brewster postmaster

Friday, November 1, 2013

Touch ID takes hardware security to new levels - Here's how, why, and what it means!

We already know that the iPhone 5s' Touch ID secures your digital fingerprint by storing it on the Secure Enclave portion of the A7 that's only accessible to the sensor itself. But what if that wasn't the only safeguard Apple took in order to protect your prints? We've taken a closer look at Touch ID and through some collaboration with repair company mendmyi, we've found that Apple actually did take extra precautions, but on a hardware level that we've never seen implemented before.

Apple has touted Touch ID to be a secure hardware path since they announced the iPhone 5s. This is Apple's explanation of Secure Enclave on their own website:

Touch ID does not store any images of your fingerprint. It stores only a mathematical representation of your fingerprint. It isn't possible for your actual fingerprint image to be reverse-engineered from this mathematical representation. iPhone 5s also includes a new advanced security architecture called the Secure Enclave within the A7 chip, which was developed to protect passcode and fingerprint data. Fingerprint data is encrypted and protected with a key available only to the Secure Enclave. Fingerprint data is used only by the Secure Enclave to verify that your fingerprint matches the enrolled fingerprint data. The Secure Enclave is walled off from the rest of A7 and as well as the rest of iOS. Therefore, your fingerprint data is never accessed by iOS or other apps, never stored on Apple servers, and never backed up to iCloud or anywhere else. Only Touch ID uses it and it can't be used to match against other fingerprint databases.

Apple has only ever talked about Secure Enclave in regards to protecting our digital fingerprints. They don't make specific mention of any other additional safeguards. However, through some research and testing of our own, we are pretty convinced they didn't stop at just the Secure Enclave.

It seems as though Apple has went through the trouble of pairing every individual Touch ID sensor cable to each individual phone. That's an incredible feat, but also baffling at the same time. But to understand and potentially figure out why, let me explain how we came to this conclusion.

Our investigation into the Touch ID assembly itself started when mendmyi contacted me about an issue with Touch ID on a customer's phone that had been in for their Colour Lab service. The video below demonstrates the issue they were presented with.

In order to try and rectify the issue, many steps were attempted. These included swapping out the Touch ID sensor for one verified to work, replacing the dock connector in which the Touch ID makes contact with, and even replacing the logic board itself. When each different hardware fix was attempted, a DFU restore was performed as well. Nothing worked. All of us were baffled.

It was then discovered that the Touch ID sensor currently in the device was not the original that came in the device. Upon replacing the original, Touch ID once again worked fine.

At this point, we knew there had to be some hardware lockdown going on that we weren't previously aware of. To test this theory, we took two iPhone 5s' that had never been opened before. First, Touch ID was verified to be in working order on both devices. The front assemblies, which contain the Touch ID assembly itself, were then removed from each and swapped into the other. Upon setup, both Touch ID setups failed. When returned to the original device, Touch ID once again operated correctly.

This confirmed for us that the Touch ID component cable assembly itself is tied to each individual A7 chip.

Our next step was obviously to understand why Apple would make this decision. So I asked our resident security expert, Nick Arnott, if he had any thoughts on why Apple would find this necessary. While none of this can be confirmed, these are his thoughts on why Apple may have taken the extra precaution:

It's hard to say why Apple might lock the A7 chip to a specific Touch ID sensor. One possibility could be to try and prevent any sort of sniffing or interception taking place between the Touch ID sensor and the secure enclave. Sort of like a hardware equivalent to SSL certificate pinning. By pairing the A7 chip to a specific Touch ID, this could make it more difficult for tinkerers to try and intercept communications to reverse engineer how the components talk to each other. This could also mitigate possible risks of malicious third-party Touch IDs being installed in a user's device without their knowledge which could capture a user's fingerprint for an attacker, while passing it on to the A7 chip to allow a user to continue to use their device as normal, without any indication it has been tampered with. If Apple instead used some sort of shared key that was used by all Touch ID sensors to authenticate with the A7 chip, it would only take one Touch ID's key being hacked to compromise all of them. Being tied to a unique Touch ID sensor on each phone means installing something like a malicious Touch ID sensor would require cracking each device you want to attack individually.

I think all Nick's points are valid and could certainly explain what Apple was getting at in their own description of Touch ID when they touch on the fact that it isn't possible for your fingerprint to be reverse-engineered. One thing is for sure, I'd be very curious to see if these kinds of security precautions are taken in other fingerprint readers such as the one found in the HTC One Max.

