Jonathan Zdziarski

And, importantly, you can trigger it immediately instead of waiting an hour. Since around iOS 11 this USB lockout and “require pin, not FaceID/TouchID” used to be 5 clicks of the power button, and triggered it immediately. Also brings up an emergency button no matter what you were doing. After this screen, pin is required. Prior to this Lockdown mode, for best results you also may want to use Apple Configurator or JAMF Free or similar to block other ways of “recovering” access. Before iOS 11’s USB lockout, this “pair locking” was the best way of helping block forensics tools: https://www.zdziarski.com/blog/?p=2589

As a counterpoint, I do recommend installing your own Supervised MDM profile onto your iOS device. This will: - prevent the installation of any other MDM profiles (such as a work profile) - allow you to pair-lock your device, which will prevent any forensic tools from accessing your device (for instance if it gets taken by police or at a border crossing, even if you're forced to give up your password, they won't be able to image your device or do other scans). iOS security researcher (now Apple employee) Jonathan Zdziarski has a blog post on it: "Counter-Forensics: Pair-Lock Your Device with Apple’s Configurator": https://www.zdziarski.com/blog/?p=2589

It's worth reading his response to Apple's latest documentation - http://www.zdziarski.com/blog/?p=3466

Mr Zdziarski gave this talk also at the HOPE conference yesterday. It's highly recommended. Slides: http://www.zdziarski.com/blog/wp-content/uploads/2014/07/iOS_Backdoors… For the people wanting to secure their iphone, go to the end to the slide "Apple Configurator" and follow the described steps to disable your iphone from paring with anything.

I could be wrong but this story was made public by a simple blog post by a guy who decided to crack open the OnStar TOS update he received by email. http://www.zdziarski.com/blog/?p=1270 The Internet is an amazing thing!

I've spent the last 4 years doing development from a 2012 macbook air with 8 gigs of ram. Its been totally fine, except when I've got a million chrome tabs open. (Declaring bankrupcy and closing them all at once feels great though.) The posted article is about a mac version of visual studio. Coincidentally, visual studio only runs in 32 bit mode and hence can only make use of 4 gigs of ram total: https://blogs.msdn.microsoft.com/ricom/2015/12/29/revisiting-64-bit-ne… The article is worth reading. They (correctly) have kept asking "why does VS need more ram than that?" and just optimize the code when the footprint grows bigger. And I'm genuinely confused by all these people complaining about 16 gigs of ram not being enough. If you have a laptop today with 16 gigs of ram, have a look. Do you actually run out of ram while working? (And if so, what on earth are you running?). It looks like its genuinely hard to fill 16 gigs without chrome or slack running. Look at all the stuff you can fit in that much ram: https://www.zdziarski.com/blog/?p=6355 I'm also a big fan of pushing app developers to fix their cruft. Maybe in 2016 its not ok to have apps that suck up as much ram as possible. Maybe app developers shouldn't write super inefficient software just because next year we'll have bigger computers anyway. Maybe if you're writing software (any kind of software) that really does need more than 16 gigs of ram to work effectively you should fix…

> This is a personal, spare-time project ... I very much admire and appreciate the work you've done bootstrapping Abot in your spare time. Now that Microsoft is in the game, my concern is we will see a "tower of babel" type of situation develop for bots emanating from the corporate behemoths (i.e., here come the Facebook bots, Google bots, Amazon of course, and Apple might play catch up too at WWDC). I much prefer grass roots growing from open source projects like Abot so as to no be locked in (financially, legally, cognitively) to one platform run by a large corporation seeking world domination. Forensics specialist Jonathan Zdziarski wrote an interesting post recently titled "Free Software Always Costs Something" it is a good read -> http://www.zdziarski.com/blog/?p=5948 Perhaps Abot would benefit from having its own Foundation similar to the likes of, say, the Apache Software Foundation https://www.apache.org/ ... "The Apache Software Foundation provides support for the Apache Community of open-source software projects, which provide software products for the public good." As Satya Nadella commented in this recent Bloomberg interview http://www.bloomberg.com/features/2016-microsoft-future-ai-chatbots/ how app stores and Facebook remind him of the walled gardens of 25 years ago (e.g., AOL and CompuServe), its what he didn't say (intentionally omitted?) in this interview which strikes me as more interesting. The rise of chat bots and Nadella's views about them remind…

A more informative technical explanation is given here: http://www.zdziarski.com/blog/?p=4140 TL;DR: Pirated OSX apps with components that listen for iphone usb connections, which then gathers some metadata from the phone, and if the phone is jailbroken, it also grabs actual data (imessages etc) by uploading an ios backdoor component that hooks onto the commonly installed mobilesubstrate jailbreak helper. Also, for non-jailbroken iphones, it uses an enterprise adhoc distribution certificate to install additional ios apps which apparently has been backdoored - article doesn't specify which apps, but apparently there's a risk that one could replace well-known apps like facebook by using the same bundle-id as the legit ones. I guess the user will be prompted on first run to accept the enterprise cert. All in all it doesn't appear to exploit any vulnerabilities, just using existing features for what they are worth.

