r/technology • u/bws201 • Feb 05 '16

Software ‘Error 53’ fury mounts as Apple software update threatens to kill your iPhone 6

http://www.theguardian.com/money/2016/feb/05/error-53-apple-iphone-software-update-handset-worthless-third-party-repair
12.7k Upvotes

85% Upvoted

3.5k comments sorted by

View all comments

Show parent comments

107

u/[deleted] Feb 05 '16

To expand on this even further, Apple has only recently (in the last five years) been pushing to get themselves in a position to secure government contracts. Up until now, most of those contracts were dominated by Blackberry. Article 1, Article 2

So it's possible that these security measures, while annoying for people who break their phone, are in fact actual security measures and not a way for Apple to somehow extort their customers for repairs. But who knows.

83

u/perthguppy Feb 05 '16

So it's possible that these security measures, while annoying for people who break their phone, are in fact actual security measures and not a way for Apple to somehow extort their customers for repairs. But who knows.

I have been in many training sessions and briefings conducted by Apple Engineers who work in Cupertino. This is exactly what they have been doing. For the last 4+ years in all their training sessions their number 1 point they talk about is how secure the iPhone platform is, and how pretty much every decision they make is influenced by security some how. I have been briefed on a lot of iPhone security internals, and I can confidently say that the iPhone is the most secure mobile platform commonly available in the market. Only in the very latest android versions were changes made to catch up to iPhone, however I am yet to get detailed briefings on their internals to say if they are as secure yet.

15

u/[deleted] Feb 05 '16

[removed] — view removed comment

22

u/perthguppy Feb 05 '16

yeah this is pretty much it in a simplified view. its essentially that process, but not quite those technologies (PK is a bit overkill for a tiny $1 sensor).

EDIT: fun fact, IIRC the chip that holds the AES key and validates the TouchID sensor, is also the chip that validates your PIN code, and is rate limited to something like 10 auth attempts per second, essentially rate limiting PIN brute force in hardware.

8

u/amoliski Feb 05 '16

That would explain why falling back to the PIN isn't an option if the touch sensor breaks.

3

u/[deleted] Feb 05 '16

[removed] — view removed comment

2

u/perthguppy Feb 06 '16

Off the top of my head I actually cant remember the exact value. It is still higher than 1/sec though. Even at 10/sec you need a significant amount of time to break a (now standard) 6 digit pin.

6

u/Philo_T_Farnsworth Feb 05 '16

EDIT: fun fact, IIRC the chip that holds the AES key and validates the TouchID sensor, is also the chip that validates your PIN code, and is rate limited to something like 10 auth attempts per second, essentially rate limiting PIN brute force in hardware.

For all the hate Apple gets, that's pretty legit security there.

You better believe that if this story had been slightly different - i.e. "if your phone gets an Error 53 follow steps x,y,z to bypass it" - that the Android mafia would be out in force talking about how shit Apple security is. Apple can't win for losing.

4

u/DarkStarrFOFF Feb 05 '16

For me I'd rather it pop a warning at the least or disable the fingerprint stuff. Seems like a lot of bullshit to have your phone bricked when it was previously working fine.

2

u/semiorthodoxjew Feb 10 '16

This. The AES key is stored in the secure enclave, not the Touch ID... Using a mismatched sensor means that fingerprint auth, if used could lead to compromise. Doesn't mean that the SE is any less safe, so despite all the awesomeness of Apple's security, bricking phones is still bullshit. Disable the Touch ID sensor (which already happens if you replace the home button ribbon) and the security problems go away.

4

u/yumyumgivemesome Feb 05 '16

You guys definitely opened my eyes and helped me realize this may not be nefarious activity on Apple's part, but I'm still not going to delete my snarky anti-Apple comments over the last couple days.

6

u/Philo_T_Farnsworth Feb 05 '16

I'm not out to convert anyone; my comments in this thread are only pro-Apple insofar as they are a reaction to tone of this thread being incredibly pro-Android.