What does all this mean for general consumers, hackers, DIY repairs, and future security standards?

For general consumers, this is good news. It means you've got an extra layer of protection that's specifically unique to your device. A universal hack won't work. For hackers, it means they've got their work cut out for them and if they want to bypass Touch ID, if it's possible at all, it can't be done by modifying the sensor cable itself.

When it comes to DIY repairers, it means your job just got a little more precarious. Since you need to remove the Touch ID cable and transfer it in order to perform to most common repair, replacing a cracked screen, you'd better make damn sure you don't break it. If you do, you'll lose Touch ID functionality and won't be able to get it back.

As for the future of hardware security, who really knows? I've yet to be able to find a reference on another company locking down specific hardware components the way Apple has with Touch ID. It theoretically means they could lock down any component in an iPhone, iPad, iPod, or Mac if they really wanted to. Will they? Probably not. But the option is there.

Your thoughts?

I'm particularly interested to see what you guys think about Touch ID, the tremendous safeguards that have went into building it, and whether or not they truly make you feel comfortable using it. Does this discovery ease your mind at all? Or is it still not enough?

And if there's anyone out there that can cite another example of this kind of hardware lockdown being used, be sure to let us know that too!

Source: http://feedproxy.google.com/~r/TheIphoneBlog/~3/QSFV4ZrAIM8/story01.htm
Tags: iTunes january jones Nothing Was The Same Madden 25 taylor swift

Judge: No questionable comments on NY stop-frisk

NEW YORK (AP) — A judge who ordered changes to the New York City police stop-and-frisk program and was removed from the case says she didn't comment on it inappropriately.

Judge Shira Scheindlin (SHEER'-uh SHIND'-lin) says quotes from her written opinions gave the appearance she had commented on the case in interviews. She says a careful reading of each interview will reveal no such comments were made.

A federal appeals court Thursday blocked the judge's order requiring changes to the police department's stop-and-frisk program. It said interviews she gave called her impartiality into question.

The judge ruled in August police discriminated against minorities in stopping and questioning people because of reasonable suspicions crimes were about to occur or had occurred. She ordered major changes.

Supporters say the changes will end unfair practices. The city and other opponents say the changes won't reduce crime.

Source: http://news.yahoo.com/judge-no-questionable-comments-ny-stop-frisk-225923450.html
Category: emmys Ozil alexander skarsgard

Bellator 106 open workout photos

Forgot password?

We'll email you a reset link.

If you signed up using a 3rd party account like Facebook or Twitter, please login with it instead.

Join MMA Fighting

You must be a member of MMA Fighting to participate.

We have our own Community Guidelines at MMA Fighting. You should read them.

Join MMA Fighting

You must be a member of MMA Fighting to participate.

We have our own Community Guidelines at MMA Fighting. You should read them.

Great!

Choose an available username to complete sign up.

In order to provide our users with a better overall experience, we ask for more information from Facebook when using it to login so that we can learn more about our audience and provide you with the best possible experience. We do not store specific user data and the sharing of it is not required to login with Facebook.

Source: http://www.mmafighting.com/2013/10/31/5053042/bellator-106-open-workout-photos
Category: BBM engadget Brian Cushing FOX Sports 1 dairy queen

Pa. residents living above mine fire free to stay

FILE - In this Jan. 26, 1983, file photo, smoke rises from the ground in Centralia, Pa., where and uncontrolled underground mine fire was burning. The attorney for the few remaining residents of the central Pennsylvania coal town that was decimated by a 50-year-old mine fire said on Thursday, Oct. 31, 2013, that they have settled their lawsuit against state officials who have been trying for years to evict them. The settlement allows eight Centralia residents to stay in their homes for as long as they live and it also includes a cash payout. (AP Photo/Rusty Kennedy, File)

FILE -- This Jan. 13, 2010 file photo shows steam rising from the ground around retired Centralia Postmaster Tom Dempsey as he stands in an area that was in Centralia, Pa. The steam is caused by a fire that was still burning underground after it started in 1962 at the town dump and ignited an exposed coal vein. The underground fire eventually forced an exodus of more than 1,000 people, nearly the entire population. The attorney for the few remaining residents of the central Pennsylvania coal town that was decimated by a 50-year-old mine fire said on Thursday, Oct. 31, 2013, that they have settled their lawsuit against state officials who have been trying for years to evict them. The settlement allows eight Centralia residents to stay in their homes for as long as they live and it also includes a cash payout. (AP Photo/Carolyn Kaster, FILE)

