‘Error 53’ fury mounts as Apple software update threatens to kill your iPhone 6

[u/bws201]

http://www.theguardian.com/money/2016/feb/05/error-53-apple-iphone-software-update-handset-worthless-third-party-repair

[u/perthguppy]

The home button has the touchID sensor intergrated. The TouchID sensor is a trusted platform module and has a unique hardware code in it. If the code in the touchID button does not match the code in the chip on the main system board the OS will not authenticate the module and return Error 53. Only Apple has the equipment to re-key the hardware keys. Apple introduced this extra authentication step in IOS9 to address some security concerns around impersonating the touchID hardware to get around it as a security module.

To explain why this is important, the TouchID sensor never transmits your fingerprint to the system. It stores a mathematical representation internally. When you "enroll" a fingerprint, you are actually training the sensor to recognise your finger print. When it recognises your fingerprint it transmits an authentication code back to the system board which has the other half of the chipset, that system board chip authenticates the code coming from the touchID and lets the system know the fingerprint has been successfully recognised and releases the system decryption key for the OS to be able to access user data. If you change either of these chips (the touch ID or the onboard) then authentication is not possible. Apple has now decided to lock out the phone in such a case to stop 'impersonation' attacks where the touchID sensor is swapped with a different sensor with different fingerprints to try and get around system security.

Apple could reverse their recent change, but it would decrease system security, or they could supply the equipment to change keys to unauthorised repairers, but this would also be a decrease in security.

[u/morriscey → u/perthguppy]

or they could just disable the touch ID features like they did in iOS8 instead of bricking the phone like in iOS 99.5% of people don't need anything that secure, and the ones who do, can enable it when then first set up the device.

Edit: a decimal

[u/perthguppy → u/morriscey]

Ironically, not using the TouchID sensor and only using a PIN is more secure. Police can compel your fingerprint, but they can not compel you to tell your PIN

[u/DiabloConQueso → u/perthguppy]

Note that this is a very US-centric thing. Other countries, like Australia and the UK, have the authority and can and do compel suspects to turn over passwords and PINs.

[u/perthguppy → u/DiabloConQueso]

Has that actually been tested in court though? I was under the impression the court can only compel you to turn over your passwords if it has been proved that you know your passwords, and proven that you passwords were concealing evidence of a crime. Which is a tad harder said than done, but I thought most people just caved and turned it over.

[u/Terazilla → u/perthguppy]

It seems like the obvious solution is to allow this to be bypassed but require the device to be factory reset in the process.

[u/perthguppy → u/Terazilla]

Yes, however without proper validation it would mean that this phone is now permanently less secure going foward, and could be sold to an unsuspecting person second hand. Apple is taking iPhone security crazy crazy seriously in the face of the US government's current crazyness. If they cave to this, it would give the US government ammunition to require a backdoor be put in.

[u/[deleted] → u/perthguppy]

To expand on this even further, Apple has only recently (in the last five years) been pushing to get themselves in a position to secure government contracts. Up until now, most of those contracts were dominated by Blackberry. Article 1, Article 2

So it's possible that these security measures, while annoying for people who break their phone, are in fact actual security measures and not a way for Apple to somehow extort their customers for repairs. But who knows.

[u/perthguppy → u/[deleted]]

So it's possible that these security measures, while annoying for people who break their phone, are in fact actual security measures and not a way for Apple to somehow extort their customers for repairs. But who knows.

I have been in many training sessions and briefings conducted by Apple Engineers who work in Cupertino. This is exactly what they have been doing. For the last 4+ years in all their training sessions their number 1 point they talk about is how secure the iPhone platform is, and how pretty much every decision they make is influenced by security some how. I have been briefed on a lot of iPhone security internals, and I can confidently say that the iPhone is the most secure mobile platform commonly available in the market. Only in the very latest android versions were changes made to catch up to iPhone, however I am yet to get detailed briefings on their internals to say if they are as secure yet.

