What do you think of Apple being forced to hack an iPhone?

_Howard wrote:

Apple has never said that what the FBI wants cannot be done.

Tim Cook wrote:

Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession.

The FBI may use different words to describe this tool, but make no mistake: Building a version of iOS that bypasses security in this way would undeniably create a backdoor.

iOS does not have this capability today. The FBI wants it built. Apple isn't saying that it can't be done, only that it would be too dangerous to do so.

_Howard wrote:

In order for the requested action to be done, there must be an existing back door.

Do you disagree with any of the above, and if so, why?

Because it does not exist today, and to do so would be too dangerous for this to be worth the specific, unconfirmed, hypothetical, hoped-for benefit the FBI seeks in the San Bernardino case.

richard09 wrote:

Perhaps Apple doesn't update automatically, but quite a bit of software does.

That's right, Apple OSes do not. It's too dangerous.

As I understand the FBI's request, they are asking for a custom version of the iOS which does not shut down the phone for repeated invalid password attempts, and does not erase the phone's contents if the attack continues.

How they plan to get this OS onto the phone in question is a bit of a mystery to me. Perhaps they have already cracked the master lock key and are looking to get into some inner encryption.

Perhaps like Howard they misunderstand that they cannot load a new OS without unlocking the phone.

The New York Times wrote:

WASHINGTON — The head of the F.B.I. acknowledged on Tuesday that his agency lost a chance to capture data from the iPhone used by one of the San Bernardino attackers when it ordered that his password to the online storage service iCloud be reset shortly after the rampage.

“There was a mistake made in the 24 hours after the attack,” James B. Comey Jr., the director of the F.B.I., told lawmakers at a hearing on the government’s attempt to force Apple to help “unlock” the iPhone.

F.B.I. personnel apparently believed that by resetting the iCloud password, they could get access to information stored on the iPhone. Instead, the change had the opposite effect — locking them out and eliminating other means of getting in.

So, the FBI has access to Farook's iCloud account.

According to what I read, a few days before the attack Farook quit backing up his phone to the cloud. The FBI is betting that he placed some incriminating evidence on his phone and intentionally kept it out of the cloud.

But you're right, Howard, the Apple fix of a new iOS would do no good to the FBI unless they had some way to access the phone and approve the iOS upgrade.

Without that -- and without some sort of back door to trigger the upgrade WITHOUT permission -- this whole debate is without merit.

Ars Technica wrote:

In the past, Apple has helped extract data from iPhones when issued with an appropriate warrant. Since iOS 8, however, full encryption has been enabled by default—a move that was seemingly introduced specifically to prevent such data-grabs by governments. "Unlike our competitors, Apple cannot bypass your passcode and therefore cannot access this data," the company wrote on its website at the time. "So it's not technically feasible for us to respond to government warrants for the extraction of this data from devices in their possession running iOS 8."

Now, however, Judge Sheri Pym has ordered Apple to introduce a backdoor to help the FBI unlock the iPhone—and, unsurprisingly, Tim Cook is not best pleased.

TheNew York Times wrote:

Apple has said that in many cases investigators have other means to gain access to crucial information, and in some instances it has turned over data stored in iCloud.

So the iCloud has a back door.  The phone does not.

The New York Times wrote:

F.B.I. officials say that encrypted data in Mr. Farook’s phone and its GPS system may hold vital clues about where he and his wife, Tashfeen Malik, traveled in the 18 minutes after the shootings, and about whom they might have contacted beforehand. While investigators believe that the couple was “inspired” by the Islamic State, they have not found evidence that they had contact with any extremists overseas.

In other words, they're fishing blindly.

Matt Apuzzo wrote:

Mr. Farook’s phone is protected by a password that Apple says it does not keep. It is encrypted with an algorithm the company says it cannot break. The F.B.I. wants to write a computer program to send the phone an unlimited combination of passwords until it finds one that works.

But Apple built its phones to protect against that tactic. Each wrong guess causes a short delay, which would significantly slow the F.B.I.’s effort. After too many incorrect guesses, the phone will automatically erase its memory.

When a new version of the OS is uploaded to your phone, there is an installer program uploaded along with it. What prevents the installer from running without user permission? Do you know? Is it possible for the installer to run without user interaction? Program updates from the app store can be automatically uploaded and installed without user involvement. Is there anything you know of that prevents the OS installer from running by itself?

When Apple added new security features to the phone, they would have needed to test them. The only way to test security is to try to break it. Quite frankly, I would be very surprised if Apple did not already have what the FBI wants, or something quite similar. I still don't want the FBI to get it, though.

