Cops in Detroit are sending out a warning about what they suspect is a new security feature in iOS 18.
  • humanspiral@lemmy.caEnglish
    0·
    4 days ago

    Speculation is that ios 18 is communicating with other phones while locked to determine security. This can more likely be a NSA/US empire backdoor than a user protection feature. Lowly police systems are just not on the “hacker list”. One way the backdoor could work is that if a “NSA/Mossad list phone” is present, protect the other phones, unless the phones are in an NSA/Mossad secure facility.

  • ERROR: Earth.exe has crashed@lemmy.dbzer0.comEnglish
    0·
    6 days ago

    Android has an app that you can install that auto wipes a phone after X amount of time if the phone hasnt been unlocked:

    https://f-droid.org/en/packages/me.lucky.wasted/

    Also theres an app that allows you to set a fake password that wipes the phone:

    https://f-droid.org/en/packages/me.lucky.duress/

    All open source, I have tested these apps on my phones, they work great. The second app about the duress password is a bit glitchy and didnt work on some of my phones.

    Disclaimer: I am not a lawyer and setting your phone to automatically wipe itself may be considered destruction of evidence in a court of law.

      • ERROR: Earth.exe has crashed@lemmy.dbzer0.comEnglish
        0·
        5 days ago

        For the “Wasted” app:

        1. Check the box saying “Wipe Data” (you can optionally check wipe eSim if yiu also want that to happen)

        2. Tap the bottom button saying [Off] which would ask you to give permission to the app as a Device Administrator, giving it the power to wipe your device.

        3. Tap the gear button on top right

        4. Scroll down to the “Lock” and check that

        5. Tap the upper left button with the 3 horizontal lines

        6. Tap the “Lock” menu option

        7. Enter a value. I personally would use something like 24 or 48 hours. Note that 24H automatically becomes 1D in the app, idk why but thats just some weird quirks with the app.

        For the Duress app, it doesn’t really work anymore on the phone I’m using, so you might have to do your own testing.

        Edit: Make sure you dont get drunk and passed out for 24 hours because then your phone gets wiped lol. Good luck, I didn’t make the app so be careful with it, don’t blame me if your accidentally get your device wiped when you didnt want it to.

        Edit 2: Also you cant really know if these apps works on your particular phone unless you test it yourself, that means wiping it. So you might wanna back up your phone then trigger the wipe to see if it works. Dont wanna get caught at a protest only to find out the app failed.

      • ERROR: Earth.exe has crashed@lemmy.dbzer0.comEnglish
        0·
        5 days ago

        Well they might charge you with “Obstruction of Justice” instead. Then plug it in some cellebrite device and boom, unlocked.

        Best way to not have to deal with stuff like this is just to not have the incriminating evidence in the first place. If you are, for example, doing a protest, only chat with contacts in a safe place, then wipe chat logs every time, any data you wish to keep should be encrypted then uploaded anonymously via VPN/Tor and wiped from local storage. Hide the fact that such data exists so you wouldn’t have a scenario where the government is trying to get you to give them the data, since they dont even know what data exists. Plausable deniability.

        Edit: Those apps I’ve linked is still a good idea since “Destruction of Evidence” is probably a lesser charge than something like “Rioting”.

          • ERROR: Earth.exe has crashed@lemmy.dbzer0.comEnglish
            0·
            3 days ago

            That’s what they say. I mean the news literally base this off the FBI’s own words, so there’s no way for us to tell if they actually manage to break the encryption but then turns around that say “the encryption is too strong”. Besides, iOS is closed source.

            Intelligence agencies have made this “Anom Phone” that is this supposed encrypted phone that drug dealers and various criminals used to communicate, turned out to be a honeypot.

              • ERROR: Earth.exe has crashed@lemmy.dbzer0.comEnglish
                0·
                3 days ago

                There are different versions.

                One is where they sell the cellebrite device to law enforcement.

                Another where the cellebrite device remain in control of cellebrite, and law enforcement has to send the phone to cellebrite.

                Unless you actually work for cellebrite and got access to their more advanced tools, which then I doubt they would let you share the details of since that must be breaking some non-disclosure agreement.

          • Echo Dot@feddit.ukEnglish
            0·
            4 days ago

            There are attacks where rather than trying to crank the password you just capture the hash which is stored in memory somewhere and then using a tool that lets you bypass the standard login inject that hash into the app, totally bypassing the UI interface and the password hashing algorithm.

            The app sees the hash is correct and isn’t aware that the information has been input via nonstandard methods, and so allows access.

            The attacker still doesn’t have a clue what your password was, but they don’t need to. Interestingly enough this means that every time they want access to your data they have to do this because they don’t have a way of actually changing the password or finding out what it was.

          • Passerby6497@lemmy.worldEnglish
            0·
            5 days ago

            It might work that way, actually .

            Just because the phone is encrypted doesn’t mean there’s not an exploit that makes it easier to bypass or extract the passphrase. Celebrite is unfortunately pretty good at attacking out of support phone and breaking into them.

            Use a modern, supported OS on a device put out by a trusted vendor and you’re probably ok. But old software/hardware makes it much easier to bypass.

    • shortwavesurfer@lemmy.zipEnglish
      0·
      6 days ago

      This is not for devices where the pin has been entered incorrectly too many times. This is for devices that the police have seized and are awaiting forensics to pull data from.

