SoylentNews

takyon writes:

Following a recent attempt in New York to legislate backdoors or ban encrypted devices, a California lawmaker is trying to do the same. Only this time, the boogeyman is human trafficking:

A second state lawmaker has now introduced a bill that would prohibit the sale of smartphones with unbreakable encryption. Except this time, despite very similar language to a pending New York bill, the stated rationale is to fight human trafficking, rather than terrorism.

Specifically, California Assemblymember Jim Cooper's (D-Elk Grove) new bill, which was introduced Wednesday, would "require a smartphone that is manufactured on or after January 1, 2017, and sold in California, to be capable of being decrypted and unlocked by its manufacturer or its operating system provider."

If the bill passes both the Assembly and State Senate and is signed into law by Gov. Jerry Brown (D), it would affect modern iOS and Android devices, which enable full-disk encryption that neither Apple nor Google can access. AB 1681's language is nearly identical to another bill re-introduced in New York state earlier this month, but Cooper denied that it was based on any model legislation, saying simply that it was researched by his staff. He also noted that the sale of his own iPhone would be made illegal in California under this bill.

Cooper himself, a 30 year veteran with the Sacramento County Sheriff's Department, told Ars that allowing local law enforcement to access unencrypted phones through the warrant process was not the same thing as allowing the National Security Agency or the CIA free rein. He also noted that "99 percent" of Californians would never have their phones be implicated in a law enforcement operation, implying that they should not have to worry.

Engadget puts it best: "The bill would put every Californian's digital security at risk to prosecute a few pimps."

In other Crypto War news, NSA Director Admiral Mike Rogers recently said that "encryption is foundational to the future," staking an opposite position from that of FBI Director James Comey.

Original Submission

takyon writes:

Apple has achieved a legal victory in a Brooklyn case that attempted to use the All Writs Act, similar to the case of a San Bernardino shooter's locked iPhone:

A magistrate judge in the U.S. District Court in New York has handed Apple a legal victory in a Brooklyn drug case where federal investigators asked for help getting into a locked iPhone.

Though the ruling isn't precedent-setting or binding on other courts, it hits on a similar overarching theme of government access to encrypted data, as The Washington Post reports:

"The two cases involve different versions of iPhone's operating system and vastly different requests for technical help, but they both turn on whether a law from 1789 known as the All Writs Act can be applied to cases in which the government cannot get at encrypted data stored on suspects' devices."

NPR's Joel Rose previously outlined the premise of this Brooklyn case, which predated the legal clash over an iPhone used by one of the San Bernardino shooters:

"Jun Feng pleaded guilty to selling methamphetamine last year. As part of its investigation, the government obtained a search warrant for Feng's iPhone. But the phone was locked by a passcode, so prosecutors asked a judge for an order compelling Apple to bypass it."

That order was based on the same law as the San Bernardino court order compelling Apple's help in unlocking the iPhone used by Syed Rizwan Farook before the Dec. 2 attack, in which he and his wife killed 14 people.

The Justice Department will appeal the case. FBI Director James Comey and Apple General Counsel Bruce Sewell will appear at a House Judiciary Committee hearing on Tuesday to testify on encryption.

The Verge, The Register.

Original Submission

MrPlow writes:

Submitted via IRC for Runaway1956

The FBI's director says the agency is collecting data that he will present next year in hopes of sparking a national conversation about law enforcement's increasing inability to access encrypted electronic devices.

Speaking on Friday at the American Bar Association conference in San Francisco, James Comey says the agency was unable to access 650 of 5,000 electronic devices investigators attempted to search over the last 10 months.

Comey says encryption technology makes it impossible in a growing number of cases to search electronic devices. He says it's up to U.S. citizens to decide whether to modify the technology.

Source: http://www.nbcnews.com/news/us-news/fbi-chief-calls-national-talk-over-encryption-vs-safety-n624101

Original Submission

Fnord666 writes:

The security coprocessor was introduced alongside the iPhone 5s and Touch ID. It performs secure services for the rest of the SOC and prevents the main processor from getting direct access to sensitive data. It runs its own operating system (SEPOS) which includes a kernel, drivers, services, and applications.

The Secure Enclave is responsible for processing fingerprint data from the Touch ID sensor, determining if there is a match against registered fingerprints, and then enabling access or purchases on behalf of the user. Communication between the processor and the Touch ID sensor takes place over a serial peripheral interface bus. The processor forwards the data to the Secure Enclave but can't read it. It's encrypted and authenticated with a session key that is negotiated using the device's shared key that is provisioned for the Touch ID sensor and the Secure Enclave. The session key exchange uses AES key wrapping with both sides providing a random key that establishes the session key and uses AES-CCM transport encryption

Today, xerub announced the decryption key 'is fully grown'. You can use img4lib to decrypt the firmware and xerub's SEP firmware split tool to process.

Decryption of the SEP Firmware will make it easier for hackers and security researchers to comb through the SEP for vulnerabilities.

Source: iClarified

Also at ThreatPost which notes that this does not mean it is open season on SEP:

Yesterday’s news set off another flurry of angst as to the ongoing security of iOS and what would happen now that the firmware had been unlocked.

