Binh Nguyen's Blog: Apple iCloud Device Locking and General Apple Information

Friday, August 7, 2015

Apple iCloud Device Locking and General Apple Information

If you work in IT you probably have people ask you random questions out of nowhere from time to time. I was recently asked about how to bypass Apple iCloud device locking.

First of all, my opinion of this. I just try to avoid this space (from any perspective). If it sounds too good/cheap to be true it probably is, yadayada...

There does seem to be some tools online to enable checking prior to purchase but obviously even that isn't full proof. For example, if the seller knows that the goods have been locked but never connects to Apple servers then it is impossible/unlikely that the device in question will be locked prior to be the sale. They could feign ignorance also when confronted, law enforcement and the legal system may offer no avenue for recourse, etc...
https://support.apple.com/en-au/HT201581
http://apple.stackexchange.com/questions/62448/find-original-sales-information-of-macbook-by-serial-number
https://www.powermax.com/stolen/index
http://notebooks.com/2011/05/10/how-to-avoid-buying-a-stolen-mac-apple-store-robbed-of-24-macbooks-in-30-seconds-video/
http://www.reddit.com/r/apple/comments/1lfko4/macbook_pro_got_stolen_how_can_i_access_the/
Safe to give out the serial number of a Mac I'm selling?
http://arstechnica.com/civis/viewtopic.php?f=19&t=93200
https://www.icloud.com/activationlock/
http://apple.stackexchange.com/questions/132478/macbook-pro-locked-with-find-my-mac-and-wont-let-me-boot
http://www.cnet.com/au/news/apples-icloud-lock-for-macs-is-not-very-secure/
iPhone 6 Plus Are "Stolen Goods" from Futu_Online eBay Promotion
https://www.ozbargain.com.au/node/205809
http://www.amta.org.au/pages/amta/Check.the.Status.of.your.Handset

If you've been watching this space for a while you'll know that about the Doucli bypass. This seems to work based on MITM (Man in the Middle Attack) principles (I haven't taken too close a look at this).
http://maypalo.com/2014/05/24/doulci-alternative-method-gadgetwide/
http://howtosifiwiki.com/bypass-icloud-account/
http://apple.stackexchange.com/questions/167978/factory-reset-an-ipad-without-knowing-the-icloud-password

For those who don't know what this is is that any communications that go from Apple to your device now go through a third party (Doucli). Doucli filters out any traffic which relates to iCloud locking or simply inserts a different set of communications which can then unlock the device. For anyone who knows how this is done this can be extremely tedious and difficult especially if the defender has taken extensive counter-measures against attack.

If you are interested in possible avenues of attacking it here goes:
- preventing it from locking your device should be simple enough. Don't connect it to the Internet and allow it to hook up with Apple servers. Earlier versions of the Doucli hack depend on DNS host file hacking. Later version of Apple software seems to block this behaviour though. Easiest way around this is to setup a layered defense/attack with DNS re-directs occuring at multiple points between you and Apple whether it may be via software (relevant configuration files, virtual machines, containers, etc...) and/or hardware (networking hardware, servers, etc...)
- the network/server setup of Apple systems is such that the authentication servers may not be isolated from the store purchases making things slightly more difficult (there are plenty of programs out there to do this). If you must use a second/intermediary system to which downloads music/software and use this to transfer to another system which is never connected online. This allows you to have the benefits of the purchasing online while not having to deal with iCloud authentication issues. Your device can not be locked without relevant identifying information being transferred between yourself and Apple (obviously, if this becomes a widespread means of bypassing iCloud then they'll be counter-measures which are deployed, etc...)
- the game keeps on changing. As cracks in the protocol/system are identified attackers and Apple have to continually change the game. If you really want to understand it, you're best trying to understand live packet manipulation and reverse engineering/cracking or DRM systems
- I've looked at this and for me the easiest way to attack is via direct hardware if your device is locked. It requires no advance knowledge of the software/protocol and is reliant entirely on the way in which data is stored on the device itself (obviously, this only makes the problem slightly easier to deal with). It's similar to the way in which firmware reset mode works on embedded devices such as eBooks and to the way in which bypass is achieved in physical security systems. The only troubling thing may access. They're BGA! Realistically this could mean that this type of attack is neigh on impossible (I think it may be possible though. When I have dead hardware lying around I often play around with it. A single copper fibre and the right type of signal/voltage may be enough to create the type of data corruption that I require). Effectively, the type of attack that I envisage revolves around storage corruption. Since, everything is stored via a combination of encrypted keys at multiple layers my belief is that destroying/corrupting the storage and restoring iOS clean and bypassing Apple servers is easier than engaging in a continual race against Apple (making the assumption that restoration of iOS can be completed independently of iCloud lock checking)
http://dtbnguyen.blogspot.com/2012/07/if-only-reading-were-easier.html