SoylentNews

takyon [soylentnews.org] writes:

[ADD SECURITY TOPIC]

Apple has been ordered to assist in the unlocking of an iPhone belonging to one of the San Bernardino shooters [theregister.co.uk]. This may require updating the firmware to bypass restrictions on PIN unlock attempts:

Apple must assist the FBI in unlocking the passcode-protected encrypted iPhone belonging to one of the San Bernardino shooters in California. US magistrate Sheri Pym says Cupertino must supply software that prevents the phone from automatically annihilating its user data when too many password attempts have been made.

The smartphone belonged to Syed Farook, who with his wife Tashfeen Malik shot and killed 14 coworkers [cbsnews.com] on December 2. The couple died in a gun battle with police soon after. Cops have been unable to access Syed's iPhone 5C because they do not know the correct PIN, and will now gain the assistance of Apple, as ordered by Judge Pym [regmedia.co.uk] [PDF] on Tuesday.

iOS 8 and above encrypts data on devices [cryptographyengineering.com], requiring a four to six-digit PIN to unlock. After the first few wrong guesses, iOS waits a few minutes between accepting further PIN entry attempts, escalating to an hour's delay after the ninth failed login.

[...] Judge Pym wants Apple to come up with some magic software – perhaps a signed firmware update or something else loaded during boot-up – that will allow the FBI to safely brute-force the PIN entry without the device self-destructing. This code must only work on Farook's phone, identified by its serial numbers, and no other handset. The code must only be run on government or Apple property, and must not slow down the brute-forcing process.

Apple has five days to appeal or demonstrate that it cannot comply with the order. It is crucial to note that the central district court of California has not instructed Apple to crack its encryption – instead it wants Apple to provide a tool to effectively bypass the unlocking mechanism. "It's technically possible for Apple to hack a device's PIN, wipe, and other functions. Question is can they be legally forced to hack," said [twitter.com] iOS security expert Jonathan Ździarski.

Previously: FBI Unable to Decrypt California Terrorists' Cell Phone [soylentnews.org]

Original Submission