{"id":156495,"date":"2016-02-28T11:30:28","date_gmt":"2016-02-28T09:30:28","guid":{"rendered":"http:\/\/mybroadband.co.za\/news\/?p=156495"},"modified":"2016-02-28T10:04:45","modified_gmt":"2016-02-28T08:04:45","slug":"fbi-vs-apple-how-encryption-and-brute-force-attacks-work","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/156495-fbi-vs-apple-how-encryption-and-brute-force-attacks-work.html","title":{"rendered":"FBI vs Apple: how encryption and brute force attacks work"},"content":{"rendered":"<p>\u201cYou have nothing to fear if you have nothing to hide\u201d is an argument that is used often in the debate about surveillance.<\/p>\n<p>The latest incarnation of that debate is currently taking place in the case of the US government versus Apple.<\/p>\n<p>The concern that technology experts have is not whether you have anything to hide, but whom you might want to hide your information from.<\/p>\n<p>Last week a US court ordered Apple to <a href=\"http:\/\/mashable.com\/2016\/02\/16\/apple-hack-san-bernardino-phone-fbi\/#Hud2hLDhYkqx\">create a special tool<\/a> so the FBI could break a security feature on an iPhone 5c.<\/p>\n<p>The phone belonged to one of the shooters in an attack resulting in the deaths of 14 people in <a href=\"http:\/\/edition.cnn.com\/specials\/san-bernardino-shooting\">San Bernardino California<\/a> in December 2015.<\/p>\n<p>In this case, <a href=\"http:\/\/www.apple.com\/customer-letter\/\">Apple is fighting the ruling<\/a>.<\/p>\n<p>Apple CEO Tim Cook argues that this is a dangerous precedent, and it is not prudent to build a system with a hacking tool that can be used against Apple\u2019s very own system.<\/p>\n<p>Beyond those concerned with civil liberties, many in the <a href=\"https:\/\/freedom-to-tinker.com\/blog\/dwallach\/apple-the-fbi-and-the-san-bernadino-iphone\/\">security technology<\/a> field, including <a href=\"http:\/\/www.theguardian.com\/technology\/2016\/feb\/18\/google-whatsapp-snowden-back-apple-against-fbi\">Google and WhatsApp<\/a> and now <a href=\"http:\/\/www.wired.com\/2016\/02\/zuckerberg-supports-apple-in-fight-with-fbi-over-iphone-privacy\/\">Facebook<\/a>, are just as worried as Cook.<\/p>\n<p>This is because a hole in security is a dangerous thing, despite assurance that only the \u201cgood guys\u201d will use it. Once a system is compromised, the hole exists \u2013 or, in this case, the master tool that can make it exists.<\/p>\n<p>This means others may be able to steal and use such a tool, or copy it.<\/p>\n<p>But how likely is this to happen? If you create a key to unlock something, the question becomes how well you can hide the key?<\/p>\n<p>How hard would an adversary \u2013 either a state actor or a commercial competitor \u2013 try to acquire the key? We expect some would try very hard.<\/p>\n<p>As it is, cybercrime is a <a href=\"https:\/\/theconversation.com\/the-ongoing-war-against-cybercrime-38051\">non-trivial matter<\/a>. There is already a \u201cdark market\u201d among hackers and organised crime for unpatched security vulnerabilities.<\/p>\n<p>When one includes <a href=\"http:\/\/www.wired.com\/2016\/01\/nsa-hacker-chief-explains-how-to-keep-him-out-of-your-system\/\">government intelligence agencies<\/a>, it\u2019s a sector with a budget of hundreds of millions of dollars.<\/p>\n<p>It\u2019s likely that a vulnerability relating to Apple\u2019s security key used for providing auto-updates to all Apple iOS devices \u2013 including iPhones, iPods and iPads \u2013 would be among the most attractive targets.<\/p>\n<p>The risk to Apple in loss of reputation for an all-pervasive security and privacy flaw would be enormous.<\/p>\n<h3 class=\"my-4\">Secure brand<\/h3>\n<p>A brand is a kind of promise, and Apple\u2019s brand promises security and privacy.<\/p>\n<p>The FBI\u2019s push is not just about bypassing that security, it is a much more aggressive step. Such a step will hurt Apple\u2019s brand.<\/p>\n<p>The cynic could argue that Apple is doing this to ensure trust with customers and maintain profits, and that might well be the case.<\/p>\n<p>However, it should not detract from the very real security threat to all its customers.