Apple has come under pressure to scrap its controversial policy of permanently disabling repaired iPhone 6s when software is upgraded, following a global consumer backlash and claims the company could be acting illegally.
...
The Apple iOS 9 software update which it launched last autumn will, in the jargon, “brick” the handset if it detects that the touch ID fingerprint recognition and/or the home button is not the original. Some victims had had their phones repaired by third-party contractors. Others had simply damaged their handset. In most cases the phone had been working normally for weeks or months before the software upgrade shut down the handset.
So, here's a quick break down of this, with a bit of technical jargon.
In your iPhone (5, 5S, 6(+), 6S(+)) there is a chip called the Secure Element. This is a small CPU with memory and storage, which is designed to be super secure. It's physically tamper resistant and walled off from the rest of the device. It's designed to hold things like
- Passwords
- Your PIN (you do have a pin on your phone right?)
- Fingerprint data
- Apple Pay credit card numbers (now it gets interesting, right?)
- Encryption keys for the disk encryption
- Policies and permissions as to who, how and what can get this information
When you use TouchId or the PIN to login, the fingerprint info or PIN is sent to the Secure Element, which decides if it's valid or not, and "unlocks itself" (in this case, gives back the info the other part of the phone requested)
So for a PIN login, it might look like this:
- Phone (to secure element): here's the 6 digit PIN, can I please have the disk encryption key so I can start up? And can can you stay unlocked for "less secure" stuff?
- Secure element: Sure, that's the PIN value I have, lets do it.
For TouchId (and ApplePay as they are linked), it's a little different:
- Phone: hey everyone, I'm in a state where you can validate with a fingerprint (eg the lock screen or TouchId login to an app). Can you tell me when someone does a valid TouchId please?
- (later) TouchId Sensor: Hey, secure element, here's a fingerprint!
- Secure Element: thats valid. Hey phone, here's the encryption keys to login!
All of this chain relies on a chain of trust. The system trusts that the Secure Element is secure, and the Secure Element needs to trust the fingerprint reader is the one it has been setup to expect input from.
So if you go and replace the fingerprint reader with a new one, its no longer trusted until you also update the Secure Element. Apple can do this when they repair a device. Most 3rd parties can't, at least not on the 6S-era devices.
So, the conversation above changes to
- Phone: hey everyone, I'm in a state where you can validate with a fingerprint (eg the lock screen or TouchId login to an app). Can you tell me when someone does a valid TouchId please?
- (later) TouchId Sensor: Hey, secure element, here's a fingerprint!
- Secure Element: Who the hell are you? Error 53!
This is obviously a total simplification, but it illustrates the problem and the reasons, I think.
For someone who has had their phone repaired by "not Apple", this is super inconvenient - to the point of litigation. They now have a $NZ 1000 glass and 7000-series aluminium paperweight.
Apple needs to deal with this. There are a couple of ways they could do that:
- They could allow 3rd parties to do the repairs, then the user to go into the Apple Store and have the button "verified" after the user's information is checked (ie, validate id). As they only sell replacement screens to verified repair places, this is workable.
- They could show a rather more helpful error than Error 53
- They could check it BEFORE allowing the OS to be upgraded. Maybe warn the user immediately "your hardware is no longer standard and will break on the next OS upgrade". A lot of people will ignore it, but then it's their own fault.
My money is on this being a problem with repair places reusing old screens in other phones. So rather than replacing your broken screen with a new one from Apple, they take another phone apart (maybe it had the camera broken, but the screen is fine), and use the screen from that. That TouchId button is tied to the old phone, and boom.
Update: iFixIt has an article on it which looks like I'm about right.
We'll see how they deal with it. Apple don't rush and announce things until they have a solution, and it's early days still.
However, lets look at the other side of this. Apple are all about device security, including preventing law enforcement getting a court order to have them unlock a phone. Because the PIN (or fingerprint) controls the unlocking of the Secure Element, there is NOTHING Apple can to do unlock a phone. No backdoors. This is a good thing, especially if you are in a sensitive position like a journalist who doesn't want to, or can't, reveal their sources to the police (think Nicky Hagar if you happen to be in NZ). Or worse someone in an oppressive country where they, and their family and contacts, would be killed if the authorities got the information.
So while this is getting into NSA spook country, imagine, and this is NOT an especially far fetched scenario, an NSA spook grabs the target's iPhone while they are "indisposed". They quickly disassemble the phone and replace the TouchId sensor with one which also records the fingerprint data and puts it to the side. They then give the target their phone back.
The target logs into their phone, unknowingly giving the NSA their login fingerprint. They then steal the phone back, and can get in.
The only far fetched bit of this is how quickly they'd have to replace the sensor - but they have $billions budget and some of the smartest people on the planet, so I'm sure they could do it if they needed to.
This is something Apple is actively wanting to prevent. If the trusted hardware is tampered with - replacement TouchId sensor - the phone SHOULD distrust it. It has to - otherwise the whole system is broken.
This is an extreme example, but not that extreme. This is why Apple's perfectly valid response (in software) is Error 53 and the phone is bricked. They are going to have to deal with it in a more customer friendly way, but fundamentally, it's the right thing to do for people security, even if it's so, so the wrong way to handle it.
