【BOB博鱼】专家怎么看联邦调查局破解苹果手机

In the week since the Federal Bureau of Investigation surprised Apple by saying that it might have found its own way into the San Bernardino gunman’s smartphone, investigators have disclosed nothing about how they did it. 本周，美国联邦调查局(FBI)称之为有可能已自行寻找密码圣贝纳迪诺枪击案凶手智能手机的方法，令其苹果(Apple)深感吃惊。调查人员没透漏他们是怎样做的。

But that has not stopped the security industry from guessing how the iPhone’s security was defeated and who helped the FBI to uncover it. 这令其安全性行业人士不已产生种种猜测，iPhone的安全性防线是如何被突破的？是谁协助FBI关卡的呢？ The speculation is driven by both high-minded concern for the digital security of the public and hackers’ constant desire for bragging rights about who has managed to outsmart the rest. 这些猜测是出于两种高尚的忧虑，一个是对公众数据安全的忧虑，另一个是环绕黑客对撒谎资本——即谁能技高一筹——孜孜以求的忧虑。Staff at Cellebrite, an Israeli mobile forensics company known to have worked for the FBI, have claimed credit in private forums for breaking into Syed Rizwan Farook’s phone, according to two people familiar with the matter. Shares in the company’s Japan-listed parent, Sun Corp, have leapt more than 60 per cent in the past week. 据两名知情人士透漏，有Cellebrite的员工在私人论坛上声称顺利密码了赛义德里兹万法鲁克(Syed Rizwan Farook)的手机。

Cellebrite是一家以色列手机核查企业，以前就为FBI获取过服务。这家公司的母公司，日本上市企业Sun Corp过去一周里股票上涨逾60%。Cellebrite, which has declined to comment on the matter, is one of several forensic security companies specialising in extracting data from mobile devices. Law enforcement agencies look to such businesses for help when extracting data, critical to solving a case. They often pay a high price — in some cases, hundreds of thousands of dollars — for tools that can simplify cracking a smartphone. “The cops basically want push-button forensics,” says Jonathan Zdziarski, an iPhone security expert. Cellebrite是一家专门从移动设备萃取数据的安全性核查企业，该公司对此事不予置评。

执法人员部门在萃取数据时会求救这类公司，提供这些数据对侦破起着关键作用。而执法人员部门为了取得可以非常简单密码智能手机的工具，往往要代价高昂的费用，有时可高约数十万美元。iPhone安全性专家乔纳森兹齐亚尔斯基(Jonathan Zdziarski)回应：“基本上警方只想非常简单地核查。

” As well as researching vulnerabilities themselves, these groups often scour the “grey” hacker market to buy so-called “exploits” they can package up and sell to investigators or companies for security testing. 这些企业除了自己研究安全漏洞，还常常在“灰色”黑客市场物色，出售所谓的“exploit”（漏洞），然后包卖给调查人员或企业展开安全性测试。Marc Goodman, who has worked on cyber security for Interpol and the US government, says law enforcement agencies had long been in an “arms race” with device and software manufacturers to break their security. “This is where law enforcement and criminals have something in common,” he adds. 曾为国际刑警组织(Interpol)及美国政府专门从事网络安全工作的马克古德曼(Marc Goodman)回应，执法人员机构早已与设备和软件制造商进行了“军备竞赛”，以突破它们的安全性防线。他说道：“执法者和罪犯在这一点上有共同之处。” Security experts agree that if the FBI can hack into Farook’s iPhone 5c model, which was running a version of the iOS 9 software released last September, it could gain access to any other device with the same specifications — and most previous models. Some fear the repercussions of the FBI’s disclosure that a previously unknown flaw exists. 安全性专家指出，如果FBI可以入侵法鲁克的iPhone 5C（加装了去年9月公布的iOS 9系统），也许也可以采访其他任何规格完全相同的设备，以及以前大多数型号。

有些人担忧FBI透露苹果手机不存在一个前所不得而知的漏洞不会引起很差的反响。“The fact that there is a confirmed exploit there for a device is certainly going to get a lot of people to look for it,” Mr Zdziarski says. “Damage control is the real question here...The FBI’s biggest mistake has been assuming they can contain this.” 兹齐亚尔斯基回应：“一款设备被证明不存在漏洞，认同不会让很多人想要寻找这个漏洞。

