FBI reportedly bought exploit from hackers to access San Bernardino iPhone

The agency is still working through questions about sharing the vulnerability with Apple

The FBI reportedly paid professional hackers a one-time fee for a previously unknown vulnerability that allowed the agency to unlock the iPhone of San Bernardino shooter.

The exploit allowed the FBI to build a device capable of brute-forcing the iPhone's PIN without triggering a security measure that would have wiped all of its data, the Washington Post reported Tuesday, citing unnamed sources familiar with the matter.

The hackers who provided the exploit to the FBI find software vulnerabilities and sometimes sell them to the U.S. government, the newspaper reported.

Previous media reports suggested Israeli mobile forensics firm Cellebrite was the unnamed third party that helped the FBI unlock Farook's iPhone 5c. That was not the case, the Post's sources said.

In February, a judge ordered Apple to write special software that could help the FBI disable the iPhone's auto-erase protection. Apple challenged the order, but in late March the FBI dropped the case after successfully unlocking the iPhone using a technique acquired from an unnamed third-party.

Last week, speaking at Ohio’s Kenyon College, FBI director James Comey said the unlocking tool the agency used works only "on a narrow slice of iPhones," such as the 5c and older models.

That's probably because newer models store cryptographic material inside a secure hardware element called the secure enclave, first introduced in the iPhone 5s.

The FBI did not immediately respond to an inquiry seeking confirmation on whether the agency bought the iPhone 5c exploit from professional hackers.

However, the existence of a shadowy and largely unregulated market for exploits not reported to software vendors is no secret. There are hackers and security researchers who sell "zero-day" exploits to law enforcement and intelligence agencies, often through third-party brokers.

In November, a vulnerability acquisition firm called Zerodium paid US $1 million for a browser-based zero-day exploit that could fully compromise iOS 9 devices. The company shares the exploits it acquires with its customers, which include "government organizations in need of specific and tailored cybersecurity capabilities," according to the company's website.

The files leaked last year from surveillance software maker Hacking Team included a document with zero-day exploits offered for sale by an outfit called Vulnerabilities Brokerage International. Hacking Team sells its surveillance software to law enforcement agencies along with exploits that can be used to silently deploy the software on users' computers.

It's not clear if the FBI plans to eventually report the vulnerability to Apple. During the discussion at Kenyon College last week, Comey said the FBI is still working through that question and other policy issues related to the tool it obtained.

In April 2014, after reports of the National Security Agency stockpiling vulnerabilities, the White House outlined the government’s policy on sharing exploit information with vendors. There is "a disciplined, rigorous and high-level decision-making process for vulnerability disclosure" that weighs the pros and cons between disclosing a flaw and using it for intelligence gathering, Michael Daniel, special assistant to the president and cybersecurity coordinator, said in a blog post then.

Some software vendors have set up bug bounty programs and pay hackers for privately reporting vulnerabilities found in in their products. However, the rewards paid by vendors cannot compete with the amount of money that governments can and are willing to pay for the same flaws.

"I would rather vendors not try to compete in the bidding, but rather focus on eliminating the market entirely by creating secure products from the very beginning," said Jake Kouns, chief information security officer at vulnerability intelligence firm Risk Based Security, via email.

Software vendors should instead "invest significant money, energy, and time" into training developers on secure coding practices and reviewing code before releasing it, he added.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?