Israeli Tech Company Says It Can Crack Any Apple Smartphone

from the thus-endeth-the-going-dark-conversation dept

Could this be the answer to FBI Director Chris Wray's call for broken device encryption?

In what appears to be a major breakthrough for law enforcement, and a possible privacy problem for Apple customers, a major U.S. government contractor claims to have found a way to unlock pretty much every iPhone on the market.

Cellebrite, a Petah Tikva, Israel-based vendor that's become the U.S. government's company of choice when it comes to unlocking mobile devices, is this month telling customers its engineers currently have the ability to get around the security of devices running iOS 11. That includes the iPhone X, a model that Forbes has learned was successfully raided for data by the Department for Homeland Security back in November 2017, most likely with Cellebrite technology.

Big, if true, but not exactly the answer Wray, and others like him, are seeking. Cellebrite claims it can crack any Apple device, including Apple's latest iPhone. This is a boon for law enforcement, as long as they have the money to spend on it and the time to send the device to Cellebrite to crack it.

It won't scale because it can't. The FBI claims it has thousands of locked devices -- not all of them Apple products -- and no one from Cellebrite is promising fast turnaround times. Even if it was low-cost and relatively scalable, it's unlikely to keep Wray from pushing for a government mandate. Whatever flaw in the architecture is being exploited by Cellebrite is likely to be patched up by Apple as soon as it can figure out the company's attack vector. And, ultimately, the fact that it doesn't scale isn't something to worry about (though the FBI doubtless will). No one said investigating criminal activity was supposed to easy and, in fact, a handful of Constitutional amendments are in place to slow law enforcement's roll to prevent the steamrolling of US citizens.

Cellebrite's service apparently disables lockscreen protection, allowing the company to root around in the phone's innards to pull out whatever law enforcement is seeking. This also apparently works with Android devices, although that news is far less surprising than discovering Apple's security measures have been defeated. Default encryption isn't an option for all Android devices and that operating system is generally considered to be the a pile of vulnerabilities d/b/a consumer software.

While this won't end calls for weakened encryption, it does at least give law enforcement agencies another option to deploy against locked devices. But I don't expect it to change the rhetoric. Those calling for "responsible encryption" don't really want private sector solutions, no matter how much they claim to want to hold a "conversation" about lawful access. They want tech company subservience. They want the government -- via judicial, executive, or legislative branch -- to put companies in their place. In their opinion, tech companies have been getting uppity and forgetting the private sector exists to serve the government. It's not just a Chris Wray problem. Plenty of government officials feel the same way. But the complaints about "going dark" are going to ring that much hollower when solutions are being offered by private companies other than the ones the FBI is just dying to smack around.

Filed Under: cracking, encryption, going dark, iphone, privacy, responsible encryption
Companies: apple, cellebrite

Apple Agrees To Store Chinese iCloud Data In China, Making It Much Easier For The Chinese Gov't To Access It

from the joining-the-Big-Brothers-program dept

In a time when law enforcement officials are calling Apple "evil" and demanding access to encrypted communications, it doesn't make much sense for the company to be doing this.

When Apple Inc begins hosting Chinese users’ iCloud accounts in a new Chinese data center at the end of this month to comply with new laws there, Chinese authorities will have far easier access to text messages, email and other data stored in the cloud.

That’s because of a change to how the company handles the cryptographic keys needed to unlock an iCloud account. Until now, such keys have always been stored in the United States, meaning that any government or law enforcement authority seeking access to a Chinese iCloud account needed to go through the U.S. legal system.

Now, according to Apple, for the first time the company will store the keys for Chinese iCloud accounts in China itself. That means Chinese authorities will no longer have to use the U.S. courts to seek information on iCloud users and can instead use their own legal system to ask Apple to hand over iCloud data for Chinese users, legal experts said.

This will allow the Chinese government to quell dissent and hunt down wrong-thinkers much more efficiently. It also shows the company is willing to drastically change the way it does business in order to maintain a large foreign customer base. This move will prompt questions from Congressional reps and FBI officials about Apple's refusal to work with the US government to provide access to locked devices and encrypted communications. Thanks to its acquiescence to the Chinese government, these questions won't be so easy to answer.

