Author Archives: Robert Graham

Dan Guido (@DGuido), who knows more about iOS than I do, wants me to retract this post. I’m willing to retract it based solely on his word, but he won’t give me any details as to what specifically he objects to. I’m an expert in reverse-engineering and software development, but I admit there may be something to specific to iOS (such as how it encrypts firmware) that I may not know.

This post will respond to the tweet by Orin Kerr:

Tech help: What are the best responses to DOJ claims in new Apple/FBI brief re whether code could be misused? Thks. pic.twitter.com/V08EcV9Rev

— Orin Kerr (@OrinKerr) March 11, 2016

The government is right that the software must be signed by Apple and made to only work on Farook’s phone, but the situation is more complicated than that.

The basic flaw in this picture is jailbreaks. This is a process of finding some hack that gets around Apple’s “signing” security layer. Jailbreaks are popular in the user community, especially China, when people want to run software not approved by Apple. When the government says “intact security”, it means “non-jailbroken”.

Each new version of iOS requires the discovery of some new hack to enable jailbreaking. Hacking teams compete to see who can ship a new jailbreak to users, and other companies sell jailbreaks to intelligence agencies. Once jailbroken, the signing is bypassed, as is the second technique of locking the software specifically to Farook’s phone.

Details are more complicated than this. The issue isn’t that jailbreaks will allow this software to run. Instead, the issue is that jailbreaks can reverse-engineer this software to grab its secrets, and then use those secrets on other phones.

A more important flaw in this reasoning is the creation of the source code itself. This is the human readable form of the code written by the Apple engineers. This will later be compiled into “binary code” then signed. It’s at the source code stage that Apple is most in danger of losing secrets.

Let’s assume that Apple is infiltrated by spies from the NSA and the Chinese. Some secrets can still be kept, such as the signing keys for the software. Other secrets cannot be kept, such as source code. It’s likely the NSA and/or Chinese have stolen Apple’s source code multiple times. Indeed, most of the source is public anyway (the Darwin operating system, Webkit, etc.). It’s not something Apple is too concerned about — as long as the source doesn’t get published.

When Apple writes this specific tool for the FBI, it’ll be very hard to keep that source out of the hands of such spies. It’s possible to keep it secret, but only through burdonsome heroic efforts on Apple’s part that certainly weren’t part of its initial estimate.

More important than the source code, though, are the ideas. Code is expressive speech that communicates ideas. Even when engineers forget the details of source code, they can still retain these ideas. Years later, they can recall those ideas and use them. I give a real example of this in my previous post on expressiveness of code. Apple cannot contain these ideas. The engineers in question, after building the code, can immediately quit Apple and got to to work for Chinese jailbreak companies or American defense contractors for twice the salary. And it’s completely legal.

It’s like a Hollywood failed movie project. In the end, they decide not to move forward with the project, shutting it down. The employees then go off to different companies, taking those ideas with them, using them in unrelated movie projects. That’s the story told in the award-winning documentary Jodorowsky’s Dune, which ties that production to other unrelated movies, like Alien, Star Wars, and Terminator.

Orin goes onto ask:

@ErrataRob Given that it only takes a few days to write the source code, isn’t that pretty much true now?

— Orin Kerr (@OrinKerr) March 11, 2016

It will likely take more than a few days to write the code. The FBI misrepresents the task as consisting of only a few lines of code. But Apple estimates a much larger project. Though to be fair, some of that is testing, packaging, and documentation unrelated to the amount of code written.

The task will likely require different skills from multiple engineers, rather than being the output of a single engineer. That’s because it’s possible no single engineer has all the necessary skills. However, all the engineers involved will still walk away with the entire picture, able to recreate the work on their own when working for the Chinese or Booz-Allen.

In the end, it’s not a huge secret that Apple will be losing. For the most part, the “backdoor” already exists, the only question is how best to exploit it. It’s likely something the jailbreak community can figure out for themselves. But at the same time, Apple does have a point that there is the fundamental burden that producing this software will slightly (though not catastrophically) weaken the security of their existing phones.

Continue reading Can the Apple code be misused? (Partly Retracted)→

I write code. More than a $billion of products have been sold where my code is the key component. I’ve written more than a million lines of it. I point this out because I want to address this FBIvApple fight from the perspective of a coder — from the … Continue reading Code is expressive. Full Stop. (FBIvApple)→

The next Marvel movie is Captain America: Civil War (May 2, 2016). The plot is this: after the Avengers keep blowing things up, there is pushback demanding accountability. Government should be in control when to call in the Avengers, and superhumans should be forced to register with the government. Ironman is pro-accountability, as you’ve seen his story arc evolve toward this point in the movies. Captain America is anti-accountability.

