If FBI busts into seized iPhone, it could get non-iCloud data, like Telegram chats

The FBI sent Ars a statement late Saturday further clarifying its role in resetting the iCloud password on the seized iPhone 5C central to the San Bernardino terrorism investigation.

Earlier in the day a spokesman for the San Bernardino County Health Department confirmed to Ars that his agency changed the iPhone’s associated iCloud password at the request of the FBI. That action had the unintended effect of making any further iCloud backup attempts impossible, likely frustrating the terror probe. The San Bernardino County Health Department, which owns the phone, was shooter Syed Rizwan Farook’s employer.

However, the Saturday evening statement, written by FBI Los Angeles Field Office spokeswoman Laura Eimiller, also claimed that "we know that direct data extraction from an iOS device often provides more data than an iCloud backup contains." She did not respond to further questions by phone and e-mail.

The latest FBI statement directly contravenes what an Apple executive, who was granted anonymity, told reporters on Friday afternoon: That if the iPhone had backed up to iCloud as Apple had suggested, then the data that the FBI may have been able to recover would be precisely the data that it is currently trying to get directly off of the phone that Farook used.

Ars spoke with three iOS security experts at length. They agreed that Apple’s statement is theoretically correct only if the bureau performed just a classic Cellebrite-style direct data extraction. Doing that would produce the same data as an iCloud backup. However, there might be other information and data on the phone that the FBI could access if agents could break the passcode and decrypt the phone. After all, bypassing that passcode limit is precisely what the FBI has asked Apple to do.

Last week, Apple was given an unprecedented court order—under an obscure 18th century law known as the All Writs Act—to create custom firmware for the iPhone 5C that was used by Farook. That new firmware would remove a possible automatic wipe feature on the phone if a passcode is incorrectly entered 10 times and would remove a delay between passcode attempts intended to make brute-force entry more difficult. If Apple does comply, it would allow the government to enter PIN codes in rapid succession until it gained access to the phone. Apple CEO Tim Cook has publicly said it will resist this attempt, calling it a significant "overreach." A court hearing has been scheduled for March 22 in Riverside, California.

Pwned two-factor authentication?

So, what information on the phone wouldn’t be available as part of an iCloud backup? There are a handful of applications that Farook may have had installed on the phone that don’t associate with iCloud. The FBI has not said publicly what it expects to find on the phone.

"Signal Messenger isn’t going to back up your messages to iCloud and since they’re end-to-end encrypted, the only place they’re going to be is on the phone," Dan Guido, the CEO of Trail of Bits, a security firm, told Ars.

Another possible app that the FBI may want to see running on the phone could include Telegram, another messaging app that has been known to be associated with Islamic State radicals. Telegram, however, has an optional app-specific passcode that protects access to the app even if the phone is unlocked.

"That would be a thing that me as an FBI agent would be concerned about," Guido added. "Maybe [Farook] communicated on it, so we need to get access to the phone. That’s a reasonable line of thinking for an FBI agent to make."

With access to installed apps like Signal and Telegram, the FBI may want to know who else Farook was communicating with, and what was said, which could open up other avenues or confirm other details about who he was communicating with.

According to John Adams, a former security official at Twitter, with access to the phone itself, the FBI may also be able to access Farook’s two-factor authentication apps, if they exist. For example, having data from the Google Authenticator app could potentially give the FBI access to his Gmail account.

"They gain a massive amount of functionality and visibility of the user that they didn’t have before," he said.

Slow down, turbo

Ars learned Friday that Apple had suggested that the FBI try to force the iPhone to perform an iCloud backup by taking it to a previously used Wi-Fi location, plugging it into an electrical wall socket, and leaving it overnight. Because the iCloud password was reset four days after the attack by the San Bernardino County Health Department, at the behest of the FBI, the possibility of forcing the phone to perform an auto-backup to its associated iCloud account was eliminated.

On Saturday, Apple declined to answer Ars’ question as to whether the company was consulted prior to the iCloud password reset.

The FBI has been doggedly trying to extract a missing six weeks worth of data from the iPhone since its last iCloud backup on October 19, 2015. No one knows why there were no further backups subsequent to that date, but the same Apple executive described Farook’s iCloud backup history as "sporadic."

Guido, the iOS security expert, also noted that it was foolish for the FBI to suggest that San Bernardino officials reset the iCloud password rather than simply wait for Apple to hand over iCloud data as part of a normal legal request.

"Any investigator knows that you can make a simple request to Apple—you don’t need to reset the password," he added. "It was likely a panicked response and they thought they could get the data faster than Apple could give it to them. That, unfortunately, was probably not the best idea."

For his part, a third iOS expert, Jonathan Zdziarski, who wrote a book called iPhone Forensics, speculated to Ars that the FBI is "hiding the fact that there's going to be a second [court] order to complete the [data] acquisition."

In a blog post published late Saturday night, Zdziarski theorized that federal prosecutors may try to expand their court order, and demand that Apple perform a physical extraction and decryption of all the data that currently sits on the phone.

As he wrote:

In other words, if the FBI is planning to have Apple perform a physical extraction of this extra data, then they are forcing Apple to create this backdoor tool for a separate reason, as it is completely unnecessary if Apple will be forced to extract the contents of the device in the end. It would also mean that they’re hiding all of this extra work from both the courts and from Apple, possibly because the combination of the two [All Writs Act] orders would have constituted "unreasonable" assistance in the court’s view. It completely modifies the purpose of the first order as well; we’ve now gone from having a single tool with a very specific purpose to having two separate tools to create a modular platform for FBI to use (via the courts) as each piece becomes needed.