This change in policy won't budge the needle much in terms of US lawful access. US authorities will now have to route requests for Chinese data through the Chinese government, but it's unlikely there's much of that going on now. Requests for domestic data and communications stored in Apple's iCloud will be handled the way they always have been. Apple's always held keys domestically for iCloud accounts, which makes the cries of "going dark" a bit melodramatic.

But it does indicate Apple is willing to change policies for governments far less freedom-friendly than ours. And if it's willing to do that, why won't it stash encryption keys for locked devices where US law enforcement can access them?

Apple's defense of this move is interesting. It claims denying the Chinese government access would have meant shutting down the service in China. According to Apple's statements, this would make Chinese users less safe than the company decrypting iCloud data on demand.

“While we advocated against iCloud being subject to these laws, we were ultimately unsuccessful,” it said. Apple said it decided it was better to offer iCloud under the new system because discontinuing it would lead to a bad user experience and actually lead to less data privacy and security for its Chinese customers.

Presumably, data would have migrated to smaller cloud services offering even less protection to Chinese citizens. But that's hard to square with the fact that Apple's Chinese iCloud infrastructure is reliant on state-owned cloud firm Guizhou -- a company with close ties to the Chinese government.

Apple says the government won't have access to keys. It will still hold the keys, but the data's location means there won't be any prolonged battles over jurisdiction. Its "contractual arrangement" with Guizhou possibly makes Apple's decision to hold the keys inconsequential. The government may be able to approach Apple's partner and obtain direct access, bypassing the very minimal legal requirements Chinese law enforcement needs to meet before demanding user data.

Apple used to resist the Chinese government's demand for cloud data. Now it's pretty much engaged in a partnership with a state-owned business. If it's willing to do this, its resistance to US government overtures seems hypocritical at best. I don't want Apple to lower its defenses against US government intrusion, but I'd rather it took a consistent stance on these issues. Right now, it appears to be willing to submit to authoritarian governments rather than sacrifice part of its user base. It punches holes in its defenses of its actions on the domestic side and makes it easier for US law enforcement officials to sell encryption-damaging legislation to Congress and the White House.

Filed Under: china, human rights, icloud, privacy, security, surveillance
Companies: apple

Apple, Verizon Continue to Lobby Against The Right To Repair Your Own Devices

from the monopolizing-repair dept

A few years back, frustration at John Deere's draconian tractor DRM resulted in a grassroots tech movement. John Deere's decision to implement a lockdown on "unauthorized repairs" turned countless ordinary citizens into technology policy activists, after DRM and the company's EULA prohibited the lion-share of repair or modification of tractors customers thought they owned. These restrictions only worked to drive up costs for owners, who faced either paying significantly more money for "authorized" repair, or toying around with pirated firmware just to ensure the products they owned actually worked.

The John Deere fiasco resulted in the push for a new "right to repair" law in Nebraska. This push then quickly spread to multiple other states, driven in part by consumer repair monopolization efforts by other companies including Apple, Sony and Microsoft. Lobbyists for these companies quickly got to work trying to claim that by allowing consumers to repair products they own (or take them to third-party repair shops) they were endangering public safety. Apple went so far as to argue that if Nebraska passed such a law, it would become a dangerous "mecca for hackers" and other rabble rousers.

In the wake of Apple's recent iPhone battery PR kerfuffle (in which it claimed it throttled the performance of older iPhones to protect device integrity from dwindling battery performance), longer than normal repair waits have resulted in renewed interest in such laws. A new bill that would make it easier for consumers to repair their own electronics or utilize third-party repair shops is quickly winding its way through the Washington state legislature. That bill would not only protect the consumers' right to repair, but prevent the use of batteries that are difficult or impossible to replace:

"Starting in 2019, the bill would ban the sale of electronics that are designed “in such a way as to prevent reasonable diagnostic or repair functions by an independent repair provider. Preventing reasonable diagnostic or repair functions includes permanently affixing a battery in a manner that makes it difficult or impossible to remove."

