Apple Finally Shuts Down Security Flaw Used By Phone-Cracking Vendor

(Mis)Uses of Technology

from the indiscriminate-protection dept

In a move that will anger law enforcement (but really isn’t about law enforcement), Apple has succeeded in killing an exploit that allowed a third-party vendor to crack iPhones for investigators. A few months ago, Apple announced it was fixing the flaw that allowed products like GrayKey to bypass built-in security features to engage in brute force password guessing. Thomas Brewster of Forbes confirms the fix is finally in.

Multiple sources familiar with the GrayKey tech tell Forbes the device can no longer break the passcodes of any iPhone running iOS 12 or above. On those devices, GrayKey can only do what’s called a “partial extraction,” sources from the forensic community said. That means police using the tool can only draw out unencrypted files and some metadata, such as file sizes and folder structures.

Some in law enforcement may view this as confirmation of their “going dark” complaints and claim that Apple cares more about its customers than it does about fighting crime. As if that was bad thing. Apple should care more about what its customers want and need than government access to locked devices. A security hole is a hole that can be used by everyone who can exploit it. There’s no way to prevent a flaw from being exploited by criminals even if law enforcement agencies find the exploit super-useful.

Grayshift’s products are still somewhat useful, but it’s going to be hard to justify a premium price for a stunted service. This new development might be Grayshift’s fault. Soon after Apple announced one fix for an exploit used by Grayshift, the company bragged it could still crack phones just as easily. This appears to have prompted closer examination of the problem Apple thought it fixed with the first round of patching. The second pass has blunted the exploit’s usefulness, even if it hasn’t made it completely impossible to access some data contained in locked devices.

Even with the fix in play, law enforcement complaints about “darkness” are overblown. There are other technical solutions available, along with a wealth on information stored by third parties and cloud services. The more technical solutions won’t scale, but that’s not really something law enforcement should complain about. Security protections for phone owners shouldn’t be viewed as weapons deployed against law enforcement. Phone manufacturers have an obligation to their customers to protect their personal data, and encryption is just one of the tools deployed to keep customers’ information out of the hands of others. That some of the “others” are cops and investigators is just a side effect of providing solid products and service.

This won’t make government critics of Apple any happier, though. And its closing of security holes is just going to lead to more demands for anti-encryption laws. Very few legislators seem interested in mandating backdoors, so these complaints aren’t gaining any traction. But government agencies like the FBI have endless time and infinite resources, so the calls for backdoors will never completely cease — not as long as there’s a chance a major tragedy might prompt reckless Congressional action.

Apple’s protection of its users is great, but its sincerity should be questioned when it’s willing to put Chinese users’ data where the Chinese government can easily access it. If it wants to be a champion for its customers, it needs to protect all of them, not just the ones it’s currently convenient to protect. When you’ve got to explain why you’re “locking out” US law enforcement but letting a foreign government walk in the front door, you’re doing customer service wrong.

Filed Under: backdoors, cracks, encryption, graykey, iphone, law enforcement
Companies: apple, grayshift