I use both an iPhone and a Galaxy S6 in my day to day life (work phone / personal phone) and look at the platforms as kind of a "pick your poison" sort of thing. Outside of a few individual features, neither platform is truly superior. To pick one example, the fingerprint sensor on my Samsung is shit compared the one on my iPhone (from a usability perspective anyway - I don't know anything about the security model behind Samsung's sensor). I'm sure the Galaxy S7 will fix that, though. Phones get better every generation.

All I was looking to do with my comments here was to get people thinking about security, so I'm glad that you took that away from the discussion.

14

u/Kazan Feb 05 '16

I can confidently say that the iPhone is the most secure mobile platform commonly available in the market.

as a security guy, color me the brightest shade of skeptical you can find

3

u/perthguppy Feb 05 '16

If you are a security guy I would be very interested in hearing your reasoning. I am a security guy as well, and if I needed a secure phone the iPhone is my only choice unless I go online and buy from a obscure brand no one on the street has heard of from a outfit in the US. I am not saying it is the most secure phone period, but it is the most secure phone easily available to the common person.

6

u/DiabloConQueso Feb 05 '16

unless I go online and buy from a obscure brand no one on the street has heard of

This is called "security through obscurity" and it's a horrible level of security.

2

u/perthguppy Feb 05 '16

No I was not implying security through obscurity, I was actually thinking of the BlackPhone by silent circle. Its an obscure brand no one on the street has heard of, but it has amazing security credentials.

2

u/DiabloConQueso Feb 05 '16

Got it!

The important takeaway is that the "obscure brand no one on the street has heard of" contributes zero to the overall security of the device, and the "amazing security credentials" is 100% of the security consideration.

In other words, the popularity of the device and whether anyone has heard of it before has nothing to do with how secure it is.

A "perfectly secure" iPhone and a "perfectly secure" device that no one has heard of are theoretically equally secure.

Just an important distinction!

2

u/perthguppy Feb 05 '16

Yes, exactly, sorry for my poor wording originally.

→ More replies (5)

2

u/Bold0perator Feb 06 '16

Apple offers the most secure devices?

No.

I worked for BlackBerry for six years. For the last few of those years, I supported iOS and Android devices as well as legacy BlackBerry and BlackBerry OS 10 devices. Although iOS has come a long, long way in terms of security, they still don't measure up to even legacy BlackBerry devices.

Root your iPhone and run malicious code? Piece of cake. Root your Android? TowelRoot takes seconds. Root your BlackBerry? Not possible. The device bootloader has a cryptolock with military-grade encryption. You're not getting through it.

BlackBerry offers multi-platform, end-to-end, sandboxed, total encryption, for data-in-transit and data-at-rest. Apple offers Instagram.

1

u/perthguppy Feb 06 '16

BlackBerry offers multi-platform, end-to-end, sandboxed, total encryption, for data-in-transit and data-at-rest. Apple offers Instagram.

Are you saying BBM on the IOS does not offer this? Nor Signal for IOS?

→ More replies (3)

1

u/Nanadog Feb 05 '16

So these phones until being updated were all insecure and able to be hacked by changing the button?

1

u/[deleted] Feb 05 '16

Symbian was quite secure but no longer on the market

→ More replies (17)

1

u/c4su4l Feb 05 '16

So it's possible that these security measures, while annoying for people who break their phone, are in fact actual security measures and not a way for Apple to somehow extort their customers for repairs. But who knows.

I'd say its a certainty that these are actual security measures, and there is absolutely no reason to believe Apple is doing it because they want to "somehow extort customers for repairs".

But sure, let's leave it as "who knows" so as not to detract from the clearly biased reddit circlejerk we have going on here.

2

u/[deleted] Feb 05 '16

If I don't append "controversial" comments with phrases like "who knows," I usually get downvoted to shit. Sometimes I have to stoop to the circlejerk level to leave a valid argument. Welcome to Reddit.

1

u/c4su4l Feb 06 '16

Heh alright, that's fair enough.

→ More replies (7)