Washington State Representative Jeff Morris says the bill was born directly from frustration by consumers and third-party repair shops in the wake of Apple's PR face-plant late last year:

"Morris told me this provision in the bill came out of a conversation with an independent repair shop owner in his district, who noted that many electronics now use glued-down batteries, which makes them difficult to repair and much harder to recycle, because batteries are flammable when shredded. There is currently no easy way for recyclers to remove the batteries from MacBook Pros at scale, for instance.

“With Apple phones in particular, they glue the battery in the case, so for me, that sounds like a purposeful attempt to make it so you couldn’t repair the phone,” Morris said. “It helps accelerate the path of those devices to the waste stream. So we’re trying to keep the philosophy our state is behind, which is recycle, repair, reuse."

Needless to say, Apple is furiously lobbying to kill Washington State's new law. As are fourteen other lobbying organizations representing hardware companies. Verizon's also lobbying against the bill (via the CTIA and the Telecommunications Industry Association), obviously concerned such a law would hurt the company's phone repair and insurance business it runs with Asurian. Unfortunately for Verizon and Apple, with 12 states introducing such bills last year and 17 such laws already proposed so far this year, this isn't an issue that's going away anytime soon.

Filed Under: drm, eula, iphone, iphone battery, ownership, right to repair, washington
Companies: apple, verizon

FBI Says Device Encryption Is 'Evil' And A Threat To Public Safety

from the thanks,-g-men.-we'll-take-it-under-advisement. dept

The FBI continues its anti-encryption push. It's now expanded past Director Christopher Wray to include statements by other FBI personnel. Not that Chris Wray isn't taking every opportunity he can to portray personal security as a threat to the security of the American public. He still is. But he's no longer the only FBI employee willing to speak up on the issue.

Wray expanded his anti-encryption rhetoric last week at a cybersecurity conference in New York. In short, encryption is inherently dangerous. And the FBI boss will apparently continue to complain about encryption without offering any solutions.

The Federal Bureau of Investigation was unable to access data from nearly 7,800 devices in the fiscal year that ended Sept. 30 with technical tools despite possessing proper legal authority to pry them open, a growing figure that impacts every area of the agency's work, Wray said during a speech at a cyber security conference in New York.

The FBI has been unable to access data in more than half of the devices that it tried to unlock due to encryption, Wray added.

"This is an urgent public safety issue," Wray added, while saying that a solution is "not so clear cut."

The solution is clear cut, even if it's not workable. What Wray wants is breakable encryption. And he wants companies to do the work and shoulder the blame. Wray wants to be able to show up at Apple's door with a warrant and walk away with the contents of someone's phone. How that's accomplished isn't really his problem. And he's not intellectually honest enough to own the collateral damage backdoored encryption would cause. But that's how Wray operates. He disparages companies, claiming encryption is all about profit and the government is all about caring deeply for public safety. Both statements are dishonest.

But Wray isn't the only FBI employee taking the move to default encryption personally. And the others commenting are taking the rhetoric even further, moving towards personal attacks.

On Wednesday, at the the International Conference on Cyber Security in Manhattan, FBI forensic expert Stephen Flatley lashed out at Apple, calling the company “jerks,” and “evil geniuses” for making his and his colleagues' investigative work harder. For example, Flatley complained that Apple recently made password guesses slower, changing the hash iterations from 10,000 to 10,000,000.

That means, he explained, that “password attempts speed went from 45 passwords a second to one every 18 seconds,” referring to the difficulty of cracking a password using a “brute force” method in which every possible permutation is tried.

[...]

“At what point is it just trying to one up things and at what point is it to thwart law enforcement?" he added. "Apple is pretty good at evil genius stuff."

This is great. Apple is now an "evil genius" because it made stolen iPhones pretty much useless to thieves. Sure, the device can be sold but no one's going to be able to drain a bank account or harvest a wealth of personal information. This was arguably in response to law enforcement (like the FBI!) complaining cellphone makers like Apple were assholes because they did so little to protect users from device theft. And why should they, these greedy bastards? Someone's phone gets stolen and the phone manufacturer now has a repeat customer.