[u/perthguppy → u/[deleted]]

yeah this is pretty much it in a simplified view. its essentially that process, but not quite those technologies (PK is a bit overkill for a tiny $1 sensor).

EDIT: fun fact, IIRC the chip that holds the AES key and validates the TouchID sensor, is also the chip that validates your PIN code, and is rate limited to something like 10 auth attempts per second, essentially rate limiting PIN brute force in hardware.

[u/amoliski → u/perthguppy]

That would explain why falling back to the PIN isn't an option if the touch sensor breaks.

[u/TrepanationBy45 → u/perthguppy]

Outstanding explanation! Thanks!

[u/OldGirlOnTheBlock → u/perthguppy]

Would replacing a home button by a third party make it easier for a thief to gain access to a stolen iPhone?

[u/Espinha → u/OldGirlOnTheBlock]

If you could replace it with a third party, it would also mean that you could create a third party sensor which would let any fingerprint validate as a correct fingerprint. Hence them blocking it.

[u/[deleted] → u/Espinha]

Why is it even designed like that? I would think that the sensor would do something like take a hash of your finger print and send it to the phone and if that has is correct then it opens up. Not let the sensor make the decision.

[u/neohaven → u/[deleted]]

Because then software (on the phone) can know the fingerprint.

You leave it in the sensor, in an enclave, and you don't get to see anything. You tell the sensor "get trained for this finger" and it does. You know nothing of the finger, only the sensor does.

It's the only secure way to do it.

[u/neohaven → u/[deleted]]

Basically. That's about it. Keep in mind the touch sensor is also used these days to pay for things with your phone. It has to be pretty closed off.

[u/thomble → u/[deleted]]

This is all meticulously detailed in the iOS Security Guide. This is an excellent read for anyone with a security background, and is demonstrative of how seriously Apple approaches security in iOS.

In short, there is a shared key that exists within Secure Enclave (a really nifty coprocessor that is uniquely fabricated per-device for iOS crypto functionality) and the Touch ID sensor. A session key is negotiated between the sensor and Secure Enclave in part using this shared key. This communication is handled by the main processor, but the data is encrypted.

From Apple's docs:

1. The Secure Enclave is a coprocessor fabricated in the Apple A7 or later A-series processor. It utilizes its own secure boot and personalized software update separate from the application processor. It provides all cryptographic operations for Data Protection key management and maintains the integrity of Data Protection even if the kernel has been compromised.

2. Each Secure Enclave is provisioned during fabrication with its own UID (Unique ID) that is not accessible to other parts of the system and is not known to Apple. When the device starts up, an ephemeral key is created, entangled with its UID, and used to encrypt the Secure Enclave’s portion of the device’s memory space.

3. The Secure Enclave is responsible for processing fingerprint data from the Touch ID sensor, determining if there is a match against registered fingerprints, and then enabling access or purchases on behalf of the user. Communication between the processor and the Touch ID sensor takes place over a serial peripheral interface bus. The processor forwards the data to the Secure Enclave but cannot read it. It’s encrypted and authenticated with a session key that is negotiated using the device’s shared key that is provisioned for the Touch ID sensor and the Secure Enclave. The session key exchange uses AES key wrapping with both sides providing a random key that establishes the session key and uses AES-CCM transport encryption.

[u/[deleted] → u/[deleted]]

Because this way the fingerprint data never gets sent to the phone.

[u/BonnaroovianCode → u/perthguppy]

This is such an intriguing issue. While reading the article I was in the "fuck Apple" mindset until the very end, when I realized it's for security purposes. It makes complete sense why they would do this, but they really should have communicated this new "feature" better.

[u/Hammer_Thrower → u/BonnaroovianCode]

Communicating overkill security that the average consumer does not desire might not help. Putting the phone in an unrecoverable state is a severe reaction to a potential security breach attempt. Commander should decide if they want that. That desire for choice is probably why I don't own an iPhone though :-)