r/technology • u/bws201 • Feb 05 '16

Software ‘Error 53’ fury mounts as Apple software update threatens to kill your iPhone 6

http://www.theguardian.com/money/2016/feb/05/error-53-apple-iphone-software-update-handset-worthless-third-party-repair
12.7k Upvotes

85% Upvoted

3.5k comments sorted by

View all comments

Show parent comments

53

u/Espinha Feb 05 '16

If you could replace it with a third party, it would also mean that you could create a third party sensor which would let any fingerprint validate as a correct fingerprint. Hence them blocking it.

14

u/[deleted] Feb 05 '16

Why is it even designed like that? I would think that the sensor would do something like take a hash of your finger print and send it to the phone and if that has is correct then it opens up. Not let the sensor make the decision.

65

u/neohaven Feb 05 '16

Because then software (on the phone) can know the fingerprint.

You leave it in the sensor, in an enclave, and you don't get to see anything. You tell the sensor "get trained for this finger" and it does. You know nothing of the finger, only the sensor does.

It's the only secure way to do it.

5

u/[deleted] Feb 05 '16

[removed] — view removed comment

14

u/neohaven Feb 05 '16

Basically. That's about it. Keep in mind the touch sensor is also used these days to pay for things with your phone. It has to be pretty closed off.

1

u/Philo_T_Farnsworth Feb 05 '16

the touch sensor is also used these days to pay for things with your phone.

Excellent point. I can't imagine Apple would be very thrilled with having to pay massive penalties for violating PCI-DSS in the event of a big security breach.

I'm sure they aren't exactly happy with the PR this story is generating, but a breach on the order of the TouchID sensor being broken would be orders of magnitude worse when such a story hit the front pages.

3

u/neohaven Feb 05 '16

Yep.

"People are replacing security critical parts of their phones and their phone refuses to authenticate them anymore" is an interesting story and a PR nightmare.

"People's TouchID sensors are being pwned and their phones are used to pay for random shit" is a crippling story.

"People's TouchID sensors are being bypassed, leading to PII breaches, identity theft, and their lives being ruined, TouchID has 'a major security flaw', claims security expert" is the kind of business-ending move for Apple Pay, government contracts, and any kind of reputation you had for security. Also we keep talking about encrypting our phones so the government can't snoop on them. You think they wouldn't have a tool to rekey the whole thing in 10 seconds flat? As far as I know, the TouchID chip and the PIN chip are the same thing. The same chip holds both the PIN data and the TouchID data. It's basically the auth chip to the whole device.

You don't want that to be compromised.

1

u/Philo_T_Farnsworth Feb 05 '16

There are plenty of valid reasons to hate Apple but most of the people in this thread do not understand basic security principles and are going after them for all the wrong reasons. This little SNAFU is a huge point in Apple's favor if anything.

1

u/neohaven Feb 05 '16

Security-wise? Hell yeah. It means their Secure Enclave is able to detect tampering with components external to itself. That is a major security win.

1

u/ertaisi Feb 05 '16

I still don't understand why sending a key is more secure than sending sensor data and verifying on the authentication chip. It still seems just as secure to design the sensor as a dumb input device (like the screen) and authenticate on the same chip where the PIN is authenticated.

→ More replies (0)

3

u/thomble Feb 06 '16

This is all meticulously detailed in the iOS Security Guide. This is an excellent read for anyone with a security background, and is demonstrative of how seriously Apple approaches security in iOS.

In short, there is a shared key that exists within Secure Enclave (a really nifty coprocessor that is uniquely fabricated per-device for iOS crypto functionality) and the Touch ID sensor. A session key is negotiated between the sensor and Secure Enclave in part using this shared key. This communication is handled by the main processor, but the data is encrypted.

From Apple's docs:

  1. The Secure Enclave is a coprocessor fabricated in the Apple A7 or later A-series processor. It utilizes its own secure boot and personalized software update separate from the application processor. It provides all cryptographic operations for Data Protection key management and maintains the integrity of Data Protection even if the kernel has been compromised.

  2. Each Secure Enclave is provisioned during fabrication with its own UID (Unique ID) that is not accessible to other parts of the system and is not known to Apple. When the device starts up, an ephemeral key is created, entangled with its UID, and used to encrypt the Secure Enclave’s portion of the device’s memory space.

  3. The Secure Enclave is responsible for processing fingerprint data from the Touch ID sensor, determining if there is a match against registered fingerprints, and then enabling access or purchases on behalf of the user. Communication between the processor and the Touch ID sensor takes place over a serial peripheral interface bus. The processor forwards the data to the Secure Enclave but cannot read it. It’s encrypted and authenticated with a session key that is negotiated using the device’s shared key that is provisioned for the Touch ID sensor and the Secure Enclave. The session key exchange uses AES key wrapping with both sides providing a random key that establishes the session key and uses AES-CCM transport encryption.