Encryption gets better and better, limiting the usefulness of stolen devices and now Apple is an "evil genius" engaged in little more than playing keepaway with device contents. Go figure.

The FBI's phone hacker did have some praise for at least one tech company: Cellebrite. The Israeli hackers were rumored to have helped the FBI get into San Bernardino shooter Syed Farook's phone after a failed courtroom showdown with Apple. The FBI ended up with nothing -- no evidence on the phone and no court precedent forcing companies to hack away at their own devices anytime the government cites the 1789 All Writs Act.

Now we're supposed to believe device makers are the villains and the nation's top law enforcement agency is filled with unsung heroes just trying to protect the public from greedy phone profiteers. I don't think anyone believes that narrative, possibly not even those trying to push it.

Filed Under: chris wray, encryption, fbi, going dark, stephen flatley
Companies: apple

Shareholder Groups Say Apple Should Do More To Address Gadget 'Addiction' Among Young People: Should It?

from the won't-somebody-think-of-the-children-even-more? dept

In an open letter to Apple, two of its major shareholders, Jana Partners and the California State Teachers' Retirement System, have raised concerns about research that suggests young people are becoming "addicted" to high-tech devices like the iPhone and iPad, and the software that runs on them. It asks the company to take a number of measures to tackle the problem, such as carrying out more research in the area, and providing more tools and education for parents to help them deal with the issue. The letter quotes studies by Professor Jean M. Twenge, a psychologist at San Diego State University, who is also working with the shareholders in an effort to persuade Apple to do more:

Professor Twenge's research shows that U.S. teenagers who spend 3 hours a day or more on electronic devices are 35% more likely, and those who spend 5 hours or more are 71% more likely, to have a risk factor for suicide than those who spend less than 1 hour.

Other quoted research found:

The average American teenager who uses a smart phone receives her first phone at age 10 and spends over 4.5 hours a day on it (excluding texting and talking). 78% of teens check their phones at least hourly and 50% report feeling "addicted" to their phones.

According to the letter, at least part of the solution needs to come from Apple:

we note that Apple's current limited set of parental controls in fact dictate a more binary, all or nothing approach, with parental options limited largely to shutting down or allowing full access to various tools and functions. While there are apps that offer more options, there are a dizzying array of them (which often leads people to make no choice at all), it is not clear what research has gone into developing them, few if any offer the full array of options that the research would suggest, and they are clearly no substitute for Apple putting these choices front and center for parents.

The Apple shareholders behind the letter admit that it is not entirely altruistic:

we believe that addressing this issue now will enhance long-term value for all shareholders, by creating more choices and options for your customers today and helping to protect the next generation of leaders, innovators, and customers tomorrow.

Building on this, they also shrewdly point out that Apple has little to fear from moves to give parents more control over their children's use of Apple products:

Doing so poses no threat to Apple, given that this is a software (not hardware) issue and that, unlike many other technology companies, Apple's business model is not predicated on excessive use of your products. In fact, we believe addressing this issue now by offering parents more tools and choices could enhance Apple's business and increase demand for its products.

That's in contrast to Facebook or Google, for example, both which want people to use their respective products as much as possible so as to maximize the opportunities for advertising. Apple has already responded with a fairly generic reply, published on the iMore site:

we are constantly looking for ways to make our experiences better. We have new features and enhancements planned for the future, to add functionality and make these tools even more robust.

Unless that functionality goes well beyond the perfunctory, it is unlikely to satisfy the shareholder groups, who presumably want the "full array of options" they mention. The danger for Apple is that a limited response might lead to it being swept up in the growing backlash against Silicon Valley and its products, evident in a number of recent articles. One thing Apple could do is to make it easier for third parties to write apps that address the problem in a thoroughgoing way -- something its tightly-controlled ecosystem may make harder than for Android.

