Apple could write code that checks the hardware ID supplied and sign only that version. It's been sufficient to prevent hacking so far and is the major protection relied upon until the latest generation, so I don't think this is an issue at all.
The issue is the precedent that is made. Once they create the special firmware, even if it is locked to one device, they have stated that law enforcement have already told them they have hundreds more devices they want unlocked. They would have a much easier time going to court and compelling Apple to resign the existing special firmware they made to work on these other hundreds of devices. Apple could no longer argue they had to create something to fulfill the warrant, since it was already created.
UDID lock is good enough for tying development builds to specific devices but is not an unbreakable guarantee the software cannot be run on another device.
No, I proposed 3 different ways of hacking the UDID in that comment. 1) disrupting the read of ECID in transit, 2) re-writing ECID by hacking the BPP, 3) a SHA1 hash collision. Any one of the 3 will do.
Even then you cannot "flash anything" to the phone. But you can flash a build signed by Apple which hard-codes a UDID check.
Wouldn't these mechanisms apply to key verification? How exactly can you argue that you can modify data in realtime inside the phone's architecture, but couldn't possibly modify data in realtime inside the phone's architecture?
Only certain parts of the hardware responsible for key storage and verification are architected to be resilient against physical and electronic attack, but the entire phone is not.
For example changing the WiFi or Bluetooth MAC is not locked down and effects the UDID. Because the UDID was never intended to be a way to bypass the device encryption it was not designed with anywhere near the same level of care and sophistication as handling the encryption key itself.
> For example changing the WiFi or Bluetooth MAC is not locked down and effects the UDID. Because the UDID was never intended to be a way to bypass the device encryption it was not designed with anywhere near the same level of care and sophistication as handling the encryption key itself.
I never suggested the UDID. Please don't ascribe a claim to me that was never made. SHA512 the serial and macs independently. Job done.
...and they give it to the FBI who then changes that ID as they please? Remove signing altogether? Its the fear of a blank check that drives this issue.
Taking the private key from Apple with a warrant, national security letter, subpoena, or other methods is much easier than creating a custom version of iOS.
It is foolish to assume that the FBI would stop at this special version of iOS, especially given how they have been arguing and fighting to break encryption for over two decades.
edit, on icebraining's interpretation:
That's exactly right - once the difficult part about targeting an individual phone is finished, it's easy to take the iOS signing key and target any device you want.
> Taking the private key from Apple with a warrant, national security letter, subpoena, or other methods is much easier than creating a custom version of iOS.
Clearly it is not, otherwise they would have done this. They did not.
I think it's meant taking the key used to signed that custom version of iOS. That is, if the FBI can force Apple to write the custom version, they can also coerce the key from them to sign their own copies, preventing your suggested blocking mechanism.
This is what I understood, at least, from the parent's post.
And can Apple guarantee that the ID can't be changed inside the device? If they can't it makes a lot of sense for Apple to refuse creating such a tool.
The ID can be easily changed. A quick Google search will easily confirm this.
The question is can you change one devices ID to exactly match another. This might require hacking the BPP or finding a SHA1 hash collision, both of which are absolutely possible but not necessarily trivial.
Pretty much, as far as I'm aware; the device ID cannot be changed. Bear in mind that this entire discussion is applicable only to older iPhones, in any case.
That guarantee until the latest generation was the only thing protecting the hardware. It has never been altered or hacked that I am aware of. Doing so would require modifying the physical construction of the chips on the device.
Possible? Maybe, but if it was that simple the FBI could simply change the signing key. It's not, and they can't.
