Apple Watch 2 MITM ...
 
Notifications
Clear all

Apple Watch 2 MITM stealing

30 Posts
4 Users
0 Reactions
3,902 Views
RolfGutmann
(@rolfgutmann)
Noble Member
Joined: 10 years ago
Posts: 1185
Topic starter  

Absolutely. This I call 'married', if Touch ID and A9 (inside Secure Enclave) are divorced, the Touch ID function (unlock or pay with fingerprint) is no more working by design.

But one thing around is to consider. It heavily depends on potential elements like version of iOS (the layer Apple anytime can fix this issue), signed-in or -out of Apple ID (e.g. iTunes or iOSAppStore app),
I also question if this is somehow was related to the point on the lifecycle of the iOS device (NB, U, RNB 😉 see first post, dont hate me pls) and as always not considered states of e.g. shooting down the device before (iOS snapshot, as always background services and functions are running) changing the part, battery connected during replacement or disconnected.

I guess that this was an exceptional case, reproducing did not work and for this, to collaborate and testing as many who are interested in this issue is a key to find, how it can be reproduced (may Apple Sec guys watch this already, if humble enough -)

RoGu


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

Absolutely. This I call 'married',

guess that this was an exceptional case, reproducing did not work

Maybe it was a rare case of cheating with a twin. 😯

I will now claim roll that since the discovery was possible using cellular technology tracking, this example is related and On Topic even if it isn't wink
http//www.mirror.co.uk/news/world-news/scorned-wife-leaves-love-rat-husband-4828218

Hard to reproduce …
)

jaclaz


   
ReplyQuote
RolfGutmann
(@rolfgutmann)
Noble Member
Joined: 10 years ago
Posts: 1185
Topic starter  

rare case yes, but crime tries as hard as I do to reproduce. The domain of law enforcement
is smaller than the dark domain due to no time, but also of missing 'no harm in trail' other
cultural domains have. To run autonomous testing of breaking is the key.


   
ReplyQuote
RolfGutmann
(@rolfgutmann)
Noble Member
Joined: 10 years ago
Posts: 1185
Topic starter  

Who knows the iOS security upgrade details from actual iOS 9.2 to iOS 9.3 (out for devs now)?


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

Bad news (
http//www.theguardian.com/money/2016/feb/05/error-53-apple-iphone-software-update-handset-worthless-third-party-repair

jaclaz


   
ReplyQuote
RolfGutmann
(@rolfgutmann)
Noble Member
Joined: 10 years ago
Posts: 1185
Topic starter  

In Europe we observed a crime gang collecting countrywide broken iPhone 6 devices to get the 'original TouchID sensors' to claim 'compensation' (officially - but crime in mind) against Apple in the months of Sept - Dec 2015. They checked every smartphone repair shop to buy deadly broken iPhones 6. We knew this.

Was to be expected. Apple pushes the level of quality of their iOS devices, specifically with ApplePay in the future in mind, not just half working. To push users into the certified Apple repair process they make sure, that an iOS device over his lifespan remains fully functional in the eyes of the users. 'iPhone 6 and upwards can pay with ApplePay'. Period. No exception.

Branding is not just early adapters and bloggers. Product-based closed repair processes to keep alive the initial functionality will be the future.

Serious. If you replace the user hardware secure element, the product has to fail. Technically spoken.
My heart understands the users very well. But Apple focusses on NEW customers.

Strategically turning point I guess.


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

Serious. If you replace the user hardware secure element, the product has to fail. Technically spoken.
My heart understands the users very well. But Apple focusses on NEW customers.

Strategically turning point I guess.

Hmmm, this seems to me like one of those moves that could seriously affect the whole brand.

One thing is discussing whether the bricking because of the replacement of a part (done not through the authorized servicing/dealers) constitutes either a monopolizing (and forbidden) practice or a (legally acceptable) security measure, another thing is to fail to warn the final user of this risk (which is BTW "retroactive") and much worse than that having the customer loose their data in an unrecoverable way.

I expect a (IMHO deserved) class action against the practice and surely this decision (independently from the strictly legal standpoint) is very likely to make a noticeable dent in the otherwise extremely "faithful" customer base.

As a side question, who is the "we" that noticed this crime gang collecting broken iPhones in Europe?

jaclaz


   
ReplyQuote
RolfGutmann
(@rolfgutmann)
Noble Member
Joined: 10 years ago
Posts: 1185
Topic starter  

Every manufacturer of a mobile device able for mobile payment will behave like We designed the device secure, if you (the user) break it, you have to give it to us, as we make it secure again. The element of 'security' is in mobile payment the best sales argument (as user fear the opposite). So to say 'our product is secure' and this is the basis for class action suites includes to define the rules of this promise. They legally can do very well to say We have to repair it, and cost is high as its a security repair. Apple lawyers did for sure check before, their legal brigades work daily.


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

Every manufacturer of a mobile device able for mobile payment will behave like We designed the device secure, if you (the user) break it, you have to give it to us, as we make it secure again. The element of 'security' is in mobile payment the best sales argument (as user fear the opposite). So to say 'our product is secure' and this is the basis for class action suites includes to define the rules of this promise. They legally can do very well to say We have to repair it, and cost is high as its a security repair. Apple lawyers did for sure check before, their legal brigades work daily.

As said they can say whatever they want and they may well get away from a legal standpoint, but how the customer base will react is to be seen, and in any case, the lack of clear warnings about the matter AND the actual destruction of the data through an OS update is likely to produce some liability.

No info about the "we"? (

jaclaz


   
ReplyQuote
RolfGutmann
(@rolfgutmann)
Noble Member
Joined: 10 years ago
Posts: 1185
Topic starter  

May the 'error 53' blocking is an intermediate step to clean the pipe for ApplePay. After they will warn in the legal disclaimer pages (iOS 9.3 beta 2 (13E5191 d) about 4 pages on 5,5" display) that the replacement of the TouchID from a non-authorized repair office will disfunction the device.

Mobile Payment is crucial to be secure. Any scandals Apple will avoid. They started this process of semi-closing the repair channel years ago as the TouchID replacement 'just' lost functionality of fingerprint and payment authorization, they may now change from semi to full.

To consider the timing of this issue. If users do not have money and are not in the mood to buy - this is the perfect time to announce 'bad news'. Users will forget in being glorified of the new iPhone 7 in Q3 before March 15th iPhone 5se. Security gaps to close is not popular, they just took the best timing.


   
ReplyQuote
Page 2 / 3
Share: