this post was submitted on 09 Nov 2024
979 points (98.5% liked)

Technology

59277 readers
4314 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
 

Apple quietly introduced code into iOS 18.1 which reboots the device if it has not been unlocked for a period of time, reverting it to a state which improves the security of iPhones overall and is making it harder for police to break into the devices, according to multiple iPhone security experts. 

On Thursday, 404 Media reported that law enforcement officials were freaking out that iPhones which had been stored for examination were mysteriously rebooting themselves. At the time the cause was unclear, with the officials only able to speculate why they were being locked out of the devices. Now a day later, the potential reason why is coming into view.

“Apple indeed added a feature called ‘inactivity reboot’ in iOS 18.1.,” Dr.-Ing. Jiska Classen, a research group leader at the Hasso Plattner Institute, tweeted after 404 Media published on Thursday along with screenshots that they presented as the relevant pieces of code.

top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 32 points 2 days ago

On one hand, Fuck Da Police

On the other hand, Fuck Apple

[–] [email protected] 11 points 1 day ago

Do two fucks make a right?

[–] [email protected] 101 points 2 days ago (11 children)

GrapheneOS been had this feature, don't let apple tell you they invented it.

[–] [email protected] 76 points 2 days ago (1 children)

Great software features should be available to all hardware, regardless of OS.

[–] [email protected] 47 points 2 days ago (3 children)

For sure I'm just joking about apple's habit of taking a feature that has been around for YEARS and claiming they "innovated" it, usually after they strip it down a little no less (like in this case where it appears to be a setting users can't access, but Graphene lets you turn it on/off or adjust the time between lock and reset.)

load more comments (3 replies)
[–] [email protected] 11 points 2 days ago

Android in general has it, not just you.

[–] [email protected] 28 points 2 days ago

IMHO, the novelty of the feature isn't what makes this headline worthy. This is noteworthy because of the scale. iOS is over a quarter of phones on earth, and in English speaking countries and Japan, you're looking at numbers that are often over 50%.

This will impact a LOT more investigations than Graphene, and I imagine Apple will be back in court fighting cops who want to remove privacy and security features. Hopefully this stuff stands up to the autocrats coming into power in the states.

[–] [email protected] 27 points 2 days ago

don't let apple tell you they invented it.

Why always the knee-jerk anti-apple reaction even if they do something good?

FYI: Apple isn’t telling anyone they invented this. In fact, they didn’t even tell anyone about this feature and declined to comment after it was discovered and people started asking questions.

load more comments (7 replies)
[–] [email protected] 318 points 3 days ago (34 children)

Law enforcement shouldn't be able to get into someone's mobile phone without a warrant anyway. All this change does is frustrate attempts by police to evade going through the proper legal procedures and abridging the rights of the accused.

[–] [email protected] 121 points 3 days ago

Yep! The police, being fascists, HATE this.

load more comments (33 replies)
[–] [email protected] 251 points 3 days ago

IT support everywhere sigh in satisfaction

[–] [email protected] 24 points 2 days ago (1 children)

I think this used to be possible with tasker, ironically though probably not anymore before of all Google's restrictions on Android. (maybe if you have root)

[–] [email protected] 11 points 2 days ago* (last edited 2 days ago) (3 children)

GrapheneOS periodically (once a day or so) forces me to put in the passcode. If this isn't a stock Android feature that's another reason to use Graphene. It also has a "lockdown" button in the power button menu that forces the same behaviour.

[–] [email protected] 9 points 2 days ago (1 children)

Pretty sure it's stock android, my phone does it every so often as well.

[–] [email protected] 3 points 1 day ago

Sho does, annoys the hell outta me when it happens but I'd never disable that feature

load more comments (2 replies)
[–] [email protected] 116 points 3 days ago (28 children)

GrapheneOS also has this. Not sure stock android includes it.

load more comments (28 replies)
[–] [email protected] 93 points 3 days ago (21 children)

There is no shortage of reasons to dislike Apple. This isn’t one of them.

load more comments (21 replies)
[–] [email protected] 71 points 3 days ago (18 children)

As a member of the intelligence community, I can almost guarantee that this is directed at the increased use of Cellebrite UFED hardware, specifically putting the device back into BFU mode, which removes cryptography-related memory allocations. This is also why you're asked for your password instead of face or fingerprint upon reboot.

load more comments (18 replies)
[–] [email protected] 33 points 2 days ago (7 children)

Wouldn't that disrupt the usage of a phone as a server?

[–] [email protected] 47 points 2 days ago

That's it!! Now I will NEVER use an iPhone as a server. 😋

load more comments (5 replies)
[–] [email protected] 48 points 3 days ago (7 children)

The way this article is framed sounds like bullshit to me. 18.1 was released less than 2 weeks ago. Any phone running this version of iOS would have had to already been in custody and somehow upgraded to this version, or otherwise brought into custody very recently—too recently for this to have already posed such a problem that law enforcement is “freaking out” and reporting it to the media.

load more comments (7 replies)
[–] [email protected] 32 points 2 days ago (12 children)

Meanwhile security-oriented Android forks: "You didn't do that?"

load more comments (12 replies)
[–] [email protected] 14 points 2 days ago (5 children)

Why does rebooting it improve the safety or security of the phone?