“I wouldn’t say there is any immediate threat to users at this point,” Azimuth Security’s Mandt said. “Although the key disclosure allows anyone to analyze the software that is running on the SEP processor, it still requires an attacker to find and exploit a vulnerability in order to compromise SEP.”

Original Submission

takyon writes:

The FBI will not have to disclose the name of the vendor that it paid to hack into an iPhone used by one of the San Bernardino terrorists:

A federal court ruled yesterday that the FBI does not have to disclose either the name of the vendor used or price the government paid to hack into the iPhone SE of mass shooter Syed Farook, according to ZDNet. The device became embroiled in a heated national controversy and legal standoff last year when Apple refused to help the FBI develop a backdoor into it for the purpose of obtaining sensitive information on Farook and his wife Tashfeen Malik, both of whom participated in the terrorist attack that left 14 dead in San Bernardino, California in December 2015.

The Justice Department originally filed a lawsuit against Apple to compel it to participate by creating a special version of its mobile operating system, something Apple was vehemently against because of the risk such a tool posed to users. But very soon after, the government withdrew from the case when a third-party vendor secretly demonstrated to the FBI a workable method to bypass the iPhone's security system. Three news organizations — the Associated Press, Vice News, and USA Today — filed a Freedom of Information Act lawsuit in September 2016 to reveal details of the hacking method used. Because it was not clear how many phones the workaround could be used on, and whether the FBI could use it surreptitiously in the future, the lawsuit was seeking information that would be pertinent to the public and security researchers around the globe.

But it's probably Cellebrite.

Previously: Washington Post: The FBI Paid "Gray Hat(s)", Not Cellebrite, for iPhone Unlock
FBI Can't Say How It Hacked IPhone 5C
Meeting Cellebrite - Israel's Master Phone Crackers
Cellebrite Appears to Have Been Hacked
Senator Dianne Feinstein Claims That the FBI Paid $900,000 to Break Into a Locked iPhone

Related: FBI Resists Revealing its Tor User Identification Methods in Court

Original Submission

takyon writes:

Despite cries of "responsible encryption", numerous law enforcement agencies are cracking into iPhones using a box called "GrayKey". Even the latest iPhones may be affected:

FBI Director Christopher Wray recently said that law enforcement agencies are "increasingly unable to access" evidence stored on encrypted devices. Wray is not telling the whole truth.

Police forces and federal agencies around the country have bought relatively cheap tools to unlock up-to-date iPhones and bypass their encryption, according to a Motherboard investigation based on several caches of internal agency documents, online records, and conversations with law enforcement officials. Many of the documents were obtained by Motherboard using public records requests.

[...] "It demonstrates that even state and local police do have access to this data in many situations," Matthew Green, an assistant professor and cryptographer at the Johns Hopkins Information Security Institute, told Motherboard in a Twitter message. "This seems to contradict what the FBI is saying about their inability to access these phones."

As part of the investigation, Motherboard found:

• Regional police forces, such as the Maryland State Police and Indiana State Police, are procuring a technology called 'GrayKey' which can break into iPhones, including the iPhone X running the latest operating system iOS 11.
• Local police forces, including Miami-Dade County Police, have also indicated that they may have bought the equipment.
• Other forces, including the Indianapolis Metropolitan Police Department, have seemingly not bought GrayKey, but have received quotations from the company selling the technology, called Grayshift.
• Emails show the Secret Service is planning to buy at least half a dozen GrayKey boxes to unlock iPhones.
• The State Department has already bought the technology, and the Drug Enforcement Administration is interested in doing so.

See also: FBI Refuses to Say Whether It Bought iPhone Unlocking Tech 'GrayKey'

Also at Engadget and AppleInsider.

Related: U.S. Legislators Trying to Weaken Encryption Yet Again

Original Submission

An Anonymous Coward writes:

The Australian Government believes that it needs a golden key to backdoor encryption within Australia via legislation. The Brits and the Yanks have both already had a nudge at this and both have conceded that requiring a backdoor to encryption is not viable but this will not stop the Australian Liberal Party from trying.

Digital rights experts have described the proposal as "ludicrous" as Cyber security minister Angus Taylor stating that the legislation would be presented for public comment within the next quarter. While the Australian Government has not detailed how it expects to gain access to encrypted data, companies may be penalized if they don't kowtow to the new laws. There is nothing to be discussed here that hasn't been said before other than the Australian Government sincerely believes it can force companies to divulge encrypted data to authorities on demand.

Original Submission

Arthur T Knackerbracket has found the following story:

Australia's promised “not-a-backdoor” crypto-busting bill is out and the government has kept its word - it doesn't want a backdoor, just the keys to your front one.

The draft of The Assistance and Access Bill 2018 calls for anyone using or selling communications services in Australia will be subject to police orders for access to private data.

That includes all vendors of computers, phones, apps, social media and cloud services in the Lucky Country, and anyone within national borders using them. These data-tapping orders will be enforced with fines of up to AU$10m (US$7.3m) for companies or $50,000 ($36,368) for individuals

The draft legislation also wants five years in prison for anyone who reveals a data-slurping investigation is going on. And while there's no explicit encryption backdoor requirements in the 110 page draft bill, our first look suggests there doesn't need to be.