FILE - In this Jan. 13, 2010 file photo, the empty town of Centralia, Pa., is seen from above. The attorney for the few remaining residents of the central Pennsylvania coal town that was decimated by a 50-year-old mine fire said on Thursday, Oct. 31, 2013, that they have settled their lawsuit against state officials who have been trying for years to evict them. The settlement allows eight Centralia residents to stay in their homes for as long as they live and it also includes a cash payout. (AP Photo/Carolyn Kaster, File)

FILE - In this Jan. 13, 2010, file photo, an old sign reading "Keep Centralia On The Map" is visible in the entrance of the closed Centralia Municipal Building in Centralia, Pa. The attorney for the few remaining residents of the central Pennsylvania coal town that was decimated by a 50-year-old mine fire said on Thursday, Oct. 31, 2013, that they have settled their lawsuit against state officials who have been trying for years to evict them. The settlement allows eight Centralia residents to stay in their homes for as long as they live and it also includes a cash payout. (AP Photo/Carolyn Kaster, File)

FILE - In this April, 1981, file photo, U.S. Bureau of Mines' John Stockalis, right, and Dan Lewis drop a thermometer through a hole on Main Street in Centralia, Pa., to measure the heat from a shaft mine blaze that was burning under the town. The attorney for the few remaining residents of the central Pennsylvania coal town that was decimated by a 50-year-old mine fire said on Thursday, Oct. 31, 2013, that they have settled their lawsuit against state officials who have been trying for years to evict them. The settlement allows eight Centralia residents to stay in their homes for as long as they live and it also includes a cash payout. (AP Photo/Paul Vathis, File)

The few remaining residents of a Pennsylvania coal town that was largely razed in the 1980s because of an underground mine fire that still burns today have gotten their wish — to be left alone, free to live out their lives there.

A lengthy battle over eminent domain culminated this week when eight residents of Centralia settled their lawsuit against state officials who had been trying to evict them from their condemned homes. The settlement, notice of which was filed in U.S. District Court, allows the residents to stay for as long as they live. It also includes a cash payout of $349,500.

"Everybody got what we wanted, and everybody's happy now," resident Tom Hynoski, 52, said Thursday.

The mine fire was ignited in 1962 and eventually spread to the vast network of mines beneath homes and businesses, threatening residents with poisonous gases and dangerous sinkholes. By the end of the 1980s, more than 1,000 people had moved and 500 structures had been demolished under a $42 million federal relocation program.

But some holdouts refused to go, even after their houses were seized in the early 1990s. They said the fire posed little danger to their part of town, accused government officials and mining companies of a plot to grab the rights to billions of dollars' worth of anthracite coal, and vowed to stay put.

After years of letting them be, state officials decided a few years ago to take possession of the homes. The homeowners fought back with a federal lawsuit.

Hynoski, who has long contended that government corruption involving the coal rights was behind the state's drive to force them out, claimed vindication.

"They bent us, but they didn't break us," he said.

State officials have long denied any such plot to grab the coal rights and say they sought possession of the properties out of public safety concerns.

Last year, a geologist with the Pennsylvania Department of Environmental Protection said the fire may have gone deeper underground but still poses a threat because it has the potential to open up new pathways for deadly gases to reach the remaining homes. But residents say that's nonsense and point out that they've lived for decades in their homes without incident.

The agreement includes $218,000 to compensate residents for the value of their homes and $131,500 to settle additional claims raised in the lawsuit, according to Steve Kratz, spokesman for the state Department of Community and Economic Development, a defendant in the suit.

The mine fire has transformed Centralia into a macabre tourist attraction. There's an intact street grid with almost nothing on it, clouds of steam waft from the cracked earth, and visitors gawk at the ruins of an abandoned highway.

But the homes that remain are neatly kept, and this week's settlement means that Centralia as a town has not yet breathed its last.

"They get to live in their property and enjoy it the rest of their life," said the plaintiffs' attorney, Don Bailey. "We did very well."

