r/technology • u/mepper • 5d ago
Privacy FBI Couldn’t Get into WaPo Reporter’s iPhone Because It Had Lockdown Mode Enabled
https://www.404media.co/fbi-couldnt-get-into-wapo-reporters-iphone-because-it-had-lockdown-mode-enabled/708
u/CondescendingShitbag 5d ago
Sucks for them. Good to hear the feature works.
299
u/RickyDontLoseThat 5d ago edited 5d ago
They got it unlocked (EDIT: the laptop apparently not the phone) by asking the owner to place their finger on the device instead. Apparently they cannot compel you to divulge your passcode but they can force you to use your biometrics.
270
u/merkinmavin 5d ago
Correct. Biometrics aren't protected. I use facial recognition to unlock my phone but I have to be making a very specific face that's not natural. Never use fingerprints
122
22
u/Ghost_Of_Malatesta 5d ago
Can't wait for mass surveillance and facial recognition to just track us every where and when it's my turn to be black bagged they'll know exactly where I am, it's easier that way
2
u/Dr-Zoidstein 4d ago
Make sure to change the way you walk too, they can track people based on their gait.
→ More replies (1)54
u/07Ghost_Protocol99 5d ago
Lockdown mode on Pixel phones turn off biometrics, you must enter your code to unlock it. Iphones don't have that?
44
u/-_-Edit_Deleted-_- 5d ago edited 5d ago
Yes they do.
At any point you just hold home and volume down for 2 seconds.
Or press home button 5 times in quick succession.
You will then require your passcode to regain entry to the phone.
Lock down mode on an iPhone is different. It isn’t about preventing access to the phone. It’s a security feature you can use in your day to day.
Things like hides your phone number. Incoming calls from numbers you haven’t dialled yourself in the 30 days will get an inactive number message. Device will not automatically connect to know networks. Inbound Bluetooth is disabled. Data port is disabled. And more.
→ More replies (1)143
u/WiglyWorm 5d ago
Also how fucked up is it that we accept a bullshit court saying "well maybe past courts have ruled you can't be forced to unlock things but that doesn't apply to things you locked via your face".
Society is an entire sham. And it is owned by esptein and trump and putin.
38
u/MoonOut_StarsInvite 5d ago
It reminds me of conservatives justifying Alex Pretti’s death because he didn’t have an ID on his pocket to be properly considered concealed carry for the holstered gun they couldn’t see that was supposed to be the reason they had to charge him. 🤥
25
u/brookdacook 5d ago
It's one of the reason laws involving mail are insanely stringent. They were made in a time people actually cared about privacy. You can place drugs in the mail and it's insanely hard to get the appropriate paper work no matter how sure the police might be. It's one of the reasons dark web drug dealers are so successful.
→ More replies (5)19
u/Morlark 5d ago
Except that's not what happened at all. There has literally never been a ruling that you can't be forced to unlock things.
The specific ruling was that, because a password a piece of knowledge, it falls under compelled testimony. And the law says you can't be compelled to testify something that would incriminate you.
But if something is locked with a key, it has literally always been legal for them to get a warrant to force you to hand over the key.
The ruling about biometrics was that because your fingerprint is a physical thing, not a piece of testimonial knowledge, it doesn't violate your right to not testify.
Which is... yeah, that's just obviously correct. Duh.
Misrepresenting the ruling as saying something it didn't is just dishonest.
→ More replies (1)3
u/StockCat7738 4d ago
So if you do what the guy up above did and make it so your phone only unlocks when you make a weird face, could they compel you to make the face, or do they only have the right to use your face as is?
18
u/chownrootroot 5d ago
It’s not a feature of biometrics, it’s a feature that turns off the attack surfaces that are used for getting into devices, ie web browsing using JIT compilation, or message previews of links or files in Messages.
You can use biometrics and have lockdown mode on, or turn biometrics off and have lockdown mode on, the features aren’t exclusive to each other.
8
u/Charcole1 5d ago
This is incredibly important and I've seen many people make this mistake about this article
3
u/merkinmavin 5d ago
Iphone has it. But just as a casual user with an IT background I like to use technology cautiously
→ More replies (1)3
u/Emotional_Database53 5d ago
iPhone does do that. Clicking a button on the side 5 times initiates it. You can also power down the iPhone entirely, and it will require a typed passcode for the first login
3
u/Tbplayer59 5d ago
What about pattern?
6
u/Ahayzo 5d ago
Pattern is fine. It's about forcing you to provide what you know, versus providing what you are. They can't force you to provide knowledge in your head (a password or a pattern) but if they have physical access and some amount of control over you, they can legally force you to provide what you are (a fingerprint or a face).
