Schneier on Security

Think • December 11, 2019 8:07 PM

Looks like a locked iPhone is the big fish here.

So, you may have data (images, contacts, songs, etc) up on the cloud and a good suspicion that these discrete files are on the encrypted phone as well. Sounds like a good place to start a decryption process.

I would imagine that looking for file system commonalities that MUST be on all iPhones would work just as well to initiate a brute force decryption process on a physical memory bit by bit data extraction image.

There is enterprise software that can be preinstalled on iPhones allowing the removal of the PIN Lock code. One wonders if a carrier update via cell service on a locked phone in custody wouldn’t be able to circumvent a passcode as the software update would already posses the required access (it would just need to add the right software changes to perform this function, sort of like use of the trusted installer service from Microsoft to deliver ‘custom’ tailored updates for specific targeted computers. You may also be able to do other things like activate the wireless or Bluetooth radios if they are turned off to access other entry points (with that special update) and attack the phone through wireless means with heretofore unknown zero days.

Cellebrite is starting to look like the EnCase of the cellphone world.