This story arc is us, in cybersecurity. Last year, Charlie Miller and Chris Valasek proved they could, through the “Internet”, remotely hack in and control a car driving down the freeway. In the video, we see a frightened reporter as the engine stalls in freeway traffic. Should researchers be able to probe cars, medical equipment, and IoT devices accountable to nobody but themselves? Or should they be accountable to the public, and rules setup by government?

This story is about us personally, too. In cyberspace, many of us have superhuman powers. Should we be free to do whatever we want, without accountability, or should be be forced to register with teh government, so they can watch us? For example, I scan the Internet (the entire Internet) with relative impunity. This is what I tweeted when creating my masscan tool, an apt analogy:

I’ve been totally tonystartking the code for the past week (think Iron man, working in the basement, only with software code).

— Rob Graham ❄️ (@ErrataRob) March 26, 2013

Finally, this is related to the #FBIvApple debate on crypto backdoors. Should law-enforcement be able to get into all our electronics, when they have a warrant upon probably cause? Or should citizens be able to encrypt their data with impunity, so that nobody (not even the NSA codebreakers) can read it?

I’m totally #TeamCap on this one, as most of you know. It’s car companies and medical device manufacturers who should be held accountable for deffects. They evade responsibility because they can pay for government lobbyists. Only a free security research community will ever hold them accountable. Similarly, as Snowden showed, ‘warrents’ are not enough to hold the government and law enforcement accountable, and thus, unfettered crypto must be a right of the people that government cannot abridge. Lastly, I’ll never “register” or “get certified” by the government. I’ll leave the country before that happens.

Continue reading Captain America Civil War — it’s us→

Hi.For security research, I regularly “mass scan” the entire Internet. For example, my latest scan shows between 250,000 and 300,000 devices still vulnerable to Heartbleed. This is legal. This is necessary security research. Yet, I still happily remove… Continue reading An open letter to Sec. Ashton Carter→

This journalist, while writing a story on the #FBIvApple debate, got his email account hacked while on the airplane. Of course he did. His email account is with Earthlink, an early Internet services provider from the 1990s. Such early providers (AOL, N… Continue reading Early Internet services considered harmful→

I need more than 140 characters to respond to this tweet:

If you were a crime victim and key evidence was on suspect’s phone, would you want govt to search phone w/ warrant?

— Orin Kerr (@OrinKerr) February 22, 2016

It’s an invalid question to ask. Firstly, it’s asking for the emotional answer, not the logical answer. Secondly, it’s only about half the debate, when the FBI is on your side, and not against you.

The emotional question is like ISIS kidnappings. Logically, we know that the ransom money will fund ISIS’s murderous campaign, killing others. Logically, we know that paying this ransom just encourages more kidnappings of other people — that if we stuck to a policy of never paying ransoms, then ISIS would stop kidnapping people.

If it were my loved ones at stake, of course I’d do anything to get them back alive and healthy, including pay a ransom. But at the same time, logically, I’d vote for laws to stop people paying ransoms. In other words, I’d vote for laws that I would then happily break should the situation ever apply to me.

Thus, the following question has no meaning in a policy debate over paying ransoms:

If it was your loved one at stake, would you pay the ransom?

Even those who say “no” are being disingenuous. It’s easy to say it because they aren’t in danger of the situation ever happening to them. Most would change their answer to “yes” if it became real.

The second reason the original question is invalid because it ignores why we have warrants in the first place. Unlimited police power is a bad thing. What you need is a counterbalancing question.

For example, in 2007 (before iPhones became popular) the FBI showed up at my business and threatened me in order to keep something quiet. Specifically, I was to give a talk at a conference on how, contrary to what the company “TippingPoint” claimed, it was easy to decrypt their “signature” files. That company convinced the FBI that it was important to “national security” that I keep such information quiet. So the FBI came to our offices, and first asked politely, then started threatening me, in order to keep the information quiet.

So, in such situations, should the FBI be able to get a warrant and search my phone? Note that a warrant would be easy to get, as the company TippingPoint suggested that I was also trying to blackmail (demanding money to stay quiet). It was a lie, they kept offering to bribe us to keep quiet and we kept telling them “under no circumstances”, but it’s enough to get a warrant in order go fishing for something else to hang us by.

If FBI threatened you to keep quiet about something, should they be able to search your phone w/ warrant?@OrinKerr

— Rob Graham ❄️ (@ErrataRob) February 22, 2016

This is less a meaningful question. Most people are sheep, believing that as long as they don’t stick their heads up above the herd, they are in no danger of getting their heads lopped off. But even if it’s not your head in danger, don’t you want to protect those who do raise their heads?

Rather than a “Going Dark” problem, ours is one of “Going Light”. We all now carry a GPS tracking device in our pocket that contains a microphone and video camera. We are quickly putting a microphone (and sometimes camera) in every room in our house, with devices like smart TVs and Amazon’s Echo. License plate readers line the roads, and face recognition (as well as video cameras) are located everywhere crowds gather. All our credit card transactions are slurped up by the government, as are our phone metadata (even more so since the so-called USA FREEDOM ACT).

