Skip to content

Comment on Cellebrite claims it can unlock any iPhone, many new Android phones for policeparent

Comments

The radios quite probably use DMA to blast bits to/from main memory.

Get code execution on the radio chip, use that to harvest the decryption keys from RAM and the rest is pretty trivial.

From the iOS security whitepaper:

To protect the device from vulnerabilities in network processor firmware, network interfaces including Wi-Fi and baseband have limited access to application processor memory. When USB or SDIO is used to interface with the network processor, the network processor can’t initiate Direct Memory Access (DMA) transactions to the application processor. When PCIe is used, each network processor is on its own isolated PCIe bus. An IOMMU on each PCIe bus limits the network processor’s DMA access to pages of memory containing its network packets or control structures.

Of course there's always the chance that there's a bug in one of these interfaces

And on Android: ¯\_(ツ)_/¯ Even for the Google Pixel I can't find a security whitepaper, just a blog post with a couple of vague bullet points.

Isn't the key in a part of RAM only accessible through the Secure Enclave? (As in, you shouldn't be able to set up DMA to certain ranges.)

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.