Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

techguy15

Suspended
Original poster
May 24, 2015
101
99
So I understand that the FBI was able to get into that one shooters 5C running on iOS 9. Now that iOS 10 is out do you think they'd be able to crack into one now? Did Apple add anything that would make it more difficult this time around?
 

SSAJ

macrumors 6502
Aug 30, 2016
369
78
So I understand that the FBI was able to get into that one shooters 5C running on iOS 9. Now that iOS 10 is out do you think they'd be able to crack into one now? Did Apple add anything that would make it more difficult this time around?
Yup they are making it difficult and difficult to break in on anyone's phone
 

C DM

macrumors Sandy Bridge
Oct 17, 2011
51,392
19,460
So I understand that the FBI was able to get into that one shooters 5C running on iOS 9. Now that iOS 10 is out do you think they'd be able to crack into one now? Did Apple add anything that would make it more difficult this time around?
5c is a 32-bit device that doesn't support TouchID, which I believe played a role in it all, aside from iOS itself.
 

DaIfoneboss

macrumors regular
Oct 6, 2011
148
121
5c is a 32-bit device that doesn't support TouchID, which I believe played a role in it all, aside from iOS itself.
This. 64 bit iOS device on iOS 10.2 is much much more secure and harder to crack then the 5C was on iOS 9 with no Touch ID

Ios 10 itself got a big boost in security
 
  • Like
Reactions: Agit21

KALLT

macrumors 603
Sep 23, 2008
5,369
3,393
32-bit-ness had nothing to do with it. Neither had Touch ID. What the FBI eventually used was a NAND mirroring technique that allowed them to clone the disk and trick the device into allowing as many password tries as they wanted. A Cambridge researcher has confirmed that this works on any later device as well, up to iPhone 6S (source).

The only real protection against this is a decent password. If you are using a 4-digit passcode, then you are not secure. You should be using a password instead. You should also not use iCloud, particularly not iCloud Backup and iCloud Keychain.

Ios 10 itself got a big boost in security

How do you know? Apple has not released an updated security guide yet.
 
  • Like
Reactions: na1577 and Agit21

DaIfoneboss

macrumors regular
Oct 6, 2011
148
121
32-bit-ness had nothing to do with it. Neither had Touch ID. What the FBI eventually used was a NAND mirroring technique that allowed them to clone the disk and trick the device into allowing as many password tries as they wanted. A Cambridge researcher has confirmed that this works on any later device as well, up to iPhone 6S (source).

The only real protection against this is a decent password. If you are using a 4-digit passcode, then you are not secure. You should be using a password instead. You should also not use iCloud, particularly not iCloud Backup and iCloud Keychain.



How do you know? Apple has not released an updated security guide yet.
Ios 10 uses FBE now. In 10.1 KPP was added, etc, all the bug fixes and security holes of past iOS versions patched up. Etc

And inherently a 64 bit device running 64 bit version of the os is more secure then 32 bit version
 
  • Like
Reactions: Agit21

KALLT

macrumors 603
Sep 23, 2008
5,369
3,393
Ios 10 uses FBE now. In 10.1 KPP was added, etc, all the bug fixes and security holes of past iOS versions patched up. Etc

And inherently a 64 bit device running 64 bit version of the os is more secure then 32 bit version

Kernel Patch Protection was added in iOS 9, not 10. I suppose with FBE you mean file-based encryption?

And inherently a 64 bit device running 64 bit version of the os is more secure then 32 bit version

Please, enlighten us.
 

DaIfoneboss

macrumors regular
Oct 6, 2011
148
121
Kernel Patch Protection was added in iOS 9, not 10. I suppose with FBE you mean file-based encryption?



Please, enlighten us.

I meant an updated version of KPP in 10.1.1. And yes iOS 9 used FDE(Full Disk Encryption) and now iOS 10 is using FBE which is better for smartphones as they typically aren't dying often and shutting off often.

And um.. ASLR to start with 64 bit ArmV8 chips? I can go on.