<\/p>\n<p>It also creates a secondary risk that international customers, such as those in Australia, may drop US companies&#8217; products in favour of products made in countries that do not force business to trade away customer privacy.<\/p>\n<p>Apple is reported as saying <a href=\"http:\/\/www.theguardian.com\/technology\/2016\/feb\/19\/apple-fbi-encryption-battle-san-bernardino-shooting-syed-farook-iphone\">no other country<\/a> in the world has asked it to do what the US Department of Justice has.<\/p>\n<p><a href=\"http:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2016\/02\/Apple-encryption.png\" rel=\"attachment wp-att-156497\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-156497 size-new-size\" src=\"http:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2016\/02\/Apple-encryption-640x803.png\" alt=\"Apple encryption\" width=\"640\" height=\"803\" srcset=\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2016\/02\/Apple-encryption-640x803.png 640w, https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2016\/02\/Apple-encryption-343x430.png 343w, https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2016\/02\/Apple-encryption.png 668w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/a><\/p>\n<p>There is also a bigger picture here. The FBI is trying to shift the frontier of how far governments can force businesses to bow to their will in the name of security.<\/p>\n<p>This is quite different from classic government regulation of companies for clean air or water, or to prevent financial chicanery.<\/p>\n<p>It is fundamentally about whether the government can or should compel a business to have to spend its own resources to actively break its own product, thus hurting its own customers and brand.<\/p>\n<p>And there are signs that some in the US government believe they should have this power.<\/p>\n<p>In a secret White House meeting late last year, the US National Security Council issued a \u201c<a href=\"http:\/\/www.bloomberg.com\/news\/articles\/2016-02-19\/secret-memo-details-u-s-s-broader-strategy-to-crack-phones\">decision memo<\/a>\u201d that included \u201cidentifying laws that may need to be changed\u201d in order to develop encryption workarounds.<\/p>\n<p>Even as the White House was claiming it <a href=\"http:\/\/www.nytimes.com\/2015\/10\/11\/us\/politics\/obama-wont-seek-access-to-encrypted-user-data.html\">wouldn\u2019t legislate backdoors in encryption<\/a>, it now seems there was another agenda being enacted that was not immediately visible.<\/p>\n<p>The Apple case may be part of a strategy to wedge any company that chooses to put its loyalty to its customers ahead of government dictates.<\/p>\n<p>Certainly the choice of this test case is interesting.<\/p>\n<h3 class=\"my-4\">Does the government even need to hack the phone?<\/h3>\n<p><a href=\"https:\/\/twitter.com\/snowden\/status\/700823383961792512\">Edward Snowden tweeted<\/a> a summary of facts about the specific case that appeared to undermine the legitimacy of the FBI\u2019s claim that breaking the iPhone is so necessary.<\/p>\n<p>Key revelations were that the FBI already has the suspect\u2019s communications records (as stored by the service provider).<\/p>\n<p>It also has backups of all the suspect\u2019s data until just six weeks before the crime.\u00a0And co-workers\u2019 phones provided records of any contact with the suspect, so it\u2019s possible to know the nature of the shooter\u2019s peer contacts.<\/p>\n<p>Further, he noted, there are <a href=\"https:\/\/www.benthamsgaze.org\/2016\/01\/19\/insecure-by-design-protocols-for-encrypted-phone-calls\/\">other means<\/a> of accessing the device without demanding Apple break its own product, despite what appears to be a sworn declaration by the FBI to the contrary.