No likey no unlocky

[barrydidit]

I thought it was a 4 digit pin so 10,000 attempts needed? The issue is that trying that many *might* cause the data to expire?

I would have a go at the 10,000 attempts! Sounds like a fun weekend to me being a sad geek moron with no life.....

Can't you just stick to the counting thread?

[NotAllThere]

So there are no devices that can take an image of whatever Apple use as a storage medium? If you were hacking a standard HDD, first thing you'd do is make a magnetic copy and hack that.

Edit: Now I've read NickFitz's links...

[NickFitz]

It appears that much of the reporting on the case is wrong (surprise!) in its description of what Apple has been asked to do. Via https://www.techdirt.com/articles/20...backdoor.shtml the important bits of the court order are:

2. Apple's reasonable technical assistance shall accomplish the following three important functions: (1) it will bypass or disable the auto-erase function whether or not it has been enabled; (2) it will enable the FBI to submit passcodes to the SUBJECT DEVICE for testing electronically via the physical device port, Bluetooth, Wi-Fi, or other protocol available on the SUBJECT DEVICE and (3) it will ensure that when the FBI submits passcodes to the SUBJECT DEVICE, software running on the device will not purposefully introduce any additional delay between passcode attempts beyond what is incurred by Apple hardware.

3. Apple's reasonable technical assistance may include, but is not limited to: providing the FBI with a signed iPhone Software file, recovery bundle, or other Software Image File ("SIF") that can be loaded onto the SUBJECT DEVICE. The SIF will load and run from Random Access Memory and will not modify the iOS on the actual phone, the user data partition or system partition on the device's flash memory. The SIF will be coded by Apple with a unique identifier of the phone so that the SIF would only load and execute on the SUBJECT DEVICE. The SIF will be loaded via Device Firmware Upgrade ("DFU") mode, recovery mode, or other applicable mode available to the FBI. Once active on the SUBJECT DEVICE, the SIF will accomplish the three functions specified in paragraph 2. The SIF will be loaded on the SUBJECT DEVICE at either a government facility, or alternatively, at an Apple facility; if the latter, Apple shall provide the government with remote access to the SUBJECT DEVICE through a computer allowing the government to conduct passcode recovery analysis.

4. If Apple determines that it can achieve the three functions stated above in paragraph 2, as well as the functionality set forth in paragraph 3, using an alternate technological means from that recommended by the government, and the government concurs, Apple may comply with this Order in that way.

The whole court order is embedded at the above link, and is worth reading to understand what the real situation is - it's only two-and-a-half pages after all the legal boilerplate on page one. Which raises the question of why journalists have failed so miserably at accurately reporting what it says…

[DaveB]

So there are no devices that can take an image of whatever Apple use as a storage medium? If you were hacking a standard HDD, first thing you'd do is make a magnetic copy and hack that.

You cant read the device without unlocking it.

Even if it was possible, all you would get was the encrypted disk image, the key to which is dependent on the phones PIN, the owner of which is now dead.

[NickFitz]

So there are no devices that can take an image of whatever Apple use as a storage medium? If you were hacking a standard HDD, first thing you'd do is make a magnetic copy and hack that.

As explained in the articles I linked to above, the device's data is encrypted with an AES key that is not accessible other than via the passcode, or Touch ID on hardware capable of that.

[LondonManc]

It appears that much of the reporting on the case is wrong (surprise!) in its description of what Apple has been asked to do. Via https://www.techdirt.com/articles/20...backdoor.shtml the important bits of the court order are:

<snip>

The whole court order is embedded at the above link, and is worth reading to understand what the real situation is - it's only two-and-a-half pages after all the legal boilerplate on page one. Which raises the question of why journalists have failed so miserably at accurately reporting what it says…

Not really; the journalists are here to dumb down and sensationalise bits of news so that they become interesting.

[SimonMac]

So there are no devices that can take an image of whatever Apple use as a storage medium? If you were hacking a standard HDD, first thing you'd do is make a magnetic copy and hack that.

Standard practice for the fuzz, image a HDD before investigating the copy leaving the original as intact evidentually.

That could work for a 4 digit PIN, its a pain but depends on how bad you want the data.

Apple are not saying that it can't be done, they are saying they don't want to do it

[NickFitz]

Here's another article on how it works, with more detail: A Few Thoughts on Cryptographic Engineering: Why can't Apple decrypt your iPhone?

Though worthy of note: Apple haven't been asked to decrypt the phone. That aspect of it is actually not mentioned in the court order.

[barrydidit]

Haven't they tried his DoB?

[DaveB]

Standard practice for the fuzz, image a HDD before investigating the copy leaving the original as intact evidentually.

That could work for a 4 digit PIN, its a pain but depends on how bad you want the data.

Apple are not saying that it can't be done, they are saying they don't want to do it

They are saying they wont do what the FBI have asked them to do. Imaging the disk wont work in any case as it required the OS on the imaged disk to have access to the encryption key in combination with the PIN number being entered. The OS has to be "live" for it to work and if it's live it will erase the data after 10 failed attempts.

Other disk encryption solutions *may* be hackable through attacking the image but the way Apple has implemented it mean it's not possible.

EDIT: Having read the link Nick Posted, the other half of the encryption key is actually buried on the hardware of the device, and is not retrievable, so the disk has to be running on the device it was created on (the original phone) in order to be able to unlock it.