现在最重要的问题是伤害掌控……FBI仅次于的错误就是以为他们可以掌控局面。” It is imperative for Apple to find out what the vulnerability is. Experts are divided on whether the FBI’s technique would have worked on newer iPhones released since 2013, when Apple introduced hardware protection known as a “secure enclave”. 苹果的当务之急是找到这个漏洞。

目前专家们的分歧在于，FBI所使用的密码技术否可用作从2013年起公布的iPhone？苹果在2013年引进了被称作“安全性飞地”(secure enclave)的硬件维护。Mr Goodman says the FBI’s method could probably not be replicated on a mass scale by cyber criminals, because it is likely to require possession of the device. Much simpler methods of tricking people into giving away the contents of their smartphones are widely available, such as persuading them to click on links containing so-called malware. 古德曼回应FBI的方法大约无法被网络犯罪分子大规模拷贝，因为该方法很有可能必须持有人明确设备。

而市面上具有大量引诱人们泄漏自己手机内容的更加非常简单的方法，比如劝说人们页面所含恶意软件的链接。Until technology is developed to enable the hacking to be done remotely, the tactic would probably be used only by state-sponsored entities, such as the US or Chinese governments, searching for “super high-value targets” such as terrorists, he says. “It could be used if you are an American travelling in China and the Chinese want access to your phone.” 古德曼回应，只要远程侵略技术还没有研发出来，FBI的这一手段很有可能不能被有政府背景的实体——比如美国或中国政府——用作找寻恐怖分子这类具备“超高价值的目标”。他说道：“比如你是个美国人，正在中国旅游，中国人想提供你的手机数据，就有可能用于上这种手段。

” Mike Janke, chairman of Silent Circle, which makes an encrypted smartphone called the Blackphone, says he is not surprised the FBI has been able to access the phone with its “tens of millions of dollars of experts”. 加密手机Blackphone的制造商、Silent Circle的董事长麦克扬克(Mike Janke)回应，FBI花费了“数千万美元雇用专家”，他一点不车祸他们能密码手机。He believes they copied the phone’s memory to automatically try different passcodes on the fake version without triggering the 10-passcode limit, in what is called a brute force attack. This method — sometimes known as “Nand mirroring” after the type of memory used in smartphones — might work on newer iPhones, some experts believe. 扬克指出，FBI的专家拷贝了手机内存，然后在仿版上自动试验有所不同密码，而会启动时10次密码容许，也就是所谓的暴力破解法。这种方法有时被称作“Nand镜像法”，源自智能手机的Nand存储器，有些专家指出该方法也许也能用作新版iPhone。

“It is not as hard as people think,” says Mr Janke. “There isn’t a phone in the world that cannot have its hard drive opened like this, all are susceptible.” 扬克说道：“这没人们想象的那么艰难。世上没一部手机无法像这部那样被密码，全都是可以的。” But Adam Ghetti, chief technology officer at Ionic Security, says the FBI is likely to have used a simpler method to get into the iPhone 5c, one that could not be used on newer models. In this scenario, a hacker would have to locate the part of the chip responsible for setting the 10-passcode limit and physically solder on a new connection to a program that could reset it after nine attempts. 但Ionic Security的首席技术官亚当盖蒂(Adam Ghetti)回应，FBI很有可能使用了更加非常简单的方法密码iPhone 5C，这种方法无法在较新机型上用于。该方法拒绝黑客必需寻找芯片上负责管理设置10次密码容许的部分，然后手动焊一条新线路连到一个程序上，该程序可在9次密码尝试后重新启动手机。

Apple is already laying the groundwork to discover the FBI’s method in other court cases involving locked iPhones. On Friday, it wrote to the judge in a New York drugs case asking to delay proceedings in light of the Department of Justice’s sudden discovery. 为寻找FBI的密码方法，苹果已开始在其他牵涉到关卡iPhone的诉讼案件上做到铺垫。上周五，苹果给负责管理一起纽约毒贩案的法官写信给拒绝延期审理，理由就是美国司法部的忽然找到。

本文来源：BOB博鱼-www.hxjgz.net