  • snooggums@lemmy.worldEnglish
    0·
    6 days ago

    The police could just ask Apple, it isn’t like they are going to have some secret reboot process that they would hide from the police.

    • bamboo@lemm.eeEnglish
      0·
      6 days ago

      And what would Apple be able to do about it? They don’t have your password*, so they’ll be just as unable to decrypt the device as the police.

      *you can give them your password via iCloud I believe but you don’t have to

      • snooggums@lemmy.worldEnglish
        0·
        6 days ago

        I’m not saying apple will do anything about it, just that they will let the cops know what is causing the reboots if asked.

  • metaStatic@kbin.earth
    0·
    6 days ago

    this is the police we’re talking about, they probably just forgot to charge them and are trying to shift the blame

  • shortwavesurfer@lemmy.zipEnglish
    0·
    6 days ago

    I guess if you have the 10 seconds to do so, you could invoke the operating system hard reboot function, which at least on Android is pressing and holding power and volume up for 10 seconds. I don’t know what it is on the iPhone.

    Edit: Too bad there’s not some sort of haptic to let you know that it accepted the command before it shuts down though.

      • shortwavesurfer@lemmy.zipEnglish
        0·
        6 days ago

        Does it or does it just simply disable biometrics but leave it an AFU? I would hope that if it’s going to disable the biometrics, that it would put it in BFU. But I do not know.

        • TragicNotCute@lemmy.worldEnglish
          0·
          6 days ago

          I don’t know how it works under the hood, but from a user perspective it behaves like it’s in BFU. Biometrics disabled, phone code required.

          • shortwavesurfer@lemmy.zipEnglish
            0·
            6 days ago

            Yeah, don’t get me wrong. Disabling the biometrics and requiring the pin is a good step. But I would like to see somebody test it to figure out whether it actually goes into BFU mode or not.

  • SpaceNoodle@lemmy.worldEnglish
    0·
    6 days ago

    Someone said it in another thread yesterday, baseband memory leak. The firmware for that shit is terrible, I’ve had to deal with it in the past.

    • shortwavesurfer@lemmy.zipEnglish
      0·
      6 days ago

      Apparently, there’s at least a chance that it is an intentional feature instead of a bug. There’s a comment link below somewhere in this thread that mentions it.

  • Rukthag@lemmy.worldEnglish
    0·
    6 days ago

    Note to those wishing for such a function, it’s possible by creating an iOS Shortcut - New Shortcut > Shutdown > Change it to ‘Restart’.

    From there, you create an automation in Shortcuts to run based on time, location, etc.

      • shortwavesurfer@lemmy.zipEnglish
        0·
        6 days ago

        You could always take 10 seconds and invoke the operating system’s hard shutdown command if you have the 10 seconds to spare. On Android at least, that’s pressing and holding power and volume up for 10 seconds. But I do not know what it would be on the iPhone.

    • shortwavesurfer@lemmy.zipEnglish
      0·
      6 days ago

      It would be best if the function was like if the phone has not been unlocked for at least 16 hours then reboot automatically. A time thing would be a problem though because then it would just reboot every day and that would be no fun.

      • Rukthag@lemmy.worldEnglish
        0·
        6 days ago

        I saw elsewhere this is a new feature in iOS 18.1, so it will probably pretty solid I’d think. But for shortcut wise, at minimum I suppose one could put automations that trigger when it detected within certain geofences or something… but then whenever you drive by your local police station it will kindly reboot your phone every time lol

        • shortwavesurfer@lemmy.zipEnglish
          0·
          6 days ago

          What if they thought you would do that and specifically took it to a police station that you did not have a geofence for? Mind you, they wouldn’t necessarily know. But it’s not impossible.

          • whithom@discuss.onlineEnglish
            0·
            6 days ago

            It also might not be taken to a police station. Who knows where the actual forensics labs are. No real need for them to be on-site or even labeled.

            • shortwavesurfer@lemmy.zipEnglish
              0·
              6 days ago

              If you have the 10 seconds, you could use the operating system’s hard reboot function, which at least on Android is pressing and holding power and volume up for 10 seconds. But I don’t know what it is on the iPhone.

              • whithom@discuss.onlineEnglish
                0·
                6 days ago

                Power and volume up for new phones, and then power and home for older ones with Touch ID.

                Also, so you know, if you press power 5 times it will ask if you want an emergency call, say no, but after you do it your PIN is required to unlock. No biometrics work at that point. So, no one can force you to touch or look at it. I don’t know if it puts the phone in that “mode” or not, but it’s a handy trick.

                • shortwavesurfer@lemmy.zipEnglish
                  0·
                  6 days ago

                  Yeah, I knew that that was available, but I do not know whether it puts the phone in the before first use mode, like you mentioned, or just disables the biometrics, but leaves the device in after first use mode.

  • shortwavesurfer@lemmy.zipEnglish
    0·
    6 days ago

    Anything to make their job harder is perfectly okay by me. The only thing that would be needed would be for this to be a feature and to have a cool down period of like 48 hours where the phone would reboot twice in that time so that if it was held it would still reboot itself.

    • shortwavesurfer@lemmy.zipEnglish
      0·
      6 days ago

      Which is the saddest part, honestly. If it was a feature, that would be fantastic news. And especially if it had a cooldown feature of like 48 hours, where it would reboot twice in that timeframe, so that if a cop turned off the setting, while it was in their possession, it wouldn’t matter because it would reboot anyway.