7

According to Ars Technica,

Jonathan Zdziarski, a leading independent Apple iOS security researcher and forensics expert, has a theory about the FBI's newly discovered potential route into the iPhone 5C used by San Bernardino shooter Syed Farook. In a blog post, Zdziarski wrote that the technique the FBI is planning to use to get around having to compel Apple to help bypass the phone's security is likely a method called NAND mirroring—a hardware-based approach that, while effective, is far from the "golden key" software the FBI had sought.

This has been repeated in a number of other news outlets.

From what it sounds like, it won't be unlike what @user9806 posited a month ago.

However, as @Xander notes:

Yes, it is possible. However, that runs the risk of destroying the device without getting the data off first, which is undesirable.

Which leads me to wonder, what processes are involved in this technique? What exactly does "NAND mirroring" involve that prevents the chip from being destroyed?

Improve this question

1 Answer 1

Reset to default
9

Basically NAND mirroring means that they're opening the phone up, de-soldering the memory chip, copying it off (the "mirroring" bit) and then they either solder it back into the phone, or more likely into a socket in phone that's been deconstructed into a test harness. This way they can try to brute force the PIN to their hearts delight, and if they run into any difficulties (too many invalid tries wipe the memory, or cause unreasonably long delays before allowing additional tries) and they just re-flash the chip with the original copy of the data that doesn't know any of this has happened, and try again. Rinse and repeat until the correct PIN is found, and the phone unlocks.

As to not destroying the phone, it's safe to presume that they've bought a batch of test phones, and practiced the technique to the point where they're fully confident there are no gotchas, and it will safely succeed.

Improve this answer
2
  • 2
    Would it be possible for them to speed up the attack by making a copy of the data on the original NAND chip, flashing the data to multiple memory chips and replacing the NAND memory chips of new test iPhones with the copies and try different passcodes on each of those phones? Since all iPhones of a particular model share the same hardware, would this work or is there a way for the phones to detect tampering?
    – Vinayak
    Commented Apr 9, 2016 at 19:40
  • 2
    @Vinayak no they cannot. Brute force operation must be performed on the device itself. The encryption keys are tied to devices unique ID and that cannot be extracted from the device.
    – b4da
    Commented Feb 2, 2018 at 6:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .