Court Order to Apple to Unlock San Bernardino iPhone May Unlock Hackers

A judge’s order that Apple cooperate with federal authorities in the San Bernardino bombing investigation may have serious unintended consequences. There are no easy answers. Once more, a broad dialog is required.

Scales of Justice Previously I opined about how a dialog should occur between policy makers and the technical community over encryption. The debate has moved on. Now, the New York Times reports that federal magistrate judge Sheri Pym has ordered Apple to facilitate access to the iPhone of Syed Rizwan Farook, one of the San Bernardino bombers. The Electronic Frontier Foundation is joining Apple in fight against the order.

The San Bernardino fight raises both technical and policy questions.

Can Apple retrieve data off the phone?

Apparently not. According to the order, Apple is required to install an operating system that would allow FBI technicians to make as many password attempts as they can without the device delaying them or otherwise deleting any information. iPhones have the capability of deleting all personal information after a certain number of authentication failures.

You may ask: why doesn’t the judge just order Apple to create an operating system that doesn’t require a password? According to Apple, the password used to access the device is itself a key encrypting key (KEK) that is used to gain access to decrypt the key that itself then decrypts stored information. Thus, bypassing the password check doesn’t get you any of the data. Thus, the FBI needs the password.

What Apple can do is install a new operating system without the permission of the owner. There are good reasons for them to have this ability. For one, it is possible that a previous installation failed or that the copy of the operating system stored on a phone has been corrupted in some way. If technicians couldn’t install a new version, then the phone itself would become useless. This actually happened to me, personally, as it happens.

The FBI can’t build such a version of the operating system on their own. As is best practice, iPhones validate that all operating systems are properly digitally signed by Apple. Only Apple has the keys necessary to sign imagines.

With a new version of software on the iPhone 5c, FBI technicians would be able to effect a brute force attack, trying all passwords, until they found the right one. This won’t be effective on later model iPhones because their hardware slows down queries, as detailed in this blog.

Would such a capability amount to malware?

Kevin S. Bankston, director of New Americas Open Technology Institute has claimed that the court is asking Apple to create malware for the FBI to use on Mr. Farook’s device. There’s no single clean definition of malware, but a good test as to whether the O/S the FBI is asking for is in fact malware is this: if this special copy of the O/S leaked from the FBI, could “bad guys” (for some value of “bad guys”) also use the software against the “good guys” (for some value of “good guys”)? Apple has the ability to write into the O/S a check to determine the serial number of the device. It would not be possible for bad guys to modify that number without invalidating the signature the phone would check before loading. Thus, by this definition, the software would not amount to malware. But I wouldn’t call it goodware, either.

Is a back door capability desirable?

Unfortunately, here there are no easy answers, but trade-offs. On the one hand, one must agree that the FBI’s investigation is impeded by the lack of access to Mr. Farook’s iPhone, and as other articles show, this case is neither the first, nor will it be the last, of its kind. As a result, agents may not be able to trace leads to other possible co-conspirators. A Berkman Center study claims that law enforcement has sufficient access to metadata to determine those links, and there’s some reason to believe that. When someone sends an email, email servers between the sender and recipient keep a log that a message was sent from one person to another. A record of phone calls is kept by the phone company. But does Apple keep a record of FaceTime calls? Why would they if it meant a constant administrative burden, not to mention additional liability and embarrassment, when (not if) they suffer a breach? More to the point, having access to the content on the phone provides investigators clues as to what metadata to look for, based on what applications were installed and used on the phone.

If Apple had the capability to access Mr. Farook’s iPhone, the question would then turn to how it would be overseen. The rules about how companies handle customer data vary from one jurisdiction to another. In Europe, the Data Privacy Directive is quite explicit, for instance. The rules are looser in the United States. Many are worried that if U.S. authorities have access to data, so will other countries, such as China or Russia. Those worries are not unfounded: a technical capability knows nothing of politics. Businesses fear that if they accede to U.S. demands, they must also accede to others if they wish to sell products and services in those countries. This means that there’s billions of dollars at stake. Worse, other countries may demand more intrusive mechanisms. As bad as that is, and it’s very bad, there is worse.

The Scary Part

If governments start ordering Apple to insert or create malware, what other technology will also come under these rules? It is plain as day that any rules that apply to Apple iPhones would also apply to Android-based cell phones. But what about other devices, such as televisions? How about Refrigerators? Cars? Home security systems? Baby monitoring devices? Children’s Toys? And this is where it gets really scary. Apple has one of the most competent security organizations in the world. They probably understand device protection better than most government clandestine agencies. The same cannot be said for other device manufacturers. If governments require these other manufacturers to provide back door access to them, it would be tantamount to handing the keys to all our home to criminals.

To limit this sort of damage, there needs to be a broad consensus as to what sorts of devices governments should be able to access, under what circumstances that access should happen, and how that access will be overseen to avert abuse. This is not an easy conversation. That’s the conversation Apple CEO Tim Cook is seeking. I agree.

Cryptowars continued: Harvard paper gives us a state of the net (and it’s not all good)

Cybercrime In November, I opined that a nuanced approach was needed when addressing encryption. I wrote that there are different forms of cryptographic protection, and that each side on this issue needs to consult and not confront one another. Last month, Harvard University’s Berkman Center for Internet and Security released a white paper that attempts to address many of the issues I and others raised. Entitled, Don’t Panic: Making Progress on the “Going Dark” Debate, the the paper points out that governments have many avenues to access unencrypted information. They also have access to so-called “metadata”, and they claim that because of this, the Internet hasn’t really gone dark.

They’re right. For now.

Many of the points the authors made addressed the state of the Internet as they saw it in January of 2016. That is- Google has had difficulty encrypting platforms, Apple has backup recovery keys that governments can subpoena, and the security of the Internet of Things is nothing short of a crying shame, that governments can take advantage of. All three of those points may well change over time. Apple could easily move to a system (if they have not already done so) where recovery keys themselves are encrypted in information that only the owner of a device has, be that a password or one of those questions like, “What was your first pet?” If Apple can accomplish such a feat, the only matter that would hold Google up is lining up those that actually sell their devices to support whatever system they put in place.

Even metadata is likely to dry up. Efforts such as the IETF’s DPRIVE working group attempt to keep private queries your computer makes to convert domain names like ofcourseimright.com to IP addresses that the network understands. At the same time, those who really want to hide are able to do so through ToR networks.

Even the security of Things on the Internet is likely to improve over time, albeit slowly. That will require a concerted effort between Thing manufacturers, network vendors, service providers, and users.

And so the question: do policy makers need to actually do anything today to insure access to law enforcement officials? My answer is a firm not yet. That’s very good news because it gives us time to have the dialog necessary to deal with the many facets of this issue. However, all sides still have come to terms with each other.

Happy Birthday, IETF

There’s a small group that hosts meetings three times per year, and works mostly via email that you’ve probably not heard of. They’re called the Internet Engineering Task Force or IETF. The women and men who participate in the IETF create standards by which computers communicate with one another. You’re reading this note thanks to several of those standards. They are collected in documents known as Requests for Comments or RFCs that are available for anyone to read. In fact, you can write your own if you want.

The IETF became important to me at a time when we were just learning how to manage congestion (more demand than there is bandwidth). It stayed important when we needed more efficient routing protocols. Through internationalization efforts at the IETF, the Internet grew from a U.S. government network to a worldwide network of networks that supports people speaking just about any language.

Last week marked the IETF’s 30th birthday. To the thousands of people who have participated over those thirty years, especially to those who aren’t with us today, I want to say this: Thank you. Thank you to those who have worked to make TCP/IP-based networking suitable for the way we live, work, and play. Thanks to the people who have done their level best to see that our protocols are safe and secure. Thanks to those who shared their innovations, so that the best ideas are available for all to use. Thanks to those who devoted their lives to handling all the administrative aspects of the organization.

So now you know who the IETF is. You too can participate, as can anyone. For more information, just go to www.ietf.org and join the party and celebrate with us this anniversary, and the ones in the future.

U.N. renews IGF and World Summit for the Information Society

For those who haven’t been following the party, the United Nations has had an effort for the last decade called the World Summit on the Information Society (WSIS). This ongoing activity was up for renewal this year. While the Internet technology provides us so much, many we face many challenges. They include access to the technology, security, and human rights. WSIS addresses itself to these challenges. The UNGA decided to continue this effort for another 10 years. As part of this renewal process, the mandate of the Internet Governance Forum (IGF) was extended for another 10 years as well. At the same time, the UNGA is taking a conservative approach toward government involvement by not trying to supplant the enormous efforts of those who do the work today.

As a community, we could have done a lot worse. ISOC president Kathy Brown and her team, Ambassador Daniel Sepulveda, Marian Gordon, Chip Sharp, Chris Fair, Dominique Lazanski, Avri Doria, Bill Drake, Chris Buckridge, George Sadowsky Veni Markovski, Vint Cerf, Robert Pepper, and many others who were in the room are to be congratulated for their hard work, not only in the room, but beyond. I personally am very impressed with ISOC’s outreach effort in region, and how that has impacted these sorts of discussions.

Within the industry we need to recognize that women are the exception to the rule at the edge of the technology development cycle. I want much better for my daughter. Also, as we head toward over 50 billion devices being connected, the Internet of Things must be secured. The architecture needs lots more work to do that. Today many endpoint devices do not have well bound names, even. At the same time, the quality of code needs to improve, which is a particular challenge in many places. Human rights is another area on which we are only just scratching the surface. And yes, we must continue to struggle engage all stakeholders, including governments. The IGF itself really needs work. It needs funding, and we need to find a way to meet the challenge set by the UNGA in terms of identifying positive outcomes.

Yes, we all truly have a lot to do, and yet these challenges present many opportunities for innovation at many levels. I’m excited to be working in this space now.

Holiday Shoppers: Don’t Get Phished!

Don’t get phished this holiday season. Here are some common sense reminders.

As we enter the holiday season, if you order online, fraudsters will be targeting you. Many people will be easy marks, where their computers will become infected with viruses, and they will be victims of identity theft. Big online vendors such as eBay and Amazon represent big targets, but others will be targets as well. Phishers will be sending out loads of poisonous messages, just hoping that a few people will mistakenly click on links to malware-laden web sites. While big mail providers like Google and Yahoo! work hard to filter out such garbage, it’s unavoidable that some of dangerous emails will get through. Preventing such thefts while shopping online can be tricky because fraudulent and legitimate messages look nearly identical. Fraudsters may know something about you, such as your name, your mother tongue, the region in which you live, and the names of some of your friends. A competent fraudster will use the logos and have the same look and feel of a legitimate online vendor.

Some of my techie friends are probably snickering, saying “That couldn’t happen to me.” It probably already has.

Here are a few common sense suggestions to keep you from becoming a victim:

Here’s the obvious one: if you didn’t order something from a vendor, be highly suspicious of the email, especially with messages that claim to have order information or coupon offers.
If you have ordered something, beware any message with a subject that is vague, such as “your order”. A legitimate online vendor will somehow identify the order, either with an order number or with the name of the product you have ordered. This may appear in the subject line or in the body of the message.
No legitimate online vendor sends zip files in email. Don’t open them. The same largely holds for most other attachments. If they can’t provide you necessary information in the body of the message, it’s probably not legitimate.
Most online vendors provide you a means to log into their service to track orders. If you are at all in doubt about whether a message is legitimate, without clicking on a link in the message, visit their web site, and log in to track the order. If you need help, contact the vendor’s customer service.
While banks may email you alerts of some form, it is still always better to go to their web sites without clicking on links in the messages.
Unless you gave it to them directly shippers such as Federal Express do not have your email address. No decent online vendor will share your email address with a shipper.

What happens if you do click on something you shouldn’t have? There is no easy answer. Unless you are using antivirus, you have to assume the worst. This means that it’s important to maintain good backups. That way you can reinstall from scratch. Sounds painful? Then don’t carelessly click on email links.

Want some more advice on staying safe? Check out StaySafeOnline.org.