The question is whether the “warrant upon probable cause” is sufficient protection for the Going Light problem? Or do we need more limits?

We activists think more limits are needed. The first limits are the ones requiring no special laws. Encryption is basic math — the effort necessary to stop encryption would require a police state worse than that created by the War on Drugs. The government should not be able to conscript programmers to create new technology on their behalf, as in the current Apple-v-FBI case.

The War on Drugs and the War on Terror have made a police state out of America. We jail 10 times more people, per capita, than other free nations (more than virtually any other nation). Law enforcement steals more through “civil asset forfeiture” than burglars do. We can no longer travel without showing our papers at numerous checkpoints. We can no longer communicate nor use credit cards without a record going to a government controlled database.

Yes, this police state works in our favor when it’s us that have been a victim of crime. But on the whole, we are now more in danger from the police state than we are from crime itself.

BTW, @orinkerr is awesome. He asks the question because he honestly wants to know the answer, not because he’s slyly arguing the point. He brings up the question because so many others mention it. I’m using his as they example only because it’s the one that’s handy, and I’m too lazy hunting down a different one. Update: as he points out.

Continue reading The disingenuous question (FBIvApple)→

So John McAfee has claimed he could unlock the terrorist’s iPhone. Is there any truth to this?http://www.businessinsider.com/john-mcafee-ill-decrypt-san-bernardino-phone-for-free-2016-2No, of course this is bogus. If McAfee could do it, then he’s alrea… Continue reading About McAfee’s claim he could unlock iPhone→

Today, a judge ordered Apple to help the FBI decrypt the San Bernadino shooter’s iPhone 5C. Specifically:

1. disable the auto-erase that happens after 10 bad guesses
2. enable submitting passcodes at a high speed electronically rather than forcing a human to type them one-by-one
3. likely accomplish this through a software update (which would run out of RAM, rather than updating the operating system)

On newer phones like the iPhone 6, with Apple’s “Enclave”, such an update of the firmware would be impossible. Updating the firmware to do what the FBI wants would also erase the crypto keys, or at least first require unlocking. If such a trick would work on the newer phones, then Apple has been lying about them. [UPDATE: There seems to be some disagreement here. I remember something to this effect when Apple announced the iPhone 5C, but I can’t find any reference to backup my claims. It may be that the current 5C has a similar vulnerability to a firmware update].

On older phones, such as the iPhone 5C, there is no enclave, so plausible the FBI’s strategy of updating iOS might work. But the problem exists on how to get the iOS update onto the phone — which may need a passcode.

The first hurdle is to get the iPhone to trust the computer doing the update, which can only be done with an unlocked phone. That means the FBI won’t be able to get the phone to trust their own computers. However, the iPhone has probably been connected to a laptop or desktop owned by the terrorists, so such an update can happen from those computers.

The second hurdle is that the phone asks for a passcode during an update. I updated my old iPhone 5 to verify this. Right between the update steps, it asked for the passcode. I’m not sure who asked for it. Was it the older iOS version, preventing an update? Or was it the new iOS version, asking to verify the new update. In the first case, it’s not something Apple can change, but in the second case, it’s something Apple can fix to comply with the FBI’s request.

I was using iTunes. Apparently, there are other tools out there (used for repair shops and factories) that are more efficient, and which may be able to bypass a security check.

Depending on the version of the existing iOS version on the phone, there may be other opportunities for the FBI. Back in 2014, there was some controversy about a developer feature that could be used to ‘backdoor’ the iPhone, assuming it had already been set to trust a computer.

Lastly, the older iOS 8 defaulted to 4 digit passcodes, and merely a long delay (but not erasure) between attempts. There’s a good chance this is how the phone was configured. Which means that an intern with the phone will eventually be able to decrypt it.

Q: Do we know if the ‘erase’ feature (after 10 failed guesses) was enabled?
A: It was a phone given by the employer, which claims erase was enabled by default.

Q: What iOS version is the phone?
A: According to the FBI, it’s iOS 9.

Q: Is the FBI asking for Apple to create a custom operating-system?
A: No. They are asking for Apple to write code that would run out of RAM, without changing anything on the drive.

Q: How is this different from the 70 other times the FBI has asked Apple to unlock a phone?
A: Because those times took a few minutes of effort on Apple’s part. This is asking Apple to spend 2000 hours on creating a new technology that could potentially be used to unlock all older phones. In other words, it’s conscripting a man-year’s worth of labor.

Links:

• The FBI motion asking for this court order.
• Apple’s letter to customers in response to this.
• Dan Guido’s take on this event (he knows more about this than I do).
• Jonathan Zdziarski’s take on this on this event (he knows more about this than I do).

Continue reading Some notes on Apple decryption San Bernadino phone→