Associated PressSource: http://hosted2.ap.org/APDEFAULT/386c25518f464186bf7a2ac026580ce7/Article_2013-10-31-Centralia's%20Final%20Days-Suit/id-8f4d177ca7614257b0a165484ed67fd2
Category: government shutdown zach mettenberger emmys veep Lisa Robin Kelly

This Is the New iPad You Should Buy

Overwhelmed with choice on the iPad front? After the most recent unveil of the new retina iPad mini and its mightier A7 chip-packing cohort, the iPad Air, you have more iPads than ever to choose from. Not sure which one you want? We've got you covered.

Indonesia summons Aussie ambassador over spy claim

SYDNEY (AP) — Australia's ambassador met with Indonesian government officials who summoned him Friday following reports the Australian embassy in Jakarta is a hub for Washington's secret electronic data collection program.

A document from National Security Agency leaker Edward Snowden, published this week by German magazine Der Spiegel, describes a signals intelligence program called "Stateroom" in which U.S., British, Australian and Canadian embassies house surveillance equipment to collect electronic communications. Those countries, along with New Zealand, have an intelligence-sharing agreement known as "Five Eyes."

The Australian embassy in Jakarta was listed as one of the embassies involved in a report from Australia's Fairfax media, along with Australian embassies in Bangkok, Hanoi, Beijing and Dili in East Timor; and High Commissions in Kuala Lumpur and Port Moresby, Papua New Guinea. Des Ball, a top Australian intelligence expert, told The Associated Press he had personally seen covert antennas in five of the embassies named in the report.

Indonesia's government dubbed such actions "a serious breach of diplomatic norms and ethics" and summoned Australian Ambassador Greg Moriarty to a meeting with the Foreign Ministry's Secretary General Budi Bowoleksono on Friday.

"From my perspective it was a good meeting and now I have to go and report directly to my government," Moriarty said afterward.

The reports sparked an outcry from governments across Asia, with officials calling on the U.S. and its allies to explain themselves. The embassy spying allegations follow other reports that the U.S. has spied on the telephone communications of as many as 35 foreign leaders.

"China is severely concerned about the reports, and demands a clarification and explanation," Chinese Foreign Ministry spokeswoman Hua Chunying said Thursday.

Indonesian Foreign Minister Marty Natalegawa said Friday the allegations were deeply concerning and unacceptable.

"Countries may have capacities, technical capacities, to intercept and to carry out the activity that's been reported, and information may have been gathered," he told reporters in Perth, Australia, where he is attending a conference. "But the cost — in terms of trust, in terms of the damage — that may be resulting, is something that we must all reflect on."

According to the Snowden document, the spying sites are small in size and staff. "They are covert, and their true mission is not known by the majority of the diplomatic staff at the facility where they are assigned," it said. The surveillance equipment is concealed, including antennas that are "sometimes hidden in false architectural features or roof maintenance sheds," the document said.

Australian Prime Minister Tony Abbott said only that the government had not broken any laws.

Still, there was predictable outrage in the countries named in the document.

Malaysian Home Minister Ahmad Zahid Hamidi said his government viewed the allegations as a serious matter and would investigate whether the U.S. Embassy in Kuala Lumpur was being used for spying. The country's opposition party issued a statement Thursday urging the Malaysian government to lodge a protest with both the U.S. and Australian embassies.

Thailand's National Security Council Secretary-General, Lt. Gen. Paradorn Pattanathabutr, said the government told the U.S. that spying was a crime under Thai laws, and that Thailand would not cooperate if asked to help eavesdrop.

Asked about the Australian embassy allegations, he said Australians are not capable of doing such sophisticated surveillance work.

"When it comes to technology and mechanics, the U.S. is more resourceful and more advanced than Australia," he said. "So I can say that it is not true that the Australian embassy will be used as a communications hub for spying."

___

Associated Press writers Thanyarat Doksone in Bangkok, Niniek Karmini in Jakarta, Sean Yoong in Kuala Lumpur and researcher Zhao Liang in Beijing contributed to this report.

Source: http://news.yahoo.com/indonesia-summons-aussie-ambassador-over-spy-claim-044510170.html
Category: National Cat Day edward norton Heisenberg dexter liam hemsworth

Creature Feature: The Original Frankenstein Text Is Now Readable Online

In the pantheon of classic horror, Mary Shelley's Frankenstein ranks as one of the first, and most memorable, monster tales ever told. And while it's easy enough to pick up a new copy of the spine-tingling 1818 narrative from pretty much any bookstore, it's now possible to pore over the original, hand-penned manuscript online.