Opinion Pandora’s phone

Apple has left a physical security hole: A phone can boot a new operating system or ROM without permission.

The FBI wants Apple to make it easier to hack into the iPhone of Syed Farook, the organiser of December’s San Bernardino shooting, who has taken its passcode to the grave with him. Apple is right to challenge it, but the case has generated masses of speculation and disinformation, which must be pared away from the truth before one understands why. Security specialists are protesting that Apple has unlocked phones and extracted their contents for the government before, so why not now? Because Apple fortified the iPhone’s security in 2014. It now offers three barriers to hackers: It holds data encrypted, so all that Apple can extract from an unopened phone is gibberish, and besides, it repels brute force attacks to open the phone by introducing a delay between password inputs and by locking up after a number of failures.

But it appears that Apple has left a physical security hole: A phone can boot a new operating system or ROM without permission. Now, if Apple gives them a ROM with the code for security features commented out, the FBI can boot Farook’s phone, crack the password with a brute force attack by a supercomputer and decrypt its contents without the fear of being locked out. What’s the problem, if this helps to solve a terrorist incident? Security agencies have been protesting for years that computer firms want to sell electronic boxes which only the user can open. Farook’s iPhone is one such part of the thriving business of privacy.

Advertisement

The problem is that this is only revisiting the backdooring debate via a new route. Barack Obama has resisted demands for a law requiring manufacturers to build a back door into their electronic boxes which government agencies can amble in through to browse private data, but future presidents may buckle. India briefly engaged with this question when it sought access to Blackberry traffic in 2012. Since this is India, the end was quick and dirty. There is a difference between compromising security by a technical stratagem — a cheat which can be replicated endlessly — and seeking data from a specific device by court order. If Apple wrote an unsecured ROM for unlocking Farook’s phone, it could be used in future to unlock any phone. Worse, if it leaked into the wild or was stolen, the personal data of every iPhone user would be compromised. The consequences would be devastating.