone that has had their phone bricked by error 53 would be overjoyed if they had the option to undo the software update that bricked their phone.

There is the option not to give Apple money.

 

[H2SO4]

There is the option not to give Apple money.

Maybe you got the phone free and then it was bricked by Tim later?

 

[DevNull0]

Old means it does need to be challenged in a court of law and applicability determined.
Or have the local legislative process update it

Not even close to being right. When is the last time the 801 year old law granting a right to a trial in public by a jury of one's peers been challenged in a court of law or the legislative process updated?

 

[dk001]

Not even close to being right. When is the last time the 801 year old law granting a right to a trial in public by a jury of one's peers been challenged in a court of law or the legislative process updated?

We could nit pick back and forth all decade on yes vs. no. And sorry, but the trial by jury 801 year old law isn't the version we have in the US.
I probably should have limited my comment to US law.

 

[I7guy]

Maybe you got the phone free and then it was bricked by Tim later?

Then you could buy a not-Apple phone who Choi designed.

 

[LovingTeddy]

Wow, people will do anything for money nowadays, huh?

This is a SECURITY feature implemented by Apple.

Yeah, SECURITY feature kicks in 9 months later and kicks in via software update.

So yeah, such security feature kinda not work.

 

[Keirasplace]

Well. I would not have any problem Apple bricking my phone upon update if Apple, with more than once, warns ahead for possible security risk and repeatedly warns before each iOS update, with an option to disable update.

However, in this case, Apple forcefully did this without any warning.

And I believe I have every right to do 3rd party repair after warranty expires in order to continue using my phone which I paid for and I own.

I keep wondering how a company which is famous for 1984 Superball Ad that depicted revolution against big brother has fallen to this state?

Its the people who sold you the part who should warned you bud. Got that. Not Apple.
This was known for 1 year, so the people sold you a POS part knowing it would do this are the one responsible, not Apple.

As for right this, right that, sue and see were it goes.

 

[C DM]

Yeah, SECURITY feature kicks in 9 months later and kicks in via software update.

So yeah, such security feature kinda not work.

Why? A security feature could have been added or improved or modified in an update and thus work differently than it did before.

 

[jkaz]

There is the option not to give Apple money.

you also would be leaving behind many of the dollars spent on apps and other media through iTunes. Not to mention all of the effort spent building your iLifestyle that have been incorporated into your phone and perhaps iPad and Mac.


None of this changes the fact that error 53 bricked peoples phones without warning and without a simple and cheap way to fix it

 

[SuperMarioKart]

We've gone almost a full page without a car analogy. Let's say you want to get somewhere, so you need your car and your phone with Maps, but your phone is broken because you just did an update with a 2nd-hand Touch ID. Good news is you found the original Touch ID, put it back in the phone, do a restore, and get your Maps working again. You get into your car to find out someone used an after-market steering wheel when you had your windshield replaced. So for whatever reason, the car doesn't even want to turn on(you initially think it's out of gas). You run to the gas station to buy a container with a couple gallons of gas. Car still doesn't turn on. Fortunately, you have pieces of the old windshield on your dashboard, but it turns out gluing those back together does nothing. Then you see your boring old steering wheel on the floor, screw it down quickly, and continue to your destination. Turns out you used up all your data, so you just go back home and cry yourself to sleep.