FBI Backed Off Apple In iPhone Cracking Case

Use Netsparker


So the big furore this week is because the FBI backed off Apple in the whole Apple vs the World privacy case regarding cracking the iPhone Passcode of the phone belonging to the San Bernardino gunman Syed Farook.

If you’re not familiar with the case, catch up with it here: FBI–Apple encryption dispute.

FBI Backed Off Apple In iPhone Cracking Case

The latest turn in this case is that the FBI have said basically a 3rd party has demonstrated them a way to unlock the phone without Apple building a specific iOS version with weaker password back-off algorithms (which is what they were proposing) to allow brute forcing.

The FBI has come to a sudden and surprising all-stop in its legal war with Apple.

Rather than compel the Cupertino giant to help it unlock an iPhone belonging to one of the San Bernardino killers, the Feds say they may be able to break into the handset without the company’s assistance after all.

In a filing [PDF] submitted late Monday in a central California federal court, the Feds asked for a crunch hearing due to take place on Tuesday be vacated and proceedings be suspended at least until next month. The court has granted the request.

The FBI will use that time to test an alternate method for unlocking the iPhone that will not involve, as it had originally sought, Apple building a specially crafted version of the iOS firmware.

That custom operating system, when installed on the phone during boot up, would allow agents to guess the passcode by brute force without the device wiping itself after too many wrong attempts.

Now, despite insisting repeatedly that Apple were the only ones on the planet who could help its investigation, the Feds may use someone else’s unlock method instead, apparently.

“On Sunday, March 20, 2016, an outside party demonstrated to the FBI a possible method for unlocking [San Bernardino gunman Syed] Farook’s iPhone,” the FBI said in its filing.

“Testing is required to determine whether it is a viable method that will not compromise data on Farook’s iPhone. If the method is viable, it should eliminate the need for the assistance from Apple Inc.”

Apple did not immediately respond to a request for comment.


It’s an interesting turn in the case, and a collective sigh of relief is being exhausted from the security community as NO ONE wanted to Apple to compromise their own security standards just because of an iPhone 5C which may or may not have any pertinent data on it.

We will have to wait a little longer to see what actually happens right now as the Feds have just put a pause on proceedings now, citing they need time to validate the attack vector provided by this mysterious 3rd party.

The FBI said in its filing that it would be able to provide a progress report on the unlocking efforts on April 5, at which point the case could proceed or it could be dropped.

The move will be seen as a win for Apple, which has for weeks been fighting, both in court and in the press, against claims by the US government that it should comply with the FBI and craft deliberately weakened software.

“The FBI always had the option of hacking the phone the expensive way, using forensic tools; they never needed Apple for this,” Holmes Wilson, cofounder of digital rights campaign group Fight for the Future, told The Register.

“What they wanted was a legal precedent that let them force any company to issue malicious updates. So if they’re saying ‘maybe there’s another way’ that means they’re walking away with their tail between their legs, hopefully for good.”

Apple boss Tim Cook and his attorneys have been the public face of Apple’s opposition in this legal showdown. However, thousands of supporters within Apple’s own ranks and at fellow tech giants including Google, Amazon and Microsoft, have been resisting what they see as a power grab that would have a chilling effect on privacy and security, should engineers be forced to compromise their own products at the behest of governments.

There’s an interesting analysis by iOS chap Jonathan Zdziarski here: My Take on FBI’s “Alternative” Method, although it is of course all speculation, it’s speculation from a fairly well informed standpoint.

So we shall see, as with anything USG related – we are extremely unlikely to get any details on what is actually happening or the methods used whichever way the case goes.

Source: The Register

Posted in: Apple, Legal Issues

, , ,


Latest Posts:


testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.
Four Year Old libSSH Bug Leaves Servers Wide Open Four Year Old libssh Bug Leaves Servers Wide Open
A fairly serious 4-year old libssh bug has left servers vulnerable to remote compromise, fortunately, the attack surface isn't that big as neither OpenSSH or the GitHub implementation are affected.
CHIPSEC - Platform Security Assessment Framework CHIPSEC – Platform Security Assessment Framework For Firmware Hacking
CHIPSEC is a platform security assessment framework for PCs including hardware, system firmware (BIOS/UEFI), and platform components for firmware hacking.
How To Recover When Your Website Got Hacked How To Recover When Your Website Got Hacked
The array of easily available Hacking Tools out there now is astounding, combined with self-propagating malware, people often come to me when their website got hacked and they don't know what to do, or even where to start.
HTTrack - Website Downloader Copier & Site Ripper Download HTTrack – Website Downloader Copier & Site Ripper Download
HTTrack is a free and easy-to-use offline browser utility which acts as a website downloader and a site ripper for copying websites and downloading them for offline viewing.
sshLooter - Script To Steal SSH Passwords sshLooter – Script To Steal SSH Passwords
sshLooter is a Python script using a PAM module to steal SSH passwords by logging the password and notifying the admin of the script via Telegram when a user logs in.


Comments are closed.