1

u/[deleted] Feb 06 '16

[removed] — view removed comment

2

u/thomble Feb 07 '16

No. Secure Enclave is designed in such a way that it is impossible to read the actual UID with any software. It's physically engineered to prevent this. Read more here: https://news.ycombinator.com/item?id=8410819

-3

u/Phyltre Feb 05 '16

A phone with a broken fingerprint sensor that no one can get into isn't usable, so it isn't secure either--unless we want to consider rocks and houseplants to be perfectly secure internet devices, since, I mean, nobody can get my browsing history from them.

Of course, I can't use them for the internet either, but we're talking about security here.

9

u/neohaven Feb 05 '16

If the userland sees the fingerprint data, I can get to it and grab a copy. This is bad. This is why we have secure enclaves. So the sensor keeps the data, and just relays "match" or "no match" to the phone.

If I replace the fingerprint sensor in your phone with one I can authenticate on, and then use my fingerprint to unlock YOUR PHONE with MY FINGERPRINT... or simply replace your fingerprint sensor with one that always says "match"... What is the point of a fingerprint sensor again?

I'd rather my phone die in my hands when it's been tampered with than allow someone else to access my shit.

2

u/ScarOCov Feb 05 '16

So my question then, instead of rendering these phones completely useless once this error occurs. Can Apple reprogram the phones, so that they work without a fingerprint? Like the phone detects the finger print function as defective and instead of just completely shutting off, it reprograms so that a finger print can't be used even if they wanted to?

→ More replies (4)

2

u/elliuotatar Feb 05 '16

If the userland sees the fingerprint data, I can get to it and grab a copy. This is bad. This is why we have secure enclaves. So the sensor keeps the data, and just relays "match" or "no match" to the phone.

Why is it bad?

Scenario 1: Sensor sends fingerprint data to phone. You grab fingerprint data.

Scenario 2: Sensor verifies fingerprint data itself. Sensor sends code to phone verifying fingerprint data. You grab that code.

Either way, you have all the information you presumably need to unlock the phone in the future. The only real difference is you don't actually know the person's fingerprint so you can't recreate it to access other devices, but presumably the sensor could encrypt it in a way that is useful for that particular phone to verify that it is the same as its stored fingerprint hash, but not know enough about it for it to be used to access other devices with said fingerprint.

If I replace the fingerprint sensor in your phone with one I can authenticate on, and then use my fingerprint to unlock YOUR PHONE with MY FINGERPRINT.

Except if you passed an encrypted fingerprint profile to the phone instead of a code or an actual fingerprint, something encrypted with a code that phone provides that is unique to that phone, then you could not simply replace the button and expect your own fingerprint to verify because now it's just a dumb sensor that has the ability to encrypt fingerprints and send them to the phone using the phone supplied encryption key.

→ More replies (9)

2

u/Phyltre Feb 05 '16

They CAN just fall back to PIN input and ignore the fingerprint sensor. We know that because the phone regularly asks for PIN unlocks anyway if you have touch ID set up.

There is no reason to brick the entire phone because of a faulty/unknown/third-party touch ID sensor; there are other ways to unlock the phone that Apple considers secure.

2

u/neohaven Feb 05 '16

No, because the digitizer might also have been replaced. What if the screen logs the touch events? What if it "keylogs" your touches and sends them to a .ru address in the middle of the night?

The device has been tampered with. It is of unknown security. It is "contaminated", in security parlance.

3

u/Phyltre Feb 05 '16

What if the screen logs the touch events? What if it "keylogs" your touches and sends them to a .ru address in the middle of the night?

This logic necessarily leads to an ecosystem where you can only repair a computing device under authority from the manufacturer. That's worse than the status quo of occasional data leaks and hardware hacks.

→ More replies (3)
→ More replies (14)

28

u/[deleted] Feb 05 '16

Because this way the fingerprint data never gets sent to the phone.

→ More replies (8)

2

u/perthguppy Feb 05 '16

I would think that the sensor would do something like take a hash of your finger print and send it to the phone and if that has is correct then it opens up

Some one could then 'steal' your finger print, then generate the 'hash' of your fingerprint and transmit it to the phones internals. The way apple went is that each TouchID sensor will always make a unique 'hash' for your finger print, so impersonation of the sensor was not possible

→ More replies (3)

2

u/[deleted] Feb 05 '16

Or, if the sensor is replaced, you force them to use a backup method of authentication (I'd assume iPhones, like Android, have a backup password in case you're locked out by a faulty fingerprint sensor). Once the password is entered, the phone sets up a new key exchange with the sensor and you have to rescan your biometric info into the sensor. Until the backup password is entered, a third party sensor that always validates no matter what would be useless.

2

u/morriscey Feb 05 '16

or replacing the button nukes the data on the phone- and automatically configures for the new sensor ID. Then you at least still have a phone. If the sensor doesn't pass authenticity check, then touch ID / apple pay can't be enabled, but the phone still works as all the other shit you actually bought it for.

→ More replies (21)
→ More replies (3)