[–] [email protected] 73 points 2 days ago (6 children)

When you first boot up a device, most data on that device is encrypted. This is the Before First Unlock (BFU) state. In order to access any of that data, someone must enter the passcode. The Secure Enclave uses it to recreate the decryption keys that allow the device to access that encrypted data. Biometrics like Face ID and Touch ID won’t work: they can’t be used to recreate the encryption keys.

Once you unlock the device by entering the passcode the device generates the encryption keys and uses them to access the data. It keeps those keys in memory. If it didn’t, you’d have to enter your passcode over and over again in order to keep using your device. This is After First Unlock (AFU) state.

When you’re in AFU state and you lock your device, it doesn’t throw away the encryption keys. It just doesn’t permit you to access your device. This is when you can use biometrics to unlock it.

In some jurisdictions a judge can legally force someone to enter biometrics, but can’t force them give up their passcode. This legal distinction in the USA is that giving a passcode is “testimonial” because it requires giving over the contents of your mind, and forcing suspects to do that is not legal in the USA. Biometrics aren’t testimonial, and so someone can be forced to use them, similar to how arrested people are forced to give fingerprints.

Of course, in practical terms this is a meaningless distinction because both biometrics and a passcode can grant access to nearly all data on a device. So one interesting thing about BFU vs AFU is that BFU makes this legal hair-splitting moot: biometrics don’t work in BFU state.

But that’s not what the 404 Media articles are about. It’s more about the forensic tools that can sometimes extract data even from a locked device. A device in AFU state has lots of opportunities for attack compared to BFU. The encryption keys exist, some data is already decrypted in memory, the lightning port is active, it will connect to Wi-Fi networks, and so on. This constitutes a lot of attack surface that hackers could potentially exploit to pull data off the device. In BFU state, there’s very little data available and almost no attack surface. Automatically returning a device to BFU state improves resistance to hacking.

[–] [email protected] 1 points 11 hours ago (1 children)

Great explanation. That was super insightful.

So even with BFU, does the iPhone not connect to the internet? I guess i hadn’t noticed it doesn’t.

Also are you still about to track via gps an iPhone that is in the off state? Just curious if there’s a lot of other vectors where the iPhone is still connected?

[–] [email protected] 1 points 5 hours ago

So even with BFU, does the iPhone not connect to the internet? I guess i hadn’t noticed it doesn’t.

Well, it’s complicated. Most of these topics are. In BFU state, an iPhone (or iPad with cellular) with an active SIM and active data plan will connect to the Internet. It won’t connect to Wi-Fi at all. If you have USB restricted mode disabled and the right accessory connected it will connect to an Ethernet network, but that may fail if the network requires 802.1x and the credential is not available in BFU state. Similarly if USB restricted mode is disabled you can use tethering to a Mac to share its network.

For location, there’s two mechanisms. One mechanism relies on directly communicating with the device, which only works if the device has network.

The other mechanism is the “FindMy network” which uses a Bluetooth low energy (BTLE) beacon to let other nearby devices detect it, and they report that to FindMy. It’s a great technology. The way it uses rotating IDs preserves your privacy while still letting you locate your devices. I know that this works when a device is powered off but the battery is not completely dead. I’m not sure if it works in BFU state… my guess it that it does work. But this is not networking. It’s just a tiny Bluetooth signal broadcasting a rotating ID, so it’s one-way communication.

Other than that, I’m not as sure how things work. I believe Bluetooth is disabled by default in BFU state, but I suspect users can choose to re-enable Bluetooth in BFU state to connect to accessibility accessories. I’m not sure about the new emergency satellite communication.

But one thing I know for sure is that Apple has world class security engineers, and one area they work hard to secure is devices in BFU state.

[–] [email protected] 14 points 2 days ago (7 children)

Fun fact: in Australia we don't have a bill of rights of any kind, so the cops can just force you to reveal your passwords. The maximum penalty for refusing is 2 years imprisonment.

[–] [email protected] 1 points 1 day ago

Small comfort: they still can't physically force you like they can with biometrics.

load more comments (6 replies)
load more comments (4 replies)
[–] [email protected] 38 points 2 days ago (6 children)

Once rebooted, you need to enter your PIN to unlock the phone (and the SIM as well). Before that it is not possible to unlock the phone with biometric credentials (face ID or fingerprint).

As far as I'm aware, police can force you to hand over your biometric credentials (they can hold the phone to your face to unlock it when you have face ID enabled, or can move your finger to the fingerprint sensor). But they can't force you to reveal the PIN number.

[–] [email protected] 18 points 2 days ago (2 children)
[–] [email protected] 9 points 2 days ago

Yep: but they can't force you to give them the password because of 5th Amendment protections from self-incrimination.

And even if they did have the right to tell you to give them the password, they don't have access if you simply refuse to cooperate. They can get your fingerprints, face ID, or retina scan by force. They cannot extract information from your brain.

BTW: Lots if phones also have a "lockout mode" that can be enabled that will give you the option to lock it down to password-only without turning it off. It can be good for recording police interactions, because it will continue to record them while they can't access the contents of the phone if they swipe it from you.

load more comments (1 replies)
load more comments (5 replies)
load more comments (3 replies)
load more comments
view more: next ›