iphone hacks

246 Articles

Replacing The IPhone 6 Button Bricks The Phone

February 5, 2016 by 131 Comments

News comes from The Guardian that the iPhone 6 will break because of software updates due to non-authorized hardware replacements. Several thousand iPhone 6 users are claiming their phones have been bricked thanks to software updates if the home button – and the integrated TouchID fingerprint sensor – were replaced by non-Apple technicians.

For the last few iPhone generations, the TouchID fingerprint sensor has been integrated into the home button of every iPhone. This fingerprint sensor provides an additional layer of security for the iPhone, and like everything on smartphones, there is a thriving market of companies who will fix broken phones. If you walk into an Apple store, replacing the TouchID sensor will cost about $300. This part is available on Amazon for about $10, and anyone with a pentalobe screwdriver, spudger, and fine motor control can easily replace it. Doing so, however, will eventually brick the phone, as software updates render the device inoperable if the TouchID sensor is not authorized by Apple.

According to an Apple spokeswoman, the reason for the error 53 is because the fingerprint data is uniquely paired to the touch ID sensor found in the home button. If the TouchID sensor was substituted with a malicious TouchID sensor, complete and total access to the phone would be easy, providing a forehead-slapping security hole. Error 53 is just Apple’s way of detecting devices that were tampered with.

In fairness to Apple, not checking the authenticity of the touch ID would mean a huge security hole; if fingerprint data is the only thing keeping evil balaclava-wearing hackers out of your phone, simply replacing this sensor would grant them access. While this line of reasoning is valid, it’s also incredibly stupid: anyone can get around the TouchID fingerprint sensor with a laser printer and a bit of glue. If you ever get ahold of the German Defense Minister’s iPhone, the fingerprint sensor isn’t going to stop you.

This is a rare case where Apple are damned if they do, damned if they don’t. By not disabling the phone when the TouchID sensor is replaced, all iPhones are open to a gaping security hole that would send the Internet into a tizzy. By bricking each and every iPhone with a replacement TouchID sensor, Apple gets a customer support nightmare. That said, the $300 replacement cost for the TouchID sensor will get you a very nice Android phone that doesn’t have this problem.

Using Over 3000A To Rapidly Charge An IPhone

January 11, 2016 by 63 Comments

Earlier this week I had the pleasure of doing something very stupid with another YouTuber. We wanted to see what would happen if you push over 3000A through an iPhone. The result? Fire. You get fire.

To perform this experiment we prepared a few different setups for maximum electrocution. The first was with the tried and true technique of re-wrapping a transformer to put out low volts at high current — essentially, a DIY spot welder. Now while most of those use a little transformer taken out of a microwave, I happened to have an industrial transformer about four times the size. Once re-wrapped to become a step-down transformer, it can produce approximately 1000A @ 1V … Or if you plug it into a 240V outlet, upwards of 2000A @ 2V — all depending on the resistance of whatever you’re putting in-between the contacts.

During the actual test we read about 1400A going through the iPhone with an ammeter. Which puts an iPhone 6 at a resistance of about 0.0014 ohms.

Continue reading “Using Over 3000A To Rapidly Charge An IPhone” →

Immersive Theatre Via IBeacons With Dustin Freeman

December 18, 2015 by 2 Comments

Combining backgrounds in math and theater, [Dustin Freeman] works on immersive, interactive theatrical experiences. During the day [Dustin] is a Spatial Interaction Engineer at Occipital, who makes the Structure Sensor. In his spare time [Dustin] works on digital theatre projects that bring the theatre goer far past the traditional row of seats.

The concept of immersive theatre is similar to ‘escape the room’ challenges and choose your own adventure experiences, in that the participants control the outcome of the experience by making decisions from the information supplied to them. [Dustin] explains in his talk that the feeling of trying to beat the clock that exists in escape the room challenges is not helpful in Floodlight’s The Painting. Floodlight is a theatre production company and The Painting is the immersive theatre experience put together by [Joshua Marx], professor of acting at San Jose State and [Dustin Freeman] who presented this 2015 Hackaday SuperConference talk.

Continue reading “Immersive Theatre Via IBeacons With Dustin Freeman” →

Your Unhashable Fingerprints Secure Nothing

November 10, 2015 by 95 Comments

Passwords are crap. Nobody picks good ones, when they do they re-use them across sites, and if you use even a trustworthy password manager, they’ll get hacked too. But you know what’s worse than a password? A fingerprint. Fingerprints have enough problems with them that they should never be used anywhere a password would be.

Passwords are supposed to be secret, like the name of your childhood pet. In contrast, you carry your fingers around with you out in the open nearly everywhere you go. Passwords also need to be revocable. In the case that your password does get revealed, it’s great to be able to simply pick another one. You don’t want to have to revoke your fingers. Finally, and this is the kicker, you want your password to be hashable, in order to protect the password database itself from theft.

