FBI reportedly bought exploit from hackers to access San Bernardino iPhone

The FBI reportedly paid professional hackers a one-time fee for a previously unknown vulnerability that allowed the agency to unlock the iPhone of San Bernardino shooter.

The exploit allowed the FBI to build a device capable of brute-forcing the iPhone’s PIN without triggering a security measure that would have wiped all of its data, the Washington Post reported Tuesday, citing unnamed sources familiar with the matter.

The hackers who provided the exploit to the FBI find software vulnerabilities and sometimes sell them to the U.S. government, the newspaper reported.

Previous media reports suggested Israeli mobile forensics firm Cellebrite was the unnamed third party that helped the FBI unlock Farook’s iPhone 5c. That was not the case, the Post’s sources said.

In February, a judge ordered Apple to write special software that could help the FBI disable the iPhone’s auto-erase protection. Apple challenged the order, but in late March the FBI dropped the case after successfully unlocking the iPhone using a technique acquired from an unnamed third-party.

Last week, speaking at Ohio’s Kenyon College, FBI director James Comey said the unlocking tool the agency used works only “on a narrow slice of iPhones,” such as the 5c and older models.

That’s probably because newer models store cryptographic material inside a secure hardware element called the secure enclave, first introduced in the iPhone 5s.

The FBI did not immediately respond to an inquiry seeking confirmation on whether the agency bought the iPhone 5c exploit from professional hackers.

However, the existence of a shadowy and largely unregulated market for exploits not reported to software vendors is no secret. There are hackers and security researchers who sell “zero-day” exploits to law enforcement and intelligence agencies, often through third-party brokers.

In November, a vulnerability acquisition firm called Zerodium paid US $1 million for a browser-based zero-day exploit that could fully compromise iOS 9 devices. The company shares the exploits it acquires with its customers, which include “government organizations in need of specific and tailored cybersecurity capabilities,” according to the company’s website.

The files leaked last year from surveillance software maker Hacking Team included a document with zero-day exploits offered for sale by an outfit called Vulnerabilities Brokerage International. Hacking Team sells its surveillance software to law enforcement agencies along with exploits that can be used to silently deploy the software on users’ computers.

It’s not clear if the FBI plans to eventually report the vulnerability to Apple. During the discussion at Kenyon College last week, Comey said the FBI is still working through that question and other policy issues related to the tool it obtained.

In April 2014, after reports of the National Security Agency stockpiling vulnerabilities, the White House outlined the government’s policy on sharing exploit information with vendors. There is “a disciplined, rigorous and high-level decision-making process for vulnerability disclosure” that weighs the pros and cons between disclosing a flaw and using it for intelligence gathering, Michael Daniel, special assistant to the president and cybersecurity coordinator, said in a blog post then.

Some software vendors have set up bug bounty programs and pay hackers for privately reporting vulnerabilities found in in their products. However, the rewards paid by vendors cannot compete with the amount of money that governments can and are willing to pay for the same flaws.

“I would rather vendors not try to compete in the bidding, but rather focus on eliminating the market entirely by creating secure products from the very beginning,” said Jake Kouns, chief information security officer at vulnerability intelligence firm Risk Based Security, via email.

Software vendors should instead “invest significant money, energy, and time” into training developers on secure coding practices and reviewing code before releasing it, he added.