Also here, from the CEO of the biggest blackhat hacking group currently in the world (Zermodium) saying it himself;


""Prices are directly linked to the difficulty of making a full chain of exploits, and we know that iOS 10 and Android 7 are both much harder to exploit than their previous versions," he told Ars. Asked why a string of iOS exploits commanded 7.5 times the price of a comparable one for Android he said: "That means that iOS 10 chain exploits are either 7.5 x harder than Android or the demand for iOS exploits is 7.5 x higher. The reality is a mix of both."


https://www.google.com/amp/arstechnica.com/security/2016/09/1-5-million-bounty-for-iphone-exploits-is-sure-to-bolster-supply-of-0days/?amp=1?client=safari


So yeah iOS 10 is quite a bit more secure then past iOS versions.. Thought it was pretty obvious for some but I guess not
 
Last edited:
  • Like
Reactions: M. Gustave

KALLT

macrumors 603
Sep 23, 2008
5,369
3,393
I meant an updated version of KPP in 10.1.1. And yes iOS 9 used FDE(Full Disk Encryption) and now iOS 10 is using FBE which is better for smartphones as they typically aren't dying often and shutting off often.

And um.. ASLR to start with 64 bit ArmV8 chips? I can go on.

Also here, from the CEO of the biggest blackhat hacking group currently in the world (Zermodium) saying it himself;


""Prices are directly linked to the difficulty of making a full chain of exploits, and we know that iOS 10 and Android 7 are both much harder to exploit than their previous versions," he told Ars. Asked why a string of iOS exploits commanded 7.5 times the price of a comparable one for Android he said: "That means that iOS 10 chain exploits are either 7.5 x harder than Android or the demand for iOS exploits is 7.5 x higher. The reality is a mix of both."


https://www.google.com/amp/arstechnica.com/security/2016/09/1-5-million-bounty-for-iphone-exploits-is-sure-to-bolster-supply-of-0days/?amp=1?client=safari


So yeah iOS 10 is quite a bit more secure then past iOS versions.. Thought it was pretty obvious for some but I guess not

I don't think that iOS ever used full-disk encryption. It was file-based encryption since iOS 4, specifically to overcome the performance penalties of full-disk encryption. iOS 4 has also introduced address space layout randomisation, it was not new to ARMv8 processors.

One improvement I do know of is the hardened JIT Compiler in WebKit, which uses a feature of ARMv8's instruction set.

iOS 10 of course fixes bugs and updates the kernel, and it has traditionally been trickier to jailbreak a newer version on a new device. Even in iOS 9 it was already a fact that in order to perform a jailbreak, you have to chain several exploits together. This is becoming ever more difficult, hence the statements that exploits are becoming more and more expensive. I do not see a 'big boost', just a continuation.
 

Mcmeowmers

macrumors 6502
Jun 1, 2015
427
268
They shouldn’t have been able to get into the 5C. But the user didn’t have a passcode initiating the encryption.

Lesson? Use that passcode.

I believe they got in through essentially brute force - they "cloned" the phone and then tried a password....
 

GreyOS

macrumors 68040
Apr 12, 2012
3,355
1,682
I don't think that iOS ever used full-disk encryption. It was file-based encryption since iOS 4, specifically to overcome the performance penalties of full-disk encryption.
One thing I always wondered with so-called FDE on iOS is how widgets, notifications, your wallpaper, etc could appear before you type in your passcode, if the passcode is supposed to decrypt the disk and some of those features necessarily require data lying on the encrypted disk. My experience of FDE on a windows laptop is a very simple password UI immediately when turning it on, with windows only loading after the password is put in.

If iOS actually uses FBE (and always did) does that make that easier to explain the above? Or is all of that still possible with FDE and I just misunderstand it? Would be interested to hear you remark on this topic in any case as you seem knowledgable. Thanks
 

KALLT

macrumors 603
Sep 23, 2008
5,369
3,393
They talked about it at WWDC.

You mean Ivan Kristic’s talk? The ‘What’s new in security’ session? They barely talked about the internal security mechanisms of iOS 10. What they talked about either pertained to existing technology covered by the security guide before or networking and sandboxing APIs in Foundation and Cocoa, such as App Transport Security and Gatekeeper. Even Kristic’s Black Hat talk was hardly surprising, it was a recap of the security guide.

