The Indian Express (Delhi Edition)
That’s the way to do it
A Cambridge don shows the FBI how to save money on phone hacking
IN FEBRUARY the Federal Bureau of Investigation (FBI), America’s national police force, took Apple, a tech giant, to court. At issue was an iphone that had belonged to Syed Farook, a terrorist who, with his wife, had shot and killed 14 people in California the previous December. Farook was subsequently killed.
The FBI wanted Apple to write a special operating system to let it bypass the phone’s security and get at any data stored inside. Apple objected, on the ground that doing so would undermine the security of its own products and that, once created, such a digital “skeleton key” would pose a risk to every iphone in existence. The FBI, for its part, insisted there was no other way into the iphone in question.
Security experts were dubious about the bureau’s argument. A paper published by Sergei Skorobogatov, a computer scientist at Cambridge University, proves that they were right to be sceptical. Farook’s phone, it seems, could probably have been cracked in two days, using off-the-shelf electronics equipment, for less than $100.
The problem the FBI faced was that the phone was encrypted, as are all iphones. It was also locked with a PIN. Encryption meant the information stored in it was a mass of meaningless gibberish. To restore it to readability required that the phone be unlocked, by entering the PIN correctly. On the face of it, that is not a big obstacle. By default, such codes are four digits long, giving only 10,000 possible combinations. In principle, it is easy to try every combination until you hit the right one by chance.
But iphones also contain features designed to make such “brute-forcing” hard. After six wrong guesses a user must wait a minute before trying again. That delay rises rapidly with subsequent failures. And iphones can also be set to wipe themselves clean after ten failed attempts to log in.
At the time of the court case, therefore, several independent experts suggested the FBI try something called NAND mirroring (“NAND” refers to the type of memory used in smartphones). James Comey, the FBI’S boss, said that would not work. But it is exactly what Dr Skorobogatov has done. NAND mirroring makes a copy of a phone’s memory in its undisturbed state. Using an iphone of his own, Dr Skorobogatov was able repeatedly to overwrite its memory with the copy he had made before he began his guesses. This caused the instrument to forget that he had made any guesses at all, avoiding any temporary lockouts and ensuring that the data would never be wiped clean. That, in turn, permitted him to bruteforce the PIN six guesses at a time, resetting the phone to its original condition between each batch of guesses.
Each PIN must be entered by hand, which is laborious. Resetting the phone’s memory requires that the device be rebooted, which takes several seconds each time. An exhaustive check of all 10,000 variants of a 4-digit PIN would therefore take about 40 hours, he reckons, although on average the time to find the correct number
iphones have features designed to make brute-forcing hard. After six wrong guesses a user must wait a minute before trying again. That delay rises with more failures. The phones can be set to wipe themselves clean after 10 failed attempts
will be half as long.
Why, then, did the FBI believe going to court was the only way to recover Farook’s data? One suspicion at the time was that it did not. Instead, it wanted to set a broader legal precedent, forcing information-technology firms to help it when asked. On this view, the case was chosen because refusing would make Apple look bad.
In the event, the bureau pulled out just before an appeal was to be held. And it did, eventually, find a way into the phone. Reports suggest it paid an unknown cybersecurity company $1.3m to hack the phone. On the basis of Dr Skorobogatov’s evidence, it seems it overpaid by $1,299,900.