Hacker successfully deciphers part of "Touch ID" "Black Box" on iPhone and makes it public



The fingerprint authentication system "Touch ID" which appeared on the iPhone 5s and increased the security level of the smartphone at a stretch realized high performance by using a dedicated chip, but there is a problem that a certain hacker tries to control the system I succeeded in decoding and I am disclosing its contents.

Hacker claims to have decrypted Apple's Secure Enclave, destroying key piece of iOS mobile security - TechRepublic
http://www.techrepublic.com/article/hacker-claims-to-have-decrypted-apples-secure-enclave-destroying-key-piece-of-ios-mobile-security/

Hacker Releases iPhone 5s Secure Enclave Decryption Keys
http://wccftech.com/iphone-5s-secure-enclave-hack/

Successfully deciphering the Touch ID is a hacker called "Xerub" on the net that it succeeded in completely decrypting the decryption key of Secure Enclave Processor (SEP) implemented in Touch ID equipped with iPhone 5s Published on Twitter. Among tweets, links for Github with binaries uploaded etc are included.


SEP is a processor and its system independent from the iPhone itself, and it operates with the OS "SEPOS" including its own kernel, driver and application. SEP itself has a function to generate Unique ID (UID), which means that it plays an important role in enhancing security. UID is tied to a temporary key which is changed every time the terminal is activated, thereby making the security high.

SEP is protecting this UID, and because it is an independent entity, we have established an environment that can safely operate even in the case of important authentication such as fingerprint authentication by Touch ID and settlement authentication. In other words, the whole system of Touch ID operates as a "black box", thereby realizing higher security.

ByAndychiu

Xerub fears against the fact that TechRepublic wrote, "The fact that SEP was made invisible by being encrypted, does Apple have insufficient confidence to make SEP unencrypted? Although I do not deny that the degree of security increases by obfuscating, I do not think that it is a good idea to rely on it. "It is extremely serious that the SEP firmware was released It seems to be able to say that it is an event.

However, in this way, hackers can hack the security system (the fact) that if the back side is returned, even though the system was destined to be broken some time, the fact that it can no longer be prevented completely It can be said that it exists in. Xerub says, "Decrypting the firmware itself is not the same as decrypting the user's data," Apple's job is to make SEP as secure as possible.This is an endless job , And there is no point that can say "100% safe with this already."

In response to this incident, Apple spokesperson said that subject to anonymity, customer data will not be affected by SEP's disclosure of the key, "There are more security layers in SEP Even if access to the firmware becomes possible, we can not access the data protection class information, "he says, indicating that there are more protective walls.

Related Posts:

in Mobile,   Software,   Hardware,   Security, Posted by darkhorse_log