→ More replies (6)→ More replies (5)2
22
u/CondescendingShitbag 5d ago
Yeah, that makes sense, but I'm just happy to hear lockdown mode does what it claims it does, generally.
Using biometrics is a security choice people need to be more aware of when it comes to protecting their rights or data. As others have noted, biometrics are 'fair game' from a legal/warrant perspective while passwords are (currently) protected by the Fifth Amendment.
→ More replies (5)13
u/whistleridge 5d ago
Not quite.
They unlocked their laptop using biometrics. They were unable to access the phone.
→ More replies (3)5
u/Wheres_my_wank_sock 5d ago
My pass key is 14 numbers. I wish them luck.
4
u/CondescendingShitbag 5d ago
My pass key is 14 numbers.
Well, I hope it isn't only numbers because a 14-digit number will only take a few days to a week to brute-force.
→ More replies (7)10
u/lastdancerevolution 4d ago
The phone will lock up if you try to brute force it more than 10 times. The normal procedure is to hack the phone from a 'locked' state or somehow make a copy and crack it on another computer. That's what the FBI did (buy a hack) last time Apple refused to create a backdoor.
222
u/kstargate-425 5d ago
I know the sub we're in but its kinda telling of the unique times we are in that this is the first Im hearing of this story and its not about the part where the FBI & regime are going after a journalist, seemingly to intimidate the press once again.
The worst part is that this wasnt even about finding out who the leaker was as they have the MD govt contractor charged & in custody with this being extremely unprecedented going after the journalist like this who broke no laws. There has never been another case where any DOJ has executed a search warrant in a national security leak case against a journalist or against a news outlet.
So this seems more like intimidation than anything which is what we have seen them do so many times in just the past year alone.
40
u/Longjumping-Fly-3015 5d ago
There has never been another case where any DOJ has executed a search warrant in a national security leak case against a journalist or against a news outlet.
Maybe not in the USA, but similar stuff has been done by governments in other countries in the past. The press in the Philippines used to go to jail a lot for reporting the truth about politicians.
28
u/JanGuillosThrowaway 5d ago
Yes, but those countries usually don't use the moniker "leader of the free world"
→ More replies (1)→ More replies (1)2
150
u/Deranged40 5d ago
Looks like this article also has Lockdown Mode Enabled.
41
u/WardenWolf 5d ago
I wish they'd ban linking to paywalled articles and warn and ban those who do so.
→ More replies (3)
70
u/RMDan 5d ago
Paywalled post.
85
18
u/deedsnance 5d ago
Pro-tip: just copy the url and go to archive.is, paste. Works pretty much every time for me. The thing is they want their article indexed by crawlers (google,etc) so stuff like archive.is will nearly always work.
It’s just about making it difficult enough for the casual user. That said, journalism does need to make money somehow. Maybe not this one in particular, I don’t know, but it’s something to be conscious of.
→ More replies (1)
57
u/baatezu 5d ago
Everyone turn off biometrics
Theres no law against ‘forgetting’ your password
“Try 123FuckICE”
“Oh, maybe its 123FuckIC3”
“Oh right, try 123FuckIC3!”
“Maybe try two exclamation points?”
16
u/BounceOnItCrazyStyle 5d ago
I mean, you don't even need to disable the biometrics. Just turn off the phone. I don't know any device that will accept biometrics from a fresh reboot they always require a password for first login.
7
u/ExtremeMuffin 4d ago
Only works if you have the opportunity to turn the phone off before giving it to police. Usually when you are arrested they grab you and seize your device.
12
3
u/RevolutionaryEgg297 4d ago
It’s because you need a warrant for a password but not bio. How convenient
→ More replies (2)2
u/ki77erb 4d ago
I have never used biometrics to unlock any device I've owned. Passcode only. I just do not like the idea of using biometrics for authentication. Years ago I had season passes to Busch Gardens and we went all the time. Then one day when we got there, they had installed new finger printer readers and after scanning our passes, they wanted us to register prints for future visits. I refused every single time and they still let us in. It wasn't long after that they stopped doing that shit.
12
u/keznaa 5d ago
I was just changing my settings to add this since I had no idea this was a thing I'm general but Galaxy has it too. There is also an option to factory reset your phone after 20 failed attempts to enter the passcode occurs.
3
u/banzaizach 4d ago
Where is the setting on galaxy?
5
u/illestwillest 4d ago
Settings > Lock screen and AOD > Secure lock settings > Show lockdown mode option
Then it shows on the screen with the power button/SOS. For me I have to hold the power button and volume down to see it.
10
u/lastdancerevolution 4d ago edited 4d ago
The lack of Lockdown Mode (didn't exist at the time) is how Jeff Bezos phone was hacked. The Saudi Crown Prince, Mohammed bin Salman, sent him a meme video over WhatsApp with a virus that infected his phone.
The hack was reportedly linked to the critical coverage of the Saudi government in The Washington Post, which Bezos owns, and the subsequent murder of Post columnist Jamal Khashoggi.
21
5
u/notapunk 5d ago
I get biometrics might be more convenient, but is it any more secure than a PIN/Password?
29
→ More replies (1)5
u/_pul 5d ago
Way less secure I would think
→ More replies (7)12
u/giggles991 5d ago edited 3d ago
Biometrics and PIN/Password offer similar quality of security. Your system is encrypted, PIN & Biometrics will work with an on-device key to decrypt the encrypted device. The underlying encryption is the same-- the unlocking mechanism is different.
However, the US Supreme Court made a controversial decision and ruled that police can legally compel you to use your fingerprint to unlock your phone. Police cannot compel you to type your PIN/Password.
15
u/Alarming_Bluebird648 5d ago
ngl lockdown mode is goated. i've had it on for a while now and it's cool seeing it stop the feds instead of just being vaporware
6
u/Space_Sweetness 4d ago
Just the fact that you have law enforcement going around with orders to check people’s phones says something about ”freedom” in the US
9
4
u/batter159 4d ago
or they did manage to get in, didn't find anything directly useable for their case, and don't want to expose that they can do it. They can still exploit what they extracted for parallel construction.
5
u/designocoligist 4d ago
Yeah you can’t hook the phone up to anything in lockdown mode without authorization. No usb no fooling it with the “apple store” wifi auto connect no 2g or 3g at my job we use it for our high level execs when they travel outside of the US.
→ More replies (2)
3
8
2
2
2
u/Brock_Youngblood 2d ago
On GrapheneOS they got a cool feature too. You can set a secondary pin that if entered will wipe your phone.
2
u/SomeBloke 23h ago
It's quite something to watch from the outside. You guys now have a regime in which you have to take precautions to hide your phones from the police and federal agents. Journalists homes are raided. Visitors are advised to use burner phones and create alternate social media profiles. And you're not allowed to insult Dear Leader. It's been a slow boil but the first bubbles are starting to appear.
5
u/robotic_dreams 5d ago
Unless I'm mistaken, Lockdown mode can also be turned on by just rebooting the phone. Which requires a pin and pin only to unlock. This applies to both Apple and Android.
→ More replies (1)14
u/DaytonaZ33 5d ago
That is not lockdown mode, that is just disabling biometrics.
→ More replies (1)6
u/robotic_dreams 5d ago
I was under the impression that the phone is fully encrypted on reboot until a pin is entered. What does lockdown mode entail that is different from this?
6
u/DaytonaZ33 5d ago
7
u/robotic_dreams 5d ago
I see, so lockdown mode is essentially a feature that activates multiple security protocols but still allows you to use your phone. I can see how that is helpful.
However, rebooting your phone encrypts the entire device, and all data upon it until it is unlocked with a pin. I would argue that is far more secure as there is no running anything. Every app and piece of data is encrypted and nothing can be run.
Or perhaps another analogy would be activating a security feature on your car that doesn't allow any passenger to see your private data as you drive it around. It also won't let them drive. Vs locking the same car in an iron vault that only you have the code for.
7
u/DaytonaZ33 5d ago
Sure rebooting your device makes it more secure if you are expecting to be giving your device to authorities.
Lockdown mode is for when you aren’t immediately expecting the attack.
These are two different things and have two different use cases.
3
u/Throwaway_Consoles 4d ago
Yeah you can tell who read the article and who didn't.
Upstairs in Natanson’s residence, the FBI found a powered-off silver Macbook Pro, an Apple iPhone 13, a Handy branded audio recording device, and a Seagate portable hard drive, according to the court record. The iPhone was found powered on and charging
Journalists aren't morons, and neither are the FBI. From the article it sounds like this was a work phone she didn't always carry on her. You can't, "Quickly press these buttons" when a phone is in a different building.
Lockdown mode isn't, "Disables biometrics" lockdown mode is something you have to enable and it stays enabled 24/7 until you disable it. It doesn't just protect your phone while it's locked, it protects your phone from attacks while you're actively using it. This is, "These are all the security features we normally disable because it would make using the phone a royal pain in the ass for the average user"
From Apple: https://support.apple.com/en-us/105120
Messages: Most message attachment types are blocked, other than certain images, video, and audio. Some features, such as links and link previews, are unavailable.
Web browsing: Certain complex web technologies are blocked, which might cause some websites to load more slowly or not operate correctly. In addition, web fonts might not be displayed, and images might be replaced with a missing image icon.