In the rest of the article, I’ll make each of these three cases, and hopefully convince you that using fingerprints in place of a password is even more broken than using a password in the first place. (You listening Apple and Google? No, I didn’t think you were.)

Continue reading “Your Unhashable Fingerprints Secure Nothing” →

IPhone Jailbreak Hackers Await $1M Bounty

November 3, 2015 by 33 Comments

According to Motherboard, some unspecified (software) hacker just won a $1 million bounty for an iPhone exploit. But this is no ordinary there’s-a-glitch-in-your-Javascript bug bounty.

On September 21, “Premium” 0day startup Zerodium put out a call for a chain of exploits, starting with a browser, that enables the phone to be remotely jailbroken and arbitrary applications to be installed with root / administrator permissions. In short, a complete remote takeover of the phone. And they offered $1 million. A little over a month later, it looks like they’ve got their first claim. The hack has yet to be verified and the payout is actually made.

But we have little doubt that the hack, if it’s actually been done, is worth the money. The NSA alone has a $25 million annual budget for buying 0days and usually spends that money on much smaller bits and bobs. This hack, if it works, is huge. And the NSA isn’t the only agency that’s interested in spying on folks with iPhones.

Indeed, by bringing something like this out into the open, Zerodium is creating a bidding war among (presumably) adversarial parties. We’re not sure about the ethics of all this (OK, it’s downright shady) but it’s not currently illegal and by pitting various spy agencies (presumably) against each other, they’re almost sure to get their $1 million back with some cream on top.

We’ve seen a lot of bug bounty programs out there. Tossing “firmname bug bounty” into a search engine of your choice will probably come up with a hit for most firmnames. A notable exception in Silicon Valley? Apple. They let you do their debugging work for free. How long this will last is anyone’s guess, but if this Zerodium deal ends up being for real, it looks like they’re severely underpaying.

And if you’re working on your own iPhone remote exploits, don’t be discouraged. Zerodium still claims to have money for two more $1 million payouts. (And with that your humble author shrugs his shoulders and turns the soldering iron back on.)

Move Over Gucci; Laser Cut Handbags Are A Thing

July 13, 2015 by 18 Comments

What happens when you want to make a custom handbag with some handy tech features, and have access to a nice laser cutter? You end up doing what [Christian] did: design a assemble a Woman’s Handbag made of Laser-Cut Leather with iPhone charger and LED Light.

The design of the bag was made in Adobe Illustrator and sent off to a Epilog Legend 36EXT laser cutter located in the hackerspace located near [Christian] in Vienna. Once the parts were precision cut, traditional leather sewing methods were used to assemble the handbag (with a little help from a shoe cobbler).

The interior of the bag was lined with old blue jeans and a white LED, which is wired and held into place with conductive thread. Powered by a coin cell and controlled by your choice of a button, or a slide switch, the light helps locating items in the deep bag.

Slide a standard USB battery pack in one of the pockets of the old jeans and you are ready for a night out on the town. Join us after the break for a video showing the design, construction and features of this practical project.

Continue reading “Move Over Gucci; Laser Cut Handbags Are A Thing” →

Reverse Engineering Apple’s Lightning Connector

February 14, 2015 by 95 Comments

Introduced with the iPhone 5 nearly two and a half years ago, Apple’s Lightning connector has stymied the incredible homebrew electronics scene that was previously accustomed to the larger, older, better documented, and more open 30-pin connector. Now, finally, the protocols inside the Apple Lightning connector have been broken. We’re still a ways off from a Lightning breakout board, but this is the first proof that a serial console can be obtained through a Lightning connector. That’s the first step to totally owning an iDevice, and this is how all those exploits will start.

[Ramtin Amin] began the teardown of the Lightning connector began as most reverse engineering tasks should – looking at the patents, finding a source for the connectors, and any other products that use similar hardware. [Ramtin] found a Lightning to Serial converter powered by an STM32 microcontroller. Disassembling the firmware and looking at the output on a logic analyzer, [Ramtin] figured out part of the protocol, most of the wiring, and after some research, schematics for how an until-now unidentified chip in Lightning-enabled iProducts was wired.

The chip in question is colloquially known as the Tristar, and more accurately as a CBTL1608A1. During the teardown craze of the iPhone 5 launch, this chip was frequently identified as a DisplayPort Multiplexer. It is a mux, but not for DisplayPort – it’s only to connect the accessory (Lightning) UART, debug UART, baseband, SoC, and JTAG. This is the key to the castle, and being able to get through this chip means we can now own our iDevices.

The chip is an incredibly small BGA affair that [Ramtin] desoldered, reflowed onto a breakout board, and connected to an STM32 Discovery board. Using the techniques he used with other Lightning-enabled hardware, [Ramtin] was able to connect his iPhone and ever so slightly peek his head into the inner workings of his device.

It’s not complete control of an iDevice yet, but this is how all those future exploits will start. [Ramtin] uploaded a short video as a proof of concept, you can check that out below.

Continue reading “Reverse Engineering Apple’s Lightning Connector” →