With Apple vowing to resist all the way to the Supreme Court the FBI’s demands for an iPhone backdoor in the San Bernardino case, many people assume the company is motivated purely by principles and concern for their customers.
No doubt these are key reasons for Apple’s stand, and I have great admiration for Tim Cook’s leadership on this matter.
At the same time, it’s important to recognize another motivation at play. It’s one that Apple and the other tech giants supporting Cook against the FBI all share but, for understandable reasons, cannot discuss in public. Unfortunately, their silence on this topic only contributes to public confusion around what’s at stake now.
To put it briefly and bluntly: The iPhone is already vulnerable to hackers around the world. So are Android-based devices and other smart-device platforms. In fact, the U.S. government is late to a party long dominated by black hat hackers working for themselves or even more nefarious parties. The FBI’s order has only brought this sensitive issue to a head.
Here’s why:
The iPhone already has backdoors Apple hasn’t yet closed.
Image: Bryce Durbin
I’m aware of at least one instance where black hat hackers have been able to extract data from an iPhone with a recent OS by directly accessing it through critical flaws that enable a backdoor into, and data extraction from, a designated device.
I cannot publicly share specific details beyond this, other than to say this breach was uncovered by a member of the hacker community. I’m also unable to confirm whether the hacking method would work on the latest iOS operating system.
However, as suggested by the recent New York case, in which Apple was able to access data on a device running an older OS, dedicated hackers are bound to find workarounds to backdoor the latest version, too.
And this is just one potential backdoor among many. Indeed, there’s a veritable underground market for 0 day iPhone vulnerabilities found by hackers and put on sale to the highest bidder — or secretly kept in reserve, to use as a potential cyber weapon against Apple down the road.
With these, hackers can, for instance, quietly connect and extract data from a user’s device without their knowledge, control it remotely or even spy on their daily activities. Apple has said that creating a backdoor for the FBI would put iPhone owners on a slippery slope of security intrusions. It is more accurate to say that the iPhone has been careening down that slope for quite some time.
Which brings me to a related point:
The U.S. government lost the backdoor race long ago.
It is ironic that many in the tech community decry the FBI’s court-ordered request for an Apple-produced backdoor, because it’s the only government body to make this request to the company through official channels.
Meanwhile, many foreign governments have long been secretly working with black hat hackers to create unauthorized backdoors into the iPhone, usually without Apple’s knowledge or control, seeking the ability to access documents of officials from rival governments. (Senator Bernie Sanders may not care about Secretary Clinton’s damn emails, but I can assure him that many people in the black hat underground surely do.)
This raises another irony: With so many trying so hard to access the iPhone already, an FBI-ordered backdoor will only assist their efforts. Once created, black hats will surely increase their attacks on the FBI and Apple, hoping to ferret out clues to this entrance route. It is almost certain they will eventually succeed.
Given all of this, it’s much easier to understand why Apple is fighting with such tenacity to prevent the iPhone’s security from becoming even weaker.
A system is only as secure as its most vulnerable link, and becomes geometrically less secure with each additional vulnerability. Devices and software associated with Google, Facebook and Microsoft are just as vulnerable as the iPhone (if not more so), which I believe partly motivates the amicus briefs they have filed on behalf of Apple.
A majority of Americans understandably assume the U.S. government’s demand for a backdoor is a reasonable request to make us safer from terrorist attacks. If they understood how profoundly insecure and under threat all their devices already are, I believe their thinking on the topic would instantly change.
It is a final irony that the FBI has inadvertently exposed the U.S. tech industry’s Achilles’ heel — and threatens to make our devices even more vulnerable to those who wish to do us harm.
