Menu
FBI reportedly bought exploit from hackers to access San Bernardino iPhone

FBI reportedly bought exploit from hackers to access San Bernardino iPhone

The agency is still working through questions about sharing the vulnerability with Apple

The FBI reportedly paid professional hackers a one-time fee for a previously unknown vulnerability that allowed the agency to unlock the iPhone of San Bernardino shooter.

The exploit allowed the FBI to build a device capable of brute-forcing the iPhone's PIN without triggering a security measure that would have wiped all of its data, the Washington Post reported Tuesday, citing unnamed sources familiar with the matter.

The hackers who provided the exploit to the FBI find software vulnerabilities and sometimes sell them to the U.S. government, the newspaper reported.

Previous media reports suggested Israeli mobile forensics firm Cellebrite was the unnamed third party that helped the FBI unlock Farook's iPhone 5c. That was not the case, the Post's sources said.

In February, a judge ordered Apple to write special software that could help the FBI disable the iPhone's auto-erase protection. Apple challenged the order, but in late March the FBI dropped the case after successfully unlocking the iPhone using a technique acquired from an unnamed third-party.

Last week, speaking at Ohio’s Kenyon College, FBI director James Comey said the unlocking tool the agency used works only "on a narrow slice of iPhones," such as the 5c and older models.

That's probably because newer models store cryptographic material inside a secure hardware element called the secure enclave, first introduced in the iPhone 5s.

The FBI did not immediately respond to an inquiry seeking confirmation on whether the agency bought the iPhone 5c exploit from professional hackers.

However, the existence of a shadowy and largely unregulated market for exploits not reported to software vendors is no secret. There are hackers and security researchers who sell "zero-day" exploits to law enforcement and intelligence agencies, often through third-party brokers.

In November, a vulnerability acquisition firm called Zerodium paid US $1 million for a browser-based zero-day exploit that could fully compromise iOS 9 devices. The company shares the exploits it acquires with its customers, which include "government organizations in need of specific and tailored cybersecurity capabilities," according to the company's website.

The files leaked last year from surveillance software maker Hacking Team included a document with zero-day exploits offered for sale by an outfit called Vulnerabilities Brokerage International. Hacking Team sells its surveillance software to law enforcement agencies along with exploits that can be used to silently deploy the software on users' computers.

It's not clear if the FBI plans to eventually report the vulnerability to Apple. During the discussion at Kenyon College last week, Comey said the FBI is still working through that question and other policy issues related to the tool it obtained.

In April 2014, after reports of the National Security Agency stockpiling vulnerabilities, the White House outlined the government’s policy on sharing exploit information with vendors. There is "a disciplined, rigorous and high-level decision-making process for vulnerability disclosure" that weighs the pros and cons between disclosing a flaw and using it for intelligence gathering, Michael Daniel, special assistant to the president and cybersecurity coordinator, said in a blog post then.

Some software vendors have set up bug bounty programs and pay hackers for privately reporting vulnerabilities found in in their products. However, the rewards paid by vendors cannot compete with the amount of money that governments can and are willing to pay for the same flaws.

"I would rather vendors not try to compete in the bidding, but rather focus on eliminating the market entirely by creating secure products from the very beginning," said Jake Kouns, chief information security officer at vulnerability intelligence firm Risk Based Security, via email.

Software vendors should instead "invest significant money, energy, and time" into training developers on secure coding practices and reviewing code before releasing it, he added.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments