Message #170232

[Kiwithrottlejockey]

from The Washington Post....

Apple is working to make iPhones even tougher to hack into

By ELLEN NAKASHIMA and TODD C. FRANKEL | 9:15PM - Wednesday, February 24, 2016


Photograph: David Paul Morris/Bloomberg.

FEARING that the government may be able to order it to bypass security features in newer-model phones, Apple has quietly begun working on enhancements that would prevent the company from updating the software of an iPhone without knowing a user's password, according to individuals familiar with the effort.

These security improvements would make it impossible for Apple to help the government unlock newer iPhones in the manner authorities want the company to do so now. The move would force those authorities to find a new technical solution even if they gain the legal authority to force the company to unlock the phones of suspects.

The move by Apple is another twist in a high-profile battle between Apple and the Justice Department which last week demanded that the company help unlock the iPhone of Syed Rizwan Farook, one of the killers in the San Bernardino, California shooting rampage.

The enhancement will not work on older model phones, such as the iPhone 5C used by Farook. But engineers are trying to address the issue on newer models, which have a security feature called Secure Enclave that protects some of the most sensitive data such as the phone's encryption keys. Currently, the software on the Secure Enclave can be updated without knowing a user's password.

That, Apple engineers realized, was a vulnerability. Those engineers began thinking about addressing the issue before the San Bernardino attacks, but the fix became a priority more recently, said the individuals familiar with the effort, which was first reported by The New York Times.

An Apple spokesman had no comment.

Security experts hailed Apple's move, saying that the phones will become more secure to a universe of threats, including hackers or even insiders who might leak secrets.

“They've never thought before that they might be forced by the government to break into its own products and reverse security procedures,” said Jonathan Zdziarski, a security researcher who has himself proposed about a dozen solutions to the problem to Apple. “Now that they've been forced into this mode of thinking, a lot of the security updates in the future will be not just to keep the hackers out, but to keep themselves out until the user authorizes the update.”

News of the attempted technical fix broke on the same day Apple chief executive Tim Cook defended his company's controversial refusal to help the FBI access the passcode-locked iPhone belonging Farook.

Cook said that helping the FBI to bypass the iPhone's security “could expose people to incredible vulnerabilities”. “This would be bad for America,” Cook said during an interview on ABC's World News Tonight With David Muir.  “It would also set a precedent that I believe many people in America would be offended by.”

This was Cook's first public interview since a federal magistrate judge in Riverside, California, last week ordered Apple to develop a way to access Farook's iPhone. Cook had previously written a public letter objecting to the court order. That touched off a heated national debate over questions about technology and surveillance. Cook had also sent an email to Apple employees making his case.

Cook said Apple tried to help the FBI with other technological solutions, offering “significant advice” on how the iPhone might be cracked. But Apple does not want to go as far as the FBI says it now needs — writing software to get around the phone's security measures. Cook called it “the software equivalent of cancer”.

“What is at stake here is can the government compel Apple to write software that we believe would make hundreds of millions of customers vulnerable around the world, including the U.S., and also trample civil liberties,” Cook said.

Cook said this case was about the future, rather than this one particular iPhone.

FBI Director James B. Comey, in a letter published on Sunday, wrote that this case highlights the tension between privacy and safety.

“That tension should not be resolved by corporations that sell stuff for a living,” Comey wrote.

Cook, in his interview, insisted that obeying by this one court order means opening hundreds of other Apple devices that law enforcement wants access to, as well.

“It is a slippery slope. I don't fear one — it is one,” Cook said.

Asked by Muir if Cook ever has any doubts that opening this iPhone might help prevent a terrorist attack.

“David, some things are hard and some things are right. And some things are both,” Cook said. “And this is one of those things.”

• Ellen Nakashima is a national security reporter for The Washington Post. She focuses on issues relating to intelligence, technology and civil liberties.

• Todd C. Frankel is a reporter covering people and policy for The Washington Post.

https://www.washingtonpost.com/news/the-switch/wp/2016/02/24/apple-is-working-to-make-iphones-even-tougher-to-hack-into