A broader issue is how serious the problem of gadget "addiction" in children really is -- and how it should be tackled. Clearly, the parents play a key role here, but what about the hardware and software companies who profit from it? To what extent should they provide fine-grained parental controls -- should social media, for example, offer parents the capability to limit the number and timing of daily posts made by their children, and would that even help?

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: children, ios, parents, phones, technology
Companies: apple, google

Apple Facing A Bunch Of Lawsuits After Admitting It Slows Down Older Devices, But Insisting It's For A Good Reason

from the yes,-but... dept

There was a bit of controversy last week concerning Apple slowing down older devices. It started, as so many things do, with a Reddit post, noting that Apple appeared to be slowing down the processor on phones with older batteries. Geekbench's John Poole then ran some tests confirming this. Apple then confirmed that it was doing so. All three of those links above also present the reason for this -- which is not necessarily a nefarious one -- though that doesn't necessarily mean it's a good explanation either. In short, it was a solution to a problem of older batteries causing "spontaneous" or "unexpected shutdowns."

But, of course, slowing down the phone to avoid those kinds of shutdowns still has the impact of reduced performance on older phones -- which ultimately angers users or makes them feel like they need to upgrade before they really do. This wouldn't necessarily be a huge issue if two things were true: (1) it was easy to replace the batteries and (2) Apple was clear and upfront about this -- telling people they could avoid this issue by replacing the battery. Neither of those things are true. Apple makes it quite difficult to replace the batteries (though, not impossible) and only now is explaining this "hack."

And, because this is America, lawsuits are already being filed. Multiple lawsuits. I imagine that they'll all be combined at some point into a giant class action, though I'm not sure how much of a chance this case has of going very far. Either way, I'd post the lawsuits, but as I type this PACER appears to not be working properly, and I really doubt there's much that's interesting in the complaints anyway.

What's more interesting here is the troubling nature of just how much control over our devices we've given to the companies who sell us stuff. This all goes back to the theme that we've discussed many times around here, of how we no longer seem to own what we've ostensibly purchased. The fact that a company such as Apple can sneak in and change our settings in a way that harms overall performance -- even if it claims it has a good reason to -- is something that concern us all. And that's especially true as more and more of our devices have such connectivity... and our own ability to get in and fix stuff is more and more limited.

Filed Under: batteries, class action lawsuit, iphone
Companies: apple

Apple Bullies Pharmacy Over Trademark Because All The Apples Are Belong To Them

from the dem-apples dept

For roughly as long as Apple went through business-puberty and grew up into a big-boy company, it has held the somewhat strange belief that only it is allowed to use anything resembling an image of an apple as part of any kind of corporate branding. This has resulted in all kinds of bullying episodes and disputes over the logos of other companies that have little to no resemblance to Apple's iconic logo and typically involve companies that don't remotely compete with it either.

But if Apple was hoping for some kind of chilling effect to be the result of these bullying efforts, it's only logical that this chilling effect would need to be renewed now and again. Fortunately, some silly pharmacy called Red Apple Interactive Pharmacy had the audacity to file a trademark application for the following logo.

Does that look like Apple's iconic logo?

No, it does not. Does the pharmacy compete with Apple in any way related to anything in trademark law? No, it does not. Did any of that stop Apple from opposing the trademark application of Red Apple Interactive Pharmacy. No, it most certainly did not.

Apple filed its opposition yesterday, December 18, claiming that the applied-for mark would cause a likelihood of confusion and dilution by blurring.

The document filed by Apple cited the company’s apple logo, the mark ‘Apple’ and the mark ‘Apple Watch’ as some of the registrations used to oppose the applied-for mark.

The Apple logo covers classes 9 (computer hardware and programs); 25 (analysis and consultation in the field of business information management); 29 (data storage services); and 41 (education and training services).

This is bullying in its purest form. There is not a shred of potential or real customer confusion about which to worry in this case. The logos aren't similar enough to cause concern, the companies are not competing, and even the most moronic hurried person is not walking going to try to buy prescription drugs thinking its from the same company that made their iPhone.

