+- Sinisterly (https://sinister.ly)
+-- Forum: General (https://sinister.ly/Forum-General)
+--- Forum: World News (https://sinister.ly/Forum-World-News)
+--- Thread: Leak Apple SEP keys leaked (/Thread-Leak-Apple-SEP-keys-leaked)
Apple SEP keys leaked - phyrrus9 - 12-15-2019
So, I'm a bit late to the party on this one, but a few days ago on twitter (my take) the SEP key for iPhone11,8 17C5053a was publicly leaked.
The significance here is that this is the first time this has happened, and very interesting to have happened on a CURRENT device (not an old one).
So what does this mean?
In reality, for most people, absolutely nothing. For the talented, it means being able to finally reverse engineer the firmware running on the secure enclave (the secondary processor used for touchID, FaceID, secure storage (passwords), and a few other odds and ends.
This should be terrifying news if you get harassed by TSA a lot. Since the keys are public, the firmware can be decrypted and a secondary firmware can be written that can be used to create backdoors in those systems. Little is known about it right now, it's likely not possible to re-flash the processor in the field, however if there are any security flaws in Apple's original code, they will be found.
Last note: this ONLY effects the iPhone XR running ios 13.3b4, and it's unknown how often Apple changes those keys, or how easy it was to get Apple to leak them.
RE: Apple SEP keys leaked - mothered - 12-16-2019
Quote:the firmware can be decrypted and a secondary firmware can be written that can be used to create backdoors in those systems
In my view, this Is a major security concern that should be addressed a lot sooner than later.
RE: Apple SEP keys leaked - phyrrus9 - 12-16-2019
(12-16-2019, 04:22 AM)mothered Wrote:Quote:the firmware can be decrypted and a secondary firmware can be written that can be used to create backdoors in those systems
In my view, this Is a major security concern that should be addressed a lot sooner than later.
For that one device and OS version, maybe. In general, it's 1 key of 16, and the IV wasn't leaked (but easy to get).
RE: Apple SEP keys leaked - mothered - 12-16-2019
(12-16-2019, 05:13 AM)phyrrus9 Wrote:(12-16-2019, 04:22 AM)mothered Wrote:Quote:the firmware can be decrypted and a secondary firmware can be written that can be used to create backdoors in those systems
In my view, this Is a major security concern that should be addressed a lot sooner than later.
For that one device and OS version, maybe. In general, it's 1 key of 16, and the IV wasn't leaked
Nonetheless, a security Issue that shouldn't exist to begin with.
RE: Apple SEP keys leaked - zorrophreak - 12-17-2019
I saw the massive shit that went down on the subreddit regarding this and kinda found it funny. On the security level, hopefully its not easily reflashable, and if it is, hopefully it requires a full disassembly and not an easy flash over lightning.
RE: Apple SEP keys leaked - phyrrus9 - 12-17-2019
(12-17-2019, 04:08 AM)zorrophreak Wrote: I saw the massive shit that went down on the subreddit regarding this and kinda found it funny. On the security level, hopefully its not easily reflashable, and if it is, hopefully it requires a full disassembly and not an easy flash over lightning.
Odds are no. DIsassembly is no big deal though.
RE: Apple SEP keys leaked - Drako - 12-17-2019
A whopping fail by Apple. But it sucks for the people who can actually do things with the key, because it's a specific iPhone and iOS version.
RE: Apple SEP keys leaked - zorrophreak - 12-17-2019
(12-17-2019, 04:48 AM)phyrrus9 Wrote:(12-17-2019, 04:08 AM)zorrophreak Wrote: I saw the massive shit that went down on the subreddit regarding this and kinda found it funny. On the security level, hopefully its not easily reflashable, and if it is, hopefully it requires a full disassembly and not an easy flash over lightning.
Odds are no. DIsassembly is no big deal though.
Well of course not, but the odds are that no day to day data thief is going to have the time to disassemble without having the phone for a little while. Of course its more of a concern for governments, TSA, and the like.
RE: Apple SEP keys leaked - phyrrus9 - 12-17-2019
(12-17-2019, 05:04 AM)zorrophreak Wrote:(12-17-2019, 04:48 AM)phyrrus9 Wrote:(12-17-2019, 04:08 AM)zorrophreak Wrote: I saw the massive shit that went down on the subreddit regarding this and kinda found it funny. On the security level, hopefully its not easily reflashable, and if it is, hopefully it requires a full disassembly and not an easy flash over lightning.
Odds are no. DIsassembly is no big deal though.
Well of course not, but the odds are that no day to day data thief is going to have the time to disassemble without having the phone for a little while. Of course its more of a concern for governments, TSA, and the like.
Again, disassembly is really no big deal (seconds of work). Understanding it, takes a skilled mind, or tax dollars.