> Poorly written, over-priced assumptionware. https://www.zdziarski.com/blog/?p=3717

I don't know anything about Grayshift boxes, but you can pair-lock your iPhone so it can't be accessed by devices that connect to it physically.[0] Note that there are some downsides like not being able to restore from a backup from a date before you pair-locked the device, and only being able to backup and restore from that device. (Better hope it never dies!) But if you've got a burner phone you don't want authorities to be able to get into (unless they take the device it's locked to, as well), it's a workable solution. [0]https://www.zdziarski.com/blog/?p=2589

Jonathan Zidarski (now at Apple) had a really good post on the approaches to handle security checkpoints [1]. It's enlightening and at the same time depressing. [1] https://www.zdziarski.com/blog/?p=6918

From the top of my head: * Pair locking [1] * Updates for longer than 18 months [2] 1: https://www.zdziarski.com/blog/?p=2589 - There was a more up to date guide but I can't find it. 2: https://www.businessinsider.com.au/apple-ios-10-iphone-software-update…

Just wanted to point this blog article out. https://www.zdziarski.com/blog/?p=6355 The author tested Xcode and ran "four production Objective-C projects, all cleaned and rebuilt."

Zdziarski's "iOS Forensic Investigative Methods"[0] is a free eBook which can be helpful if you're interested in native penetration testing. [0]: http://www.zdziarski.com/blog/?p=2287

Zdziarski seems to think it is quite dangerous. Thoughts? http://www.zdziarski.com/blog/?p=6046 I see the limitation clause and so forth, but some of the language still seems pretty broad and dangerous. In fact the way it is worded, it nearly contradicts itself, calling for "design limitation" yet requiring things that will inevitably require a design change. Which part of that contradiction would be upheld in the event this becomes law?

Incorrect -- they requested an "instrument", which carries with it all sorts of legal requirements beyond creating an in-house tool. Source: http://www.zdziarski.com/blog/?p=5645

Already better-reported yesterday: https://news.ycombinator.com/item?id=11336155 Here's the direct link to Zdziarski's blog entry explaining this: http://www.zdziarski.com/blog/?p=5966

It isn't as simple as creating the tool, read this blog post that was linked elsewhere in this thread that explains why they can't just create and delete the tool. http://www.zdziarski.com/blog/?p=5645

In support of this, someone forwarded me a very interesting article written by someone who creates forensic software for a living. The legal requirements surrounding the creation of a software tool for forensic purposes, which this proposed effort requested by the government might fall under, are nothing less than herculean in scope. http://www.zdziarski.com/blog/?p=5645

Yes, this is very naive. They're actually asking for a forensic instrument - asserting that it is for a one-time use is absurd on the face of it. The most thorough deconstruction of this argument I've seen is here: http://www.zdziarski.com/blog/?p=5645

To play the devil's advocate, LE can get a court order to search your house, your car, your file folder, tap your phone, and so on, and that's viewed as fair by most people, since there are some checks and balances: they have to convince a judge (we're not talking about the secret NSA court stuff), and have to stick to some rules when they do it. Why should they not be able to search phones on a case by case basis, with a court order? That's something reasonable people are going to ask. Edit: This is a pretty good analysis of why turning over a tool to the FBI is a terrible idea: http://www.zdziarski.com/blog/?p=5645 - but the FBI is saying they don't want that. The guy in the blog disagrees. Let's say they meant what they said and everything stays inside Apple. Why shouldn't a court be able to order a search?

To me this post explained a lot of the legal side of the issue: http://www.zdziarski.com/blog/?p=5645 I think it may have been on HN earlier.

The FBI said it was 100% totally fine with giving the phone to Apple and just having remote access to the phone in this one specific case. It's really up to the court to decide that, and this post makes the argument that it may not be possible to keep the tools under wraps if the case progresses: http://www.zdziarski.com/blog/?p=5645

> Is it easy to randomize your MAC? It would appear to be: http://www.zdziarski.com/blog/?p=2738

According to this writeup, that may be worked around by resetting the device after every few attempts: http://www.zdziarski.com/blog/?p=5106 (penultimate paragraph)

Thank you, I knew I was missing something. Also, I found that iOS 8 (mostly) fixed the backdoor: http://www.zdziarski.com/blog/?p=3820

http://www.zdziarski.com/blog/?p=4056 is the direct link to the post

Pretty interesting - this must have changed in iOS 8. At least according to Jonathan Zdziarski Apple previously had the ability to bypass the iPhone encryption for law enforcement if the phone was physically sent to Apple [1]. [1] http://www.zdziarski.com/blog/?p=2589

Please allow me to refer to http://www.zdziarski.com/blog/?p=3466, Jonathan Zdziarski is far more qualified than I am to provide further information.

The researcher's response to Apple's statement: http://www.zdziarski.com/blog/?p=3447