<\/p>\n<p><a href=\"http:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2016\/02\/Brute-force-attacks.png\" rel=\"attachment wp-att-156499\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-156499 size-new-size\" src=\"http:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2016\/02\/Brute-force-attacks-640x910.png\" alt=\"Brute force attacks\" width=\"640\" height=\"910\" srcset=\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2016\/02\/Brute-force-attacks-640x910.png 640w, https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2016\/02\/Brute-force-attacks-302x430.png 302w, https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2016\/02\/Brute-force-attacks.png 668w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/a><\/p>\n<p>Perhaps most surprising is that the phone in question was reported to be a government-issued work phone, not a <a href=\"https:\/\/twitter.com\/snowden\/status\/700823383961792512\">\u201ca secret terrorist\u201d device<\/a>. Such phones already require users to give monitoring permissions.<\/p>\n<p>In other words, there should be a long and fruitful digital trail without Apple\u2019s help.<\/p>\n<p>In fact, the hotly contested iPhone is not even the shooter\u2019s personal phone. The <a href=\"http:\/\/abcnews.go.com\/US\/san-bernardino-shooters-destroy-phones-hard-drives-sources\/story?id=35570286\">shooter<\/a> destroyed his personal phone and other digital media before he was killed in the police shoot-out.<\/p>\n<p>This highlights that giving up security and privacy on a mass scale may offer little return, as the \u201cvillains\u201d have <a href=\"https:\/\/theintercept.com\/2016\/02\/18\/passcodes-that-can-defeat-fbi-ios-backdoor\/\">many other ways<\/a> to hide their transactions.<\/p>\n<p>Therefore, for politicians who seek to <a href=\"http:\/\/www.theguardian.com\/us-news\/2016\/feb\/19\/donald-trump-apple-boycott-fbi-san-bernardino\">politicise this issue<\/a>, it might be important to understand the security risks and threats here before making pronouncements about the issue.<\/p>\n<p>There is certainly more at stake here than just political popularity.<\/p>\n<p><a href=\"http:\/\/theconversation.com\/profiles\/suelette-dreyfus-1102\">Suelette Dreyfus<\/a>, Lecturer, Department of Computing and Information Systems, <em><a href=\"http:\/\/theconversation.com\/institutions\/university-of-melbourne\">University of Melbourne<\/a><\/em> and <a href=\"http:\/\/theconversation.com\/profiles\/shanton-chang-135762\">Shanton Chang<\/a>, Associate Professor in Information Systems, <em><a href=\"http:\/\/theconversation.com\/institutions\/university-of-melbourne\">University of Melbourne<\/a><\/em><\/p>\n<p>This article was originally published on <a href=\"http:\/\/theconversation.com\">The Conversation<\/a>. Read the <a href=\"https:\/\/theconversation.com\/fbi-vs-apple-giving-up-security-and-privacy-could-hurt-us-all-55024\">original article<\/a>.<\/p>\n<h3 class=\"my-4\">More on Apple<\/h3>\n<p><strong><a href=\"http:\/\/mybroadband.co.za\/news\/smartphones\/155925-samsung-galaxy-s7-vs-apple-iphone-6s-battle-of-the-smartphone-giants.html\">Samsung Galaxy S7 vs Apple iPhone 6s \u2013 battle of the smartphone giants<\/a><\/strong><\/p>\n<p><strong><a href=\"http:\/\/mybroadband.co.za\/news\/security\/155713-twitter-supports-apple-in-privacy-fight.html\">Twitter supports Apple in privacy fight<\/a><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u201cYou have nothing to fear if you have nothing to hide\u201d is an argument that is used often in the debate about surveillance.<\/p>\n","protected":false},"author":340972,"featured_media":153501,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27,17934],"tags":[605,6298,2674,35],"class_list":["post-156495","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-smartphones","tag-apple","tag-encryption","tag-fbi","tag-headline"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/156495"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/340972"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=156495"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/156495\/revisions"}],"predecessor-version":[{"id":156501,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/156495\/revisions\/156501"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/153501"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=156495"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=156495"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=156495"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}