I have seen the WWDC talks, read the available developer documentation and am following some blogs. There is a wealth of information about iOS security, and most of it is not even new. What we have here is an ambiguous quote from Zerodium, but no hard facts. iOS 10.1.1 had not even a security note of its own that backs up the supposedly updated KPP. Again, I do not know to which ’big security boost’ DaIfoneboss is referring.

One thing I always wondered with so-called FDE on iOS is how widgets, notifications, your wallpaper, etc could appear before you type in your passcode, if the passcode is supposed to decrypt the disk and some of those features necessarily require data lying on the encrypted disk. My experience of FDE on a windows laptop is a very simple password UI immediately when turning it on, with windows only loading after the password is put in.

If iOS actually uses FBE (and always did) does that make that easier to explain the above? Or is all of that still possible with FDE and I just misunderstand it? Would be interested to hear you remark on this topic in any case as you seem knowledgable. Thanks

iOS does not use full-disk encryption, that is precisely the point. It uses a fairly elaborate file-based encryption scheme. It attempts to encrypt only the sensitive data and it does that by encrypting individual files and their metadata. Apple uses many other technologies to secure the boot process, but the system components themselves are not encrypted, unlike on macOS with FileVault.
 
  • Like
Reactions: GreyOS

electronicsguy

macrumors 6502a
Oct 12, 2015
569
251
Pune, India
So I understand that the FBI was able to get into that one shooters 5C running on iOS 9. Now that iOS 10 is out do you think they'd be able to crack into one now? Did Apple add anything that would make it more difficult this time around?
Whatever it is will be covered under a gag order. Unless Timmy and his gang wanna goto jail, they're never going to give you the real info - because they cannot. Secondly, the agencies like NSA, etc. may have undocumented access into phones - they'll never reveal it willingly to the companies about these bugs.
 

GreyOS

macrumors 68040
Apr 12, 2012
3,355
1,682
You mean Ivan Kristic’s talk? The ‘What’s new in security’ session? They barely talked about the internal security mechanisms of iOS 10. What they talked about either pertained to existing technology covered by the security guide before or networking and sandboxing APIs in Foundation and Cocoa, such as App Transport Security and Gatekeeper. Even Kristic’s Black Hat talk was hardly surprising, it was a recap of the security guide.

I have seen the WWDC talks, read the available developer documentation and am following some blogs. There is a wealth of information about iOS security, and most of it is not even new. What we have here is an ambiguous quote from Zerodium, but no hard facts. iOS 10.1.1 had not even a security note of its own that backs up the supposedly updated KPP. Again, I do not know to which ’big security boost’ DaIfoneboss is referring.



iOS does not use full-disk encryption, that is precisely the point. It uses a fairly elaborate file-based encryption scheme. It attempts to encrypt only the sensitive data and it does that by encrypting individual files and their metadata. Apple uses many other technologies to secure the boot process, but the system components themselves are not encrypted, unlike on macOS with FileVault.
Yes I know that's your stance, my question was about whether that's obvious from the fact notifications etc appear when locked, or whether thats still possible with fde. Wondering how anyone could ever claim it had FDE given those features
 

KALLT

macrumors 603
Sep 23, 2008
5,369
3,393
Yes I know that's your stance, my question was about whether that's obvious from the fact notifications etc appear when locked, or whether thats still possible with fde. Wondering how anyone could ever claim it had FDE given those features

Push notifications are sent by a server, thus the information is not encrypted. It is of course possible to encrypt only a particular volume, such as the volume that contains the user data and application data, like macOS used to have before FileVault 2.
 

GreyOS

macrumors 68040
Apr 12, 2012
3,355
1,682
Push notifications are sent by a server, thus the information is not encrypted. It is of course possible to encrypt only a particular volume, such as the volume that contains the user data and application data, like macOS used to have before FileVault 2.
Say an app lets you set a favourite bus stop, and that app has a widget showing you favourite bus stop departure times. I can see that widget before unlocking my phone, and the widget is using my preference which is saved to the disk. i just never understood how the phone could supposedly have its whole disk encrypted when it was obvious certain information was not encrypted when the phone was locked. Even an iMessage notification on the lock screen will display the name of the sender - which comes from your contacts on the disk.