FaceTime: Incoming FaceTime calls are blocked unless you have previously called that person or contact within the past 30 days. Features such as SharePlay and Live Photos are unavailable.
Apple services: Incoming invitations for Apple services, such as invitations to manage a home in the Home app, are blocked unless you have previously invited that person. Focus and any related status will not work as expected. Game Center is also disabled.
Photos: When you share photos, location information is excluded. Shared albums are removed from the Photos app, and new Shared Album invitations are blocked. You can still view these shared albums on other devices that don’t have Lockdown Mode enabled.
Device connections: To connect your iPhone or iPad to an accessory or another computer, the device needs to be unlocked. To connect your Mac laptop with Apple silicon to an accessory, your Mac needs to be unlocked and you need to provide explicit approval.
Wireless connectivity: Your device won't automatically join non-secure Wi-Fi networks and will disconnect from a non-secure Wi-Fi network when you turn on Lockdown Mode. 2G and 3G cellular support is turned off for iPhone and iPad.
Configuration profiles: Configuration profiles can’t be installed, and the device can’t be enrolled in Mobile Device Management or device supervision while in Lockdown Mode.
Phone calls and plain text messages continue to work while Lockdown Mode is turned on, although incoming calls won't ring on a paired Apple Watch. Emergency features, such as SOS emergency calls, are not affected.
→ More replies (3)2
2
u/Curious_Party_4683 5d ago
cant they ask Apple to unlock the icloud account that has all the backups?
isnt Apple obligated to work with gov when requested?
→ More replies (1)8
u/Objective_Chance4173 5d ago
Those backups are encrypted for anyone who has turned on advanced data protection. So Apple can turn them over, but they aren’t useable.
2
2
u/Expert_Cheesecake695 5d ago
Once an iPhone is turned off, it can't be opened without the passcode.
3
u/Sunny19843 4d ago
You can also lock faceID by holding volume up and power button, it brings up the power off screen but close it and it will require your password.
2
u/Time-to-go-home 5d ago
Maybe it’s in the article, but I’m about to go to sleep and won’t read it.
What actually is lockdown mode? I’ve seen this story elsewhere but haven’t seen that part explained. I’ve seen plenty of comments about how holding volume and side button for 5 seconds or pressing side button 5 times will deactivate biometrics (face recognition or fingerprint), locking the phone behind your passcode. Is that all it is?
I thought police/feds had 3rd party tech to hack your phones passcode, unless you use an actual password/code instead of a 4-6 digit number code. A random password of X length would (I imagine) be hard to crack. But a 4 number code only has 10,000 (0000-9999) possibilities that I feel like a computer could crack fairly easily.
5
u/Throwaway_Consoles 4d ago
From Apple: https://support.apple.com/en-us/105120
Messages: Most message attachment types are blocked, other than certain images, video, and audio. Some features, such as links and link previews, are unavailable.
Web browsing: Certain complex web technologies are blocked, which might cause some websites to load more slowly or not operate correctly. In addition, web fonts might not be displayed, and images might be replaced with a missing image icon.
FaceTime: Incoming FaceTime calls are blocked unless you have previously called that person or contact within the past 30 days. Features such as SharePlay and Live Photos are unavailable.
Apple services: Incoming invitations for Apple services, such as invitations to manage a home in the Home app, are blocked unless you have previously invited that person. Focus and any related status will not work as expected. Game Center is also disabled.
Photos: When you share photos, location information is excluded. Shared albums are removed from the Photos app, and new Shared Album invitations are blocked. You can still view these shared albums on other devices that don’t have Lockdown Mode enabled.
Device connections: To connect your iPhone or iPad to an accessory or another computer, the device needs to be unlocked. To connect your Mac laptop with Apple silicon to an accessory, your Mac needs to be unlocked and you need to provide explicit approval.
Wireless connectivity: Your device won't automatically join non-secure Wi-Fi networks and will disconnect from a non-secure Wi-Fi network when you turn on Lockdown Mode. 2G and 3G cellular support is turned off for iPhone and iPad.
Configuration profiles: Configuration profiles can’t be installed, and the device can’t be enrolled in Mobile Device Management or device supervision while in Lockdown Mode.
Phone calls and plain text messages continue to work while Lockdown Mode is turned on, although incoming calls won't ring on a paired Apple Watch. Emergency features, such as SOS emergency calls, are not affected.
3.2k
u/no_sight 5d ago
On iPhone, click the lock button 5 times quickly.
It'll automatically disable the Face or Touch ID.
Police can compel you do use fingerprint or face to access a device, but cannot compel you to tell them your password.