One would think there were better efforts on which to spend Apple's valuable time beyond these frivolous, bullying efforts.

Filed Under: apple, pharmacy, trademark
Companies: apple, red apple interactive pharmacy

Trump's FCC Boss Blasts Apple For Refusing To 'Turn On' FM iPhone Chipsets That Don't Actually Exist

from the yeah,-whoops dept

If you've seen current FCC Ajit Pai's name in print so far this year, it's probably for any number of his extremely anti-consumer, telecom industry friendly positions. Like his attempts to kill net neutrality, his support of gutting consumer broadband privacy protections, his efforts to protect the cable industry's cable box monopoly from competition, efforts to dramatically reduce media consolidation rules, his defense of prison phone monopoly price gouging, or the way he's making it harder for Americans to get affordable broadband.

To obfuscate this arguably-lopsided agenda, Pai has been busy trying to portray himself as somebody notably other than the revolving door regulator he actually is.

For example, Pai has repeatedly insisted that he's a heroic advocate for closing the digital divide, even while simultaneously weakening broadband deployment standards and eroding all oversight of historically-despised mono/duopolists like Comcast. Similarly, Pai spent many of his first months in office insisting he'd be breathlessly dedicated to transparency, yet the FCC boss has already been sued for refusing to document his communications with incumbent ISPs regarding net neutrality, or to provide hard data on why his agency appears to have hallucinated a DDoS attack.

Last week, Pai trotted out yet another effort to try and portray himself as an unwavering ally to consumers. In a missive posted to the FCC website (pdf), Pai lambasted Apple for refusing to turn on the FM radio chipsets embedded in iPhones, something he was quick to proclaim was a major affront to the safety and security of the nation's wireless subscribers:

"Apple is the one major phone manufacturer that has resisted doing so. But I hope the company will reconsider its position, given the devastation wrought by Hurricanes Harvey, Irma, and Maria. That’s why I am asking Apple to activate the FM chips that are in its iPhones. It is time for Apple to step up to the plate and put the safety of the American people first. As the Sun Sentinel of South Florida put it, ‘Do the right thing, Mr. Cook. Flip the switch. Lives depend on it.’”

And while that may look like Pai was busy trying to do a good thing, Apple was forced to issue a public statement pointing out that the chipsets Pai wants turned on -- don't actually exist:

"Apple cares deeply about the safety of our users, especially during times of crisis and that’s why we have engineered modern safety solutions into our products. Users can dial emergency services and access Medical ID card information directly from the Lock Screen, and we enable government emergency notifications, ranging from Weather Advisories to AMBER alerts. iPhone 7 and iPhone 8 models do not have FM radio chips in them nor do they have antennas designed to support FM signals, so it is not possible to enable FM reception in these products."

And while some older iPhone models do have such chipsets, they don't have the embedded antennas necessary to effectively utilize them. In many instances, the FM functionality is just part of an overall "system on a chip" (SOC) that technically contains the functionality, but isn't actually capable of being turned on. Pai appears to have drawn his information from this similarly incorrect Florida news report, something ten minutes of research could have clarified. From some additional commentary from Apple evangelist John Gruber:

"I’ve dug around, and what I’ve been told is that there is an FM radio chip in older iPhones, but it’s not connected, and there’s no antenna designed for FM radio. The chip is just part of a commodity component part, and Apple only connected the parts of the chip that the iPhones were designed to use. No iPhone was ever designed to be an FM radio, and there is no “switch” that can be “flipped” — nor software update that could be issued — that could turn them into one. It’s a complete technical misconception.

What’s absurd is that the FCC commissioner would take his understanding of the iPhone’s technical capabilities from a newspaper editorial rather than from Apple’s own FCC regulatory filings, which I’m pretty sure would show that they’re not capable of acting as FM radios.

If that's the level of Pai's fact-checking before accusing Apple of harming the safety of the "American people," it leaves you wondering just how much homework Pai has done before deciding to "take a weedwhacker" (his words) to essential consumer protections on the telecom front.

Filed Under: ajit pai, fcc, fm radios, iphones
Companies: apple