Now i get what you're saying - it doesn't use FDE, it uses 'elaborate file-based encryption scheme' - and so the 'problem' above dissolves. there's no issue. my question was - how can others (journalist in the media, a user above, etc.) claim it has FDE, to me the features described above rule it out quite obviously? so, i know iOS doesn't use FDE, but could it do so and still have those features? doesn't seem like it could, to me. so the claims of others are even stranger, to me.

anyway, it's probably not worth pursuing this line of question, i think i'm just confusing things. thanks anyway.
 

C DM

macrumors Sandy Bridge
Oct 17, 2011
51,392
19,460
Say an app lets you set a favourite bus stop, and that app has a widget showing you favourite bus stop departure times. I can see that widget before unlocking my phone, and the widget is using my preference which is saved to the disk. i just never understood how the phone could supposedly have its whole disk encrypted when it was obvious certain information was not encrypted when the phone was locked. Even an iMessage notification on the lock screen will display the name of the sender - which comes from your contacts on the disk.

Now i get what you're saying - it doesn't use FDE, it uses 'elaborate file-based encryption scheme' - and so the 'problem' above dissolves. there's no issue. my question was - how can others (journalist in the media, a user above, etc.) claim it has FDE, to me the features described above rule it out quite obviously? so, i know iOS doesn't use FDE, but could it do so and still have those features? doesn't seem like it could, to me. so the claims of others are even stranger, to me.

anyway, it's probably not worth pursuing this line of question, i think i'm just confusing things. thanks anyway.
Interestingly, if you restart your phone and don't unlock it (assuming you have a TouchID and/or passcode) you won't really see that information as I recall. I just recently restarted my phone and didn't get a chance to unlock it before a phone call from one of my contacts came in and the call just showed up with the phone number rather than the contact information from my contacts.
 

Clete2

macrumors 65816
Sep 20, 2008
1,080
30
USA
Interestingly, if you restart your phone and don't unlock it (assuming you have a TouchID and/or passcode) you won't really see that information as I recall. I just recently restarted my phone and didn't get a chance to unlock it before a phone call from one of my contacts came in and the call just showed up with the phone number rather than the contact information from my contacts.


There is a Blackhat talk where an Apple employee describes why you don't see that information. Essentially there is a key you have to unlock by using your passcode when you start your phone. The phone physically does not have access to your contacts until you use the passcode to unlock it for the first time.
 

C DM

macrumors Sandy Bridge
Oct 17, 2011
51,392
19,460
There is a Blackhat talk where an Apple employee describes why you don't see that information. Essentially there is a key you have to unlock by using your passcode when you start your phone. The phone physically does not have access to your contacts until you use the passcode to unlock it for the first time.
Yup, that's basically what's behind it.
 
  • Like
Reactions: haruhiko

GreyOS

macrumors 68040
Apr 12, 2012
3,355
1,682
Interestingly, if you restart your phone and don't unlock it (assuming you have a TouchID and/or passcode) you won't really see that information as I recall. I just recently restarted my phone and didn't get a chance to unlock it before a phone call from one of my contacts came in and the call just showed up with the phone number rather than the contact information from my contacts.
Good example of more elaborate FBE, e.g. it can't see the title of reminders but it can see how many you have, which FDE wouldn't allow.
 

Tech198

Cancelled
Mar 21, 2011
15,915
2,151
So I understand that the FBI was able to get into that one shooters 5C running on iOS 9. Now that iOS 10 is out do you think they'd be able to crack into one now? Did Apple add anything that would make it more difficult this time around?

Well, the case would still stand.. Apple won't hand over anything, but of course other organizations can get in...... It's like we actually want our phones to be the silver bullet and Apple is the big daddy so no one in the world can crack it..... That's why organizations like Cellebrite exist.

If Cellebrite couldn't get in, they'd be out of a job.

iOS 10 would be "more" secure" not "impossible"
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.