Original Submission

Submitted by chromas from IRC, as story from ZDNet:

"The governments of the United States, the United Kingdom, Canada, Australia, and New Zealand are committed to personal rights and privacy, and support the role of encryption in protecting those rights," began a document agreed to last week. Sounds good. But wait.

The government ministers who met on Australia's Gold Coast last week went on to explain that the information and communications technology vendors and service providers have a "mutual responsibility" to offer "further assistance" to law enforcement agencies.

"Governments should recognize that the nature of encryption is such that there will be situations where access to information is not possible, although such situations should be rare," it said. That's clearly setting an expectation for industry to meet.

The good news is that service providers who "voluntarily establish lawful access solutions" will have "freedom of choice" in how they do it. "Such solutions can be a constructive approach to current challenges," the document said, cheerily, before ending with a warning.

takyon writes:

The FBI used a suspect's face to unlock his iPhone in Ohio case

When Apple debuted Face ID with the iPhone X last year, it raised an interesting legal question: can you be compelled to unlock your phone by looking at it? In an apparent first, Forbes reports that the FBI got a suspect to unlock his phone during a raid in August.

In August, the FBI raided the home of Grant Michalski, looking for evidence that he had sent or received child pornography. They were armed with a search warrant [warning: this documentation contains explicit descriptions of sexual abuse] which allowed them to search Michalski's computer for evidence, and during the raid, agents recovered his iPhone X.

The agents who found the iPhone asked Michalski to unlock the device via Face ID, which he did. They "placed the [phone] into airplane mode and examined it by looking through the files and folders manually and documenting the findings with pictures."

The facial unlocking was voluntary (or so they claim), and the Columbus Police and FBI have devices capable of bypassing the phone's passcode protection. So much for security.

Also at AppleInsider.

Original Submission

An Anonymous Coward writes:

With the Australian Labor Party caving in on the proposed encryption law that will allow Australian police and agencies to access private data directly from vendors, the new proposed laws are now agreed in principle to introduce government level snooping of user messages and encrypted files. Agencies like ASIO or the Australian Federal Police will have the ability to request that telecommunications and tech companies help them with their investigations and compel companies to build ways to allow targeted access to encrypted communications data.

Previously: Australian Government Pursues "Golden Key" for Encryption
Five Eyes Governments Get Even Tougher on Encryption
Apple Speaks Out Against Australian Anti-Encryption Law; Police Advised Not to Trigger Face ID
Australia follows New Zealand to demand passwords
New Australian Push For Encryption Backdoor in Wake of Alleged Terrorist Plot

Original Submission

canopic jug writes:

In response to the news of what's going on in Australia, Derek Zimmer over at Private Internet Access' blog covers split key cryptography and why government back doors don't/won't/can't work. Attempts to regulate cryptography have been going on for a long while and each try has failed. He starts with recent history, the cold war, and follows through to the latest attempts to stifle encryption. These past failures give a foundation which can be applied to the current situation in hopes of understanding why cryptographers around the world are universally against these kinds of schemes.

The new proposal touted by the NSA, GCHQ, The Australian government and others is a simple evolution of Key Escrow. The proposal is key escrow with split-key cryptography, which is just key escrow with extra steps. There is still a "Golden Key" that can decrypt all messages from a particular service, but this time, two or more entities have pieces of that key. The concept, popularized by a Microsoft researcher, is said to solve the problem of abuse, because all parties have to agree to decrypt the messages.

Earlier on SN:
Australia Set to Pass Controversial Encryption Law
Apple Speaks Out Against Australian Anti-Encryption Law; Police Advised Not to Trigger Face ID
When's A Backdoor Not A Backdoor? When The Oz Government Says It Isn't
Australian Government Pursues "Golden Key" for Encryption
and more

Original Submission

takyon writes:

FBI: End-to-End Encryption Is an Infectious Problem

Just in case there were any lingering doubts about U.S. law enforcement's stance on end-to-end encryption, which prevents information from being read by anyone but its intended recipient, FBI executive assistant director Amy Hess told the Wall Street Journal this week that its use "is a problem that infects law enforcement and the intelligence community more and more so every day."

The quote was published in a piece about efforts from the UK, Australia and India to undermine end-to-end encryption. All three countries have passed or proposed legislation that compels tech companies to supply certain information to government agencies. The laws vary in their specifics, including restrictions on to what information law enforcement can request access, but the gist is that they don't want any data to be completely inaccessible.

Related: FBI Chief Calls for National Talk Over Encryption vs. Safety
FBI Failed to Access 7,000 Encrypted Mobile Devices
DOJ: Strong Encryption That We Don't Have Access to is "Unreasonable"
Five Eyes Governments Get Even Tougher on Encryption
Apple Speaks Out Against Australian Anti-Encryption Law; Police Advised Not to Trigger Face ID
Australia Set to Pass Controversial Encryption Law
Split Key Cryptography is Back... Again – Why Government Back Doors Don't Work

Original Submission