FBI Unlocks iPhone

As you probably have already heard, the FBI sued Apple because Apple refused its demand to unlock an iPhone 5C belonging to the San Bernardino terrorists. But what is new and shocking is that Apple withdrew its suit because they figured out how to unlock the phone themselves.  

In the past law enforcement and intelligence agencies around the world routinely sent captured phones to Apple and Google’s headquarters where the phones were unlocked. At that time Apple and Google kept a serial number that was shipped with the phone. This number together with the passcode created by the user created an unbreakable encrypted value. Calculate that and you could unlock a locked phone perhaps by plugging in a cable. But then Apple changed the iPhone, as did Google, where they no longer kept a copy of that value. They did that because customers and privacy activists demanded that after the Edward Snowden leaks. Then the manufacturers said they could not assist the police and spies anymore as it was technically impossible because they had got rid of that back door.

What makes the Apple iPhone particularly hard to unlock is two things. First, if you try to unlock it too many times by guessing the passcode, the phone will ease its data. Second, a brute force attack will not work because the phone is designed to go progressively slower each time that someone tries to guess the password. A brute force attack would have taken years.

It is obvious to anyone who follows this type of news that a professional hacking firm approached the FBI and offered to sell the secret to them of how to unlock the phone. Hacking companies like these can charge up to $1 million for this kind of secret.  hey sell such secrets to governments. And then no one talks about it. Because if they did talk about it the secret would get out. Then Apple would change its software, and then the intelligence or law enforcement agency would not long be able to unlock the phone. One thing that the Edward Snowden revelations revealed is the the spy agencies keeps lots of secrets about flaws in Microsoft Windows and other products but does not tell the companies.

But now we know who unlocked the phone. It was an Israeli company, CyberArk. They will not confirm it and neither will the FBI. But CNN said that the FBI signed a $200,000 contract with CyberArk contract on the day that the FBI unlocked the firm and unlocking phones is what they do. The company's stock price surged on that news.

CNN interviewed an Israeli security expert who is not associated with Cyberark. Asked how he would unlock the phone he said he would plug in a USB cable and then play with the transmission protocols. Now other law enforcement in the USA wants the FBI’s help. Already the FBI has agreed to assist with a murder case.  

All of this is highly embarrassing for Apple who said its phone could not be unlocked. No one but the security firm and the FBI knows how the hack works. But what we do know is that the Israelis did not discover any mathematics that would untangle encryption as that is based on a 2,000 year old unsolved math problem of determining whether a number is prime. Had they solved that they would not have been able to hide that news as the greatest minds in history have tried but failed to do that. Instead they probably made a copy of the storage card so they they would not accidently erase the device then fiddled with it. Then they might have used some of the equipment that cellular repair shops use to probe the electronics on the device and found a weakness there. Or they could have found a way in through the cable as the Israeli expert suggested. In other words the went around the encryption. The encryption algorithms work, but it's their implementation where people make mistakes.

There is another way for the FBI to get at data on a criminal or terrorist iPhone. If they are a dumb criminal and forget to turn off syncing then that data can be obtained on the iCloud.

While the government has withdrawn its case the issue is not settled. They will sue again. The previous court order had come from Federal District Court for the District of Central California. From there Apple could have appealed to a federal appeals court and then the US Supreme Court.  If they lost or the court refused to take up the issue the court would have set a precedent thus creating a new law. That is how the American legal system works.

The tech industry opposed what the FBI wanted to do. Politicians on the Intelligence Committee of the Senate said it was necessary. One thing one wonders about is how all of this made the news. In the past, before Edward Snowden, the government ordered these companies not to tell anyone when they had been served a secret warrant from the secret intelligence court under penalty of jail. So some Apple executive must be credited with being bold by risking his own neck by making the matter public.

While all of this unfolded in the USA its implications are international as law enforcement and intelligence agencies around the world send captured phones to Apple to be unlocked because Apple must follow the law in the countries where they operate. Now Apple will look at the phone and try to figure out what weakness it has themselves. Of course one possibility is they could never figure it out.  Another possibility is someone else will find another flaw. Perhaps they already have and are waiting to use it or sell it.

▼ Show Discussion