The bumpy road towards iPhone 5c NAND mirroring
The bumpy road towards iPhone 5c NAND mirroring
复制标题
iPhone 5c NAND镜像之路坎坷
DOI：
10.17863/cam.23095
复制
发表时间：
2016
期刊：
影响因子：
--
通讯作者：
S. Skorobogatov
中科院分区：
文献类型：
--
作者：
S. Skorobogatov
本文是对iOS 9下的Apple iPhone 5C密码重试计数器的攻击的现实世界的简短总结。这是通过删除样品手机的Nand闪光灯芯片来实现的，以便物理地访问其与SOC的联系并部分反向工程其专有巴士协议。该过程不需要任何昂贵且复杂的设备。所有必需的零件都是低成本，是从当地电子分销商那里获得的。通过使用所描述的成功的硬件镜像过程，可以绕过密码重试的限制。这是工作原型的第一个公开演示，也是iPhone 5C的真实硬件镜像过程。尽管可以改善该过程，但它仍然是一个成功的概念验证项目。了解镜像的可能性肯定会有助于设计具有更好保护的系统。还揭示了与iPhone 5C中NAND内存分配有关的一些可靠性问题。本文概述了一些未来的研究方向，并提出了一些可能的对策。我们表明，声称iPhone 5C NAND镜像是不可行的。
This paper is a short summary of a real world mirroring attack on the Apple iPhone 5c passcode retry counter under iOS 9. This was achieved by desoldering the NAND Flash chip of a sample phone in order to physically access its connection to the SoC and partially reverse engineering its proprietary bus protocol. The process does not require any expensive and sophisticated equipment. All needed parts are low cost and were obtained from local electronics distributors. By using the described and successful hardware mirroring process it was possible to bypass the limit on passcode retry attempts. This is the first public demonstration of the working prototype and the real hardware mirroring process for iPhone 5c. Although the process can be improved, it is still a successful proof-of-concept project. Knowledge of the possibility of mirroring will definitely help in designing systems with better protection. Also some reliability issues related to the NAND memory allocation in iPhone 5c are revealed. Some future research directions are outlined in this paper and several possible countermeasures are suggested. We show that claims that iPhone 5c NAND mirroring was infeasible were ill-advised.