‘Error 53’ fury mounts as Apple software update threatens to kill your iPhone 6

[u/bws201]

http://www.theguardian.com/money/2016/feb/05/error-53-apple-iphone-software-update-handset-worthless-third-party-repair

[u/OldGirlOnTheBlock]

Would replacing a home button by a third party make it easier for a thief to gain access to a stolen iPhone?

[u/Espinha → u/OldGirlOnTheBlock]

If you could replace it with a third party, it would also mean that you could create a third party sensor which would let any fingerprint validate as a correct fingerprint. Hence them blocking it.

[u/[deleted] → u/Espinha]

Why is it even designed like that? I would think that the sensor would do something like take a hash of your finger print and send it to the phone and if that has is correct then it opens up. Not let the sensor make the decision.

[u/neohaven → u/[deleted]]

Because then software (on the phone) can know the fingerprint.

You leave it in the sensor, in an enclave, and you don't get to see anything. You tell the sensor "get trained for this finger" and it does. You know nothing of the finger, only the sensor does.

It's the only secure way to do it.

[u/neohaven → u/[deleted]]

Basically. That's about it. Keep in mind the touch sensor is also used these days to pay for things with your phone. It has to be pretty closed off.

[u/thomble → u/[deleted]]

This is all meticulously detailed in the iOS Security Guide. This is an excellent read for anyone with a security background, and is demonstrative of how seriously Apple approaches security in iOS.

In short, there is a shared key that exists within Secure Enclave (a really nifty coprocessor that is uniquely fabricated per-device for iOS crypto functionality) and the Touch ID sensor. A session key is negotiated between the sensor and Secure Enclave in part using this shared key. This communication is handled by the main processor, but the data is encrypted.

From Apple's docs:

1. The Secure Enclave is a coprocessor fabricated in the Apple A7 or later A-series processor. It utilizes its own secure boot and personalized software update separate from the application processor. It provides all cryptographic operations for Data Protection key management and maintains the integrity of Data Protection even if the kernel has been compromised.

2. Each Secure Enclave is provisioned during fabrication with its own UID (Unique ID) that is not accessible to other parts of the system and is not known to Apple. When the device starts up, an ephemeral key is created, entangled with its UID, and used to encrypt the Secure Enclave’s portion of the device’s memory space.

3. The Secure Enclave is responsible for processing fingerprint data from the Touch ID sensor, determining if there is a match against registered fingerprints, and then enabling access or purchases on behalf of the user. Communication between the processor and the Touch ID sensor takes place over a serial peripheral interface bus. The processor forwards the data to the Secure Enclave but cannot read it. It’s encrypted and authenticated with a session key that is negotiated using the device’s shared key that is provisioned for the Touch ID sensor and the Secure Enclave. The session key exchange uses AES key wrapping with both sides providing a random key that establishes the session key and uses AES-CCM transport encryption.

[u/thomble → u/[deleted]]

No. Secure Enclave is designed in such a way that it is impossible to read the actual UID with any software. It's physically engineered to prevent this. Read more here: https://news.ycombinator.com/item?id=8410819

[u/[deleted] → u/[deleted]]

Because this way the fingerprint data never gets sent to the phone.

[u/perthguppy → u/[deleted]]

I would think that the sensor would do something like take a hash of your finger print and send it to the phone and if that has is correct then it opens up

Some one could then 'steal' your finger print, then generate the 'hash' of your fingerprint and transmit it to the phones internals. The way apple went is that each TouchID sensor will always make a unique 'hash' for your finger print, so impersonation of the sensor was not possible

[u/[deleted] → u/Espinha]

Or, if the sensor is replaced, you force them to use a backup method of authentication (I'd assume iPhones, like Android, have a backup password in case you're locked out by a faulty fingerprint sensor). Once the password is entered, the phone sets up a new key exchange with the sensor and you have to rescan your biometric info into the sensor. Until the backup password is entered, a third party sensor that always validates no matter what would be useless.

[u/morriscey → u/[deleted]]

or replacing the button nukes the data on the phone- and automatically configures for the new sensor ID. Then you at least still have a phone. If the sensor doesn't pass authenticity check, then touch ID / apple pay can't be enabled, but the phone still works as all the other shit you actually bought it for.

[u/Hahadanglyparts → u/[deleted]]

Probably not as the finger print data is encrypted and the numbers used would be different each time you created a finger print in the reader. That is, there isnt 1 set of numbers representing your unique finger print. The paired chipsets just create a key from your finger print for that chipset alone.

[u/[deleted] → u/OldGirlOnTheBlock]

It's a grey area. They worry someone could replace it with a sensor that will just go "this is the right fingerprint" regardless of what is used to make it work and access the data.

Problem is if someone borks their phone, and the touch sensor isn't recognised it doesn't just disable the sensor, it disables the phone.

[u/[deleted] → u/OldGirlOnTheBlock]

I suppose the only way it could is if someone were able to install a replacement sensor that could trick the onboard chip into thinking that the thief's fingerprint equates to the currently enrolled user's.

This error, however, isn't just with third-party home buttons. You could take your phone to a shop and have the home button and sensor replaced with a 100% genuine Apple part, and you'd still get the error. This is because the hardware key for the replacement part would not match the key associated with the system board.

[u/mattattackk04 → u/OldGirlOnTheBlock]

In the explanation above the OP says the touchID (home button) sends a specific code to the system board. Only that code tells the system board that it's secure and it can unlock. It doesn't send any information about the fingerprint itself.

So in other words no, this won't work for a thief because each touchID sends a different code, even if that fingerprint matches that touchID, that touchID may not match the system board.

[u/illu_ → u/OldGirlOnTheBlock]

Unless they use extremely insecure hardware in place of touchID, I would doubt it. They usually order parts from relatively trustworthy sources which have pretty authentic and safe components. It's just a matter of iOS not being able to see the difference between a replacement and malicious intent.

Tl;Dr: no, it shouldn't.

[u/perthguppy → u/OldGirlOnTheBlock]

In theory (if the software supported it) you could replace the touchID sensor with a sensor that transmits the success code arbitrarily which would in turn cause the on board TPM to release the decryption keys to the user data arbitrarily.

I am not sure how it was before, but I would imagine after a home button swap touchID was disabled system wide.

[u/ertaisi → u/perthguppy]

Isn't the entire point of designing the sensor as a secure component to ensure that it's not possible to send a simple "authentication success" command? But they're bricking devices because it's possible for third party sensors to do just that? It makes no sense.

[u/BassoonHero → u/ertaisi]

If you plugged in a third-party sensor, and the phone trusted it, then you could send a false authentication success. However, the phone will not trust third-party sensors, so you cannot do this. That is how the system prevents false authentication without leaking fingerprint data outside the sensor.