Apple under pressure to find flaw used by FBI to crack iPhone without them
Though its legal battle with the FBI came to an abrupt halt when the bureau independently gained access to the San Bernardino gunman’s iPhone, Apple is faced with a new challenge: Figuring out what security flaw the government exploited.
The US government said Monday that it was able to access data on a locked iPhone used by Syed Farook, one of the perpetrators of the San Bernardino terrorist attack, with the help of an independent third party. It therefore “no longer requires the assistance from Apple” that had been ordered by the courts, which the company had been ready to challenge all the way to the Supreme Court.
Authorities gave very few details on the method used to get past the smartphone’s security, and have refused to identify the third party who aided in cracking it open. Apple did not play a part in uncovering the solution, company officials said.
What’s known is that the FBI bypassed a feature on the iPhone that locks out trespassers and ultimately deletes phone content if they try too many passcode combinations, a law enforcement official told AP.
FBI Director James Comey said that once those features were beaten, the Bureau was able to crack the phone in 26 minutes.
One possibility is that the Bureau used a method that was pointed out by Representative Darrell Issa (R-California) at a hearing in early March. Issa mentioned that a tactic called "NAND-mirroring" might be able to beat the passcode, since it involves duplicating the contents of one phone onto another so that each copy can have the maximum allowed number of different passcodes attempted on them.
It’s unclear, however, if the FBI will glean anything useful related to the San Bernardino attacks from the information contained within the iPhone.
With the legal load off of its shoulders, Apple now faces the challenge of finding and patching the hole that the government used to gain access, so that criminals would not use it as well. The company uses internal security researchers to discover flaws by attempting to hack Apple products, but this operation is currently in flux. Many researchers have left the company over the last few months, and the manager responsible for the government’s data extraction requests went to work for a different part of the company.
Apple, one of the largest companies in the world, is one of the few tech giants that don’t set bounties for independent security researchers to find and report security flaws that could degrade the user experience. By contrast, Facebook said that it paid almost $1 million to hackers in 2015, and Google said that it has paid out over $6 million since launching its bug bounty program in 2010.
Though the current legal battle has come to an end, federal authorities said that there should still be a national discussion about balancing privacy and security.
“Our need for public safety and our need for privacy are crashing into each other, and we have to sort that out as a people,” Comey said recently, according to ABC. “This world some people imagine where nobody can look at your stuff is a world that will have public safety costs.”
