Hacker News Reader

Comment by tpush | Hacker News Reader

"The suspect - identified by a hair found at the scene of the crime - refused to provide police with the PIN code to his phone so investigating officers turned to an unnamed cyber-forensics firm in Munich, which broke into the device."

Really interested in knowing how they got in (and what model of iPhone it was.)

View on HN

>Really interested in knowing how they got in (and what model of iPhone it was.)

Likely (but not necessarily) it was Cellebrite CAIS:

https://www.cyberscoop.com/cellebrite-iphone-6-ufed-samsung-...

The iPhone model in question was (allegedly) a 6s, a German article:

https://www.welt.de/vermischtes/article172287105/Mordprozess...

I thought I read an article linked from HN(which I can no longer find here or google) that vaguely stated they used a previously trusted device(PC) to gain access. That would mean the "yes, I trust this computer" notification has long term ramifications security-wise.

Or couldn't it have actually been just a backup on that computer that they were able to open up?

Especially since Apple claimed this was impossible in 2014.

https://www.google.com/amp/appleinsider.com/articles/14/09/1...

The forensics team may have been able to brute force the PIN, depending on the settings, if I'm reading this correctly:

https://arstechnica.com/gadgets/2016/03/there-are-ways-the-f...

(Please use direct links rather than amp links.)

Which again contradicts Apple's statement from 2014.

My link is also a direct link to a faster loading page. I tried to load the appleinsider.com page, and it hung for nearly ten seconds waiting for a response from the server before I gave up. It's not worth my time, and it's not worth the reader of my comment's time.

The main problem with a lot of these stories is that there are combinations of iPhone models, operating systems, and settings which are believed not to be breakable by general law enforcement agencies, and others which are known or strongly suspected to be.

Apple tends to make its claims regarding latest iPhone model combined with latest iOS version combined with particular settings.

Thus, for example, in the San Bernardino case, the fact that the phone in question was a 5C mattered. The 5C is not just an older phone, it has different security-oriented hardware inside, and that does change the security characteristics of the device.

Also, the Apple statement you keep pointing to said that Apple, as of iOS 8, is unable to retrieve or reconstruct the key used to encrypt the phone's storage. Which is true -- Apple cannot do that, and has designed things so that Apple cannot do that. What the FBI wanted in that case was not for Apple to supply a key or a passcode (which they don't have). What the FBI wanted was for Apple to create and sign and load a custom firmware which would disable anti-brute-force protection for the passcode, allowing the FBI to determine the passcode via brute force. Apple could do that, but refused to do so.

And for completeness' sake, that avenue is no longer available on more recent phones with more recent versions of iOS; performing an iOS update now requires the passcode, regardless of whether the update is initiated from the phone or from a connected device (even one previously designated as trusted).

Not if your PIN is 1234

Has there been a case of someone breaking into a modern Samsung phone? Knox "officially" passes some level of security standard, not sure how it holds up.

https://support.samsungknox.com/hc/en-us/articles/1150137331...

It makes sense that any security claim about something "impossible" from 4 years ago might now be possible. They may have been right in 2014.

Reply on news.ycombinator.com