Menu
FBI reportedly bought exploit from hackers to access San Bernardino iPhone

FBI reportedly bought exploit from hackers to access San Bernardino iPhone

The agency is still working through questions about sharing the vulnerability with Apple

The FBI reportedly paid professional hackers a one-time fee for a previously unknown vulnerability that allowed the agency to unlock the iPhone of San Bernardino shooter.

The exploit allowed the FBI to build a device capable of brute-forcing the iPhone's PIN without triggering a security measure that would have wiped all of its data, the Washington Post reported Tuesday, citing unnamed sources familiar with the matter.

The hackers who provided the exploit to the FBI find software vulnerabilities and sometimes sell them to the U.S. government, the newspaper reported.

Previous media reports suggested Israeli mobile forensics firm Cellebrite was the unnamed third party that helped the FBI unlock Farook's iPhone 5c. That was not the case, the Post's sources said.

In February, a judge ordered Apple to write special software that could help the FBI disable the iPhone's auto-erase protection. Apple challenged the order, but in late March the FBI dropped the case after successfully unlocking the iPhone using a technique acquired from an unnamed third-party.

Last week, speaking at Ohio’s Kenyon College, FBI director James Comey said the unlocking tool the agency used works only "on a narrow slice of iPhones," such as the 5c and older models.

That's probably because newer models store cryptographic material inside a secure hardware element called the secure enclave, first introduced in the iPhone 5s.

The FBI did not immediately respond to an inquiry seeking confirmation on whether the agency bought the iPhone 5c exploit from professional hackers.

However, the existence of a shadowy and largely unregulated market for exploits not reported to software vendors is no secret. There are hackers and security researchers who sell "zero-day" exploits to law enforcement and intelligence agencies, often through third-party brokers.

In November, a vulnerability acquisition firm called Zerodium paid US $1 million for a browser-based zero-day exploit that could fully compromise iOS 9 devices. The company shares the exploits it acquires with its customers, which include "government organizations in need of specific and tailored cybersecurity capabilities," according to the company's website.

The files leaked last year from surveillance software maker Hacking Team included a document with zero-day exploits offered for sale by an outfit called Vulnerabilities Brokerage International. Hacking Team sells its surveillance software to law enforcement agencies along with exploits that can be used to silently deploy the software on users' computers.

It's not clear if the FBI plans to eventually report the vulnerability to Apple. During the discussion at Kenyon College last week, Comey said the FBI is still working through that question and other policy issues related to the tool it obtained.

In April 2014, after reports of the National Security Agency stockpiling vulnerabilities, the White House outlined the government’s policy on sharing exploit information with vendors. There is "a disciplined, rigorous and high-level decision-making process for vulnerability disclosure" that weighs the pros and cons between disclosing a flaw and using it for intelligence gathering, Michael Daniel, special assistant to the president and cybersecurity coordinator, said in a blog post then.

Some software vendors have set up bug bounty programs and pay hackers for privately reporting vulnerabilities found in in their products. However, the rewards paid by vendors cannot compete with the amount of money that governments can and are willing to pay for the same flaws.

"I would rather vendors not try to compete in the bidding, but rather focus on eliminating the market entirely by creating secure products from the very beginning," said Jake Kouns, chief information security officer at vulnerability intelligence firm Risk Based Security, via email.

Software vendors should instead "invest significant money, energy, and time" into training developers on secure coding practices and reviewing code before releasing it, he added.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners

Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners

More than 500 channel leaders gathered in Auckland on 21 October at the ​Reseller News Innovation Awards ​2020 to celebrate the achievements of the New Zealand technology industry's top partners, start-ups, vendors, distributors and individuals.

Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners
Meet the winners of the 2020 Reseller News Innovation Awards

Meet the winners of the 2020 Reseller News Innovation Awards

Reseller News honoured the standout players of the New Zealand channel in front of more than 500 technology leaders in Auckland on 21 October, recognising the achievements of top partners, start-ups, vendors, distributors and individuals.

Meet the winners of the 2020 Reseller News Innovation Awards
Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

This year’s Reseller News 30 Under 30 Tech Awards were held as an integral part of the first entirely virtual Emerging Leaders​ forum, an annual event dedicated to identifying, educating and showcasing the New Zealand technology market’s rising stars. The 30 Under 30 Tech Awards 2020 recognised the outstanding achievements and business excellence of 30 talented individuals​, across both young leaders and those just starting out. In this slideshow, Reseller News honours this year's winners and captures their thoughts about how their ideas of leadership have changed over time.​

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners
Show Comments