FBI spent $900,000 to obtain the password and unlock iOS devices
In 2015, a shooting occurred in San Bernardino, California. The shooting resulted in 14 deaths and 21 injuries. In addition, 3 other people were killed.
When investigating the case, the FBI sought Apple to unlock the sought-after iPhone in order to obtain potential information.
Although Apple did help but did not create a backdoor program to unlock the device, Apple believes that unlocking the device threatens the safety of the company’s products and may set a precedent.
Since Apple can’t get help, it can only find another way. In the end, the FBI still relied on other methods to successfully unlock the device and extract useful information on the iPhone.
However, no one knows how the FBI unlocked the device. Until recently, the Washington Post obtained internal information to reveal how the FBI unlocked the iPhone.
“Linux password file”by Christiaan Colen is licensed under CC BY-SA 2.0
Most technology media previously believed that unlocking Apple devices at the time was to use some backdoor programs or exploit known security vulnerabilities to develop backdoor programs to bypass restrictions.
But what is surprising is that the actual method of unlocking the device in the past was brute force attack, that is, a large number of randomly generated passwords were tried one by one, and the correct password would always be obtained.
But as you know, the iOS device may be locked if you enter the wrong password multiple times in a row, and it may self-destruct data, so if you want to brute force it directly, it is useless.
When the FBI was looking for a solution at the time, an Australian security company proposed a solution that could use known vulnerabilities in the iOS system to bypass the password error restriction.
That is to say, a large number of password combinations can be generated without limitation and then input for testing. Even if the input is wrong, the device will not be locked, so you can keep trying.
This security company actually discovered a security loophole in a certain piece of software developed by Mozilla. This loophole can be used to gain access to the system.
The company then used two other security vulnerabilities to combine to take over the processor on the phone, so that it could run its own programs directly on the device.
This program can generate a large number of passwords and automatically enter them until the correct set of passwords is found. Thanks to successfully bypassing the password error restriction, the password is finally found.
For this, the FBI paid the company a technical support fee of 900,000 US dollars, but later the FBI stated that they did not obtain useful information from the gunman’s mobile phone.