NoCoPilot wrote:

richard09 wrote:

Perhaps Apple doesn't update automatically, but quite a bit of software does.

That's right, Apple OSes do not.  It's too dangerous.

What's "dangerous" about it? An army of killer iPhones on the loose?

_Howard wrote:

When a new version of the OS is uploaded to your phone, there is an installer program uploaded along with it. What prevents the installer from running without user permission?

First of all, the OS upgrade isn't "uploaded" to you, you have to physically go out and request a download.

Once downloaded, you have to physically initiate the upgrade. That involves giving your passcode.

Now, granted, somebody could hack into Apple and embed malware into an OS upgrade -- but that would be a pretty major breach.

_Howard wrote:

What's "dangerous" about it? An army of killer iPhones on the loose?

Not all users want all upgrades. For big corporations, sometimes they need to test compatibility before rolling out OS upgrades to all users (this is more true of Windows of course, which has a higher installed business base).

Secondly, the liability of installing software on a user's computer without her permission could be costly, if anything went wrong and data became unrecoverable.

Last, if the user does not approve the upgrade, and perform the upgrade, and see the upgrade happening, the sense of ownership of the computer would be diminished.

NoCoPilot wrote:

First of all, the OS upgrade isn't "uploaded" to you, you have to physically go out and request a download.

My iPhone and other devices have always had the new version uploaded to them. I have never requested an upgrade.

The question doesn't revolve around what Apple's published policies are or the normal manner in which updates are handled. The question is what is possible. And if it is possible for Apple to do what the FBI is asking, then there has to be an existing back door. Very simple.

And it's not like Apple hasn't used a back door in the past for their own malicious purposes.

I think the concern over cell phone security is way overblown.
What would happen to the average person if his or her phone was stolen?
It would be inconvenient and cost money to replace it, but that's about all.
If my phone was stolen, there's only one program on it that a thief might be interested in. It's for my credit union. If he was able to guess the ten-character user name and the ten-random-character password, he would then be able to deposit checks into my account. Boy, that would be terrible.

NoCoPilot wrote:

First of all, the OS upgrade isn't "uploaded" to you, you have to physically go out and request a download.

You might find this page on Apple Support Communities interesting.

_Howard wrote:

You might find this page on Apple Support Communities interesting.

News Flash: Ignorant User Is Confused.

Wow, what a scoop.

NoCoPilot wrote:

News Flash: Ignorant User Is Confused.

There are many places on the web where people are asking how to turn off the automatic uploads of OS updates. Do you think that they are all confused, or ignorant? As I said, my devices ALL get the OS updates uploaded to them. ALL of them. Should I type bigger? You don't seem to have caught that. Or do you think that I am imagining it?

If the device is connected to wi-fi and is plugged in to a charger, then Apple will push the update to the device. Ask Apple. Or read this article on osXDaily.
Of course, the author of that article may also be ignorant. Or suffering from Microsoft-induced dementia.

Interesting development in the case. I'm surprised it has taken so long for this to come up.

Quote :

"If they thought [the new approach] was plausible enough to pull off the case, I think it says they haven't tried everything," says Landau. "One can't try everything, of course — but have they tried a reasonable amount for what they expect to get off the phone? That's the question."

No guarantees that FBI hackers can break the security that the Chinese government hasn't.

Incidentally, the new iOS 9.3 came out this morning.  I was notified on my iPad that it was available, but I had to go looking for it on my iPhone.  In both cases, I navigated to the upgrade website and initiated the download.

According to a news item last night, it is a third party offering to open the phone, not the FBI.

And you are only assuming that the Chinese government is incapable of breaking the phone's security.

Yeah, if the Chinese want to read my grocery list and my ramblings on UD who am I to stop them?

NoCoPilot wrote:

Incidentally, the new iOS 9.3 came out this morning.  I was notified on my iPad that it was available, but I had to go looking for it on my iPhone.  In both cases, I navigated to the upgrade website and initiated the download.

How, exactly, did your iPad notify you that 9.3 was available? My iPad downloaded the update without asking me.

I got a popup.

You must have some "automatically update me" checkbox checked. I'd uncheck that if I were you.

The automatic update has always been disabled. That option does not apply to OS updates, just application programs.

Well maybe Apple just hates you then, for always badmouthing them.

What did your iPad's popup say? I get a popup telling me the new OS is available for installation and asks me if I want to install it now. I click on "Later." Then I get another popup offering to install it between 2 and 4 in the morning. I have to dismiss that one before I can continue. Nag. Nag. Nag.