[Infowarrior] - FBI's hack into iPhone increases pressure on Apple security

[Richard Forno]

FBI's hack into iPhone increases pressure on Apple security

By: TAMI ABDOLLAH (AP), BRANDON BAILEY (AP)

http://bigstory.ap.org/article/83cc2309f8a4425588e4b6c37b076ffe/us-hacks-iphone-ends-legal-battle-questions-linger

WASHINGTON (AP) — The FBI's announcement that it mysteriously hacked into an iPhone is a public setback for Apple Inc., as consumers suddenly discover they can't keep their most personal information safe. Apple remains in the dark about how to restore the security of its flagship product.

The government said it was able to break into an iPhone used by a gunman in a mass shooting in California, but it didn't say how. That puzzled Apple software engineers — and outside experts — about how the FBI broke the digital locks on the phone without Apple's help. It also complicated Apple's job repairing flaws that jeopardize its software.

The Justice Department's announcement that it was dropping a legal fight to compel Apple to help it access the phone also took away any obvious legal avenues Apple might have used to learn how the FBI did it. The Justice Department declined through a spokesman to comment Tuesday.

It is a closely held secret how the FBI hacked the iPhone, but a few clues have emerged. A senior law enforcement official told The Associated Press that the FBI managed to defeat an Apple security feature that threatened to delete the phone's contents if the FBI failed to enter the correct passcode combination after 10 tries. That allowed the government to guess the correct passcode by trying random combinations until the software accepted the right one.

It wasn't clear how the FBI also bypassed a related Apple security feature that deliberately introduces increasing time delays in how frequently guesses can be entered. The official spoke on condition of anonymity because this person was not authorized to discuss the technique publicly.

The FBI hacked into the iPhone used by gunman Syed Farook, who died with his wife in a gun battle with police after they killed 14 people in December in San Bernardino, California. The iPhone, issued to Farook by his employer, the county health department, was found in a vehicle the day after the shooting; two personal phones were found destroyed completely so the FBI couldn't recover information from them.

The FBI was reviewing information from the iPhone, and it was unclear whether anything useful would be found.

Apple said in a statement late Monday that the legal case to force its cooperation "should never have been brought," and it promised to increase the security of its products. CEO Tim Cook has said the Cupertino-based company is constantly fending off security threats and trying to improve security.

The FBI's announcement — even without revealing precise details — that it had hacked the iPhone was directly at odds with the U.S. government's firm recommendations for nearly two decades that security researchers always work cooperatively and confidentially with software manufacturers before revealing that a product might be susceptible to hackers.

Those guidelines lay out a specific process about how and when to announce that commercial software might be vulnerable. The aim was to ensure that American consumers stay as safe online as possible and prevent premature disclosures that might damage a U.S. company or the economy.

As far back as 2002, the Homeland Security Department ran a working group — run by leading industry technology industry executives — to advise the U.S. president on how to keep confidential the discoveries by independent researchers that a company's software could be hacked until it was already fixed. Even now, the Commerce Department has been trying to fine-tune those rules to protect the digital economy. The next meeting of a conference on the subject is April 8 in Chicago, but it is unclear how the FBI's behavior in the current case might influence the government's fragile relationship with technology companies or researchers.

The industry's rules are not legally binding, but the government's top intelligence agency said in 2014 that such vulnerabilities should be reported to companies.

"When federal agencies discover a new vulnerability in commercial and open source software - a so-called 'zero day' vulnerability because the developers of the vulnerable software have had zero days to fix it - it is in the national interest to responsibly disclose the vulnerability rather than to hold it for an investigative or intelligence purpose," the Office of the Director of National Intelligence said in a statement in April 2014.

The statement recommended generally disclosing such flaws to manufacturers "unless there is a clear national security or law enforcement need."

The chief technologist at the Center for Democracy and Technology, Joseph Lorenzo Hall, said keeping details secret about a flaw affecting millions of iPhone users "is exactly opposite the disclosure practices of the security research community. The FBI and Apple have a common goal here: to keep people safe and secure. This is the FBI prioritizing an investigation over the interests of hundreds of millions of people worldwide."

--
It's better to burn out than fade away.