mjg59 | Freedom, the US Government, and why Apple are still bad

The US Government is attempting to force Apple to build a signed image that can be flashed onto an iPhone used by one of the San Bernardino shooters. To their credit, Apple have pushed back against this - there's an explanation of why doing so would be dangerous here. But what's noteworthy is that Apple are arguing that they shouldn't do this, not that they can't do this - Apple (and many other phone manufacturers) have designed their phones such that they can replace the firmware with anything they want.

In order to prevent unauthorised firmware being installed on a device, Apple (and most other vendors) verify that any firmware updates are signed with a trusted key. The FBI don't have access to Apple's firmware signing keys, and as a result they're unable to simply replace the software themselves. That's why they're asking Apple to build a new firmware image, sign it with their private key and provide it to the FBI.

But what do we mean by "unauthorised firmware"? In this case, it's "not authorised by Apple" - Apple can sign whatever they want, and your iPhone will happily accept that update. As owner of the device, there's no way for you to reconfigure it such that it will accept your updates. And, perhaps worse, there's no way to reconfigure it such that it will reject Apple's.

I've previously written about how it's possible to reconfigure a subset of Android devices so that they trust your images and nobody else's. Any attempt to update the phone using the Google-provided image will fail - instead, they must be re-signed using the keys that were installed in the device. No matter what legal mechanisms were used against them, Google would be unable to produce a signed firmware image that could be installed on the device without your consent. The mechanism I proposed is complicated and annoying, but this could be integrated into the standard vendor update process such that you simply type a password to unlock a key for re-signing.

Why's this important? Sure, in this case the government is attempting to obtain the contents of a phone that belonged to an actual terrorist. But not all cases governments bring will be as legitimate, and not all manufacturers are Apple. Governments will request that manufacturers build new firmware that allows them to monitor the behaviour of activists. They'll attempt to obtain signing keys and use them directly to build backdoors that let them obtain messages sent to journalists. They'll be able to reflash phones to plant evidence to discredit opposition politicians.

We can't rely on Apple to fight every case - if it becomes politically or financially expedient for them to do so, they may well change their policy. And we can't rely on the US government only seeking to obtain this kind of backdoor in clear-cut cases - there's a risk that these techniques will be used against innocent people. The only way for Apple (and all other phone manufacturers) to protect users is to allow users to remove Apple's validation keys and substitute their own. If Apple genuinely value user privacy over Apple's control of a device, it shouldn't be a difficult decision to make.

Flat | Top-Level Comments Only

Apple screwed up here. An update of the firmware should wipe the
device, i.e., wipe the old secret key.

For a legitimate use case, the backup-update-restore cycles is
inconvenient, but I doubt it needs to happen often.

Making firmware updates difficult makes it less likely that people will install security updates, which is a different kind of irresponsibility.

_Firmware_ updates, specifically those having to do with the secure
enclave. OS updates and application updates don't need to wipe
anything. Firmware updates really shouldn't be that often.

Or, for less trouble, they could either (1) require both an Apple
signature and the current key, or (2) just the Apple signature and
do the wipe.

OS updates are firmware updates on embedded devices, but maybe there's an argument for wiping information when installing new firmware on certain components. But that only protects you against the specific kind of attack that's currently being argued about - you really want to be able to prevent backdoored upgrades that don't modify ancillary firmware as well.

You're just assuming that the Secure Enclave doesn't have security holes that need fast fixing (which means OTA, without a backup/wipe/restore cycle).

The Secure Enclave may not support OTA. Yes, it assumes that there's no bugs that need to be fixed overnight but that's a reasonable assumption. This kind of hardware has been widely used for years now, although not in phones, so it's in general well tested and understood. It may be a completely reasonable design decision to take the risk of having to support backup/erase/restore cycle in case of bugs.

The phone in question does not have a secure enclave. Newer phones do, but the firmware is as you suggest (and as best I am aware) updatable without wiping the keys.

However wiping the keys entirely is not necessary nor practical, it would be just as easy to make the firmware update process require the secure enclave to be unlocked with the key first. That would prevent an "authorised" backdoor reflash in this situation.

It's also possible this is already required, we are not sure as Apple do not speak quite as detailed about the secure enclave update process as the rest of the processes in their iOS security guide.

However as before, it is not relevant to this case as the 5C does not contain a secure enclave.

Freedom, the US Government, and why Apple are still bad

Firmware updates

Re: Firmware updates

Re: Firmware updates

Re: Firmware updates

Re: Firmware updates

Re: Firmware updates

Re: Firmware updates