Focus on the Possibility of the Late Park Won-soon's iPhone as the 'Smoking Gun'
iPhone Security is Strict... Face ID, Password, and Other
Unlock Methods are Also Difficult
Privacy Protection Causes Friction with the U.S. Department of Justice
Police forensic investigators are transporting the body of Park Won-soon, the Mayor of Seoul, who was found dead near Sukjeongmun in Jongno-gu, Seoul, in the early morning of the 10th. / Photo by Yonhap News
[Asia Economy Reporter Han Seung-gon, Intern Reporter Lim Joo-hyung] As the police plan to conduct digital forensics on the late Park Won-soon, former Mayor of Seoul's mobile phone soon, attention is focused on how to unlock the phone, which is known to be an iPhone by the US company Apple, equipped with a high-level security system.
Earlier, the police found an iPhone near Sukjeongmun in Seoul, where Mayor Park's body was discovered, at 12:01 a.m. on the 10th.
This iPhone was brought by Mayor Park when he went hiking the day before (the 9th), and it is attracting attention as it may contain information that could be a 'smoking gun' regarding the exact circumstances of his death and allegations of sexual harassment.
The problem lies in the fact that the phone is an iPhone, famous for its advanced security system. The iPhone protects user data through encryption technology, and extracting information stored inside the phone requires a complex process.
'End-to-End Encryption' Technology Preventing Extraction of Others' Information
The reason why digital forensics on the iPhone is difficult is due to iOS's 'end-to-end encryption' technology. End-to-end encryption encrypts all communication processes between the message sender and receiver and is mainly used in privacy-focused messengers like Telegram.
Because iPhones using this technology store all user information in encrypted form, third parties cannot view the contents.
For example, even if data such as calendars, diaries, or conversations with others are copied from an iPhone that is not recognized by the user and transferred to another electronic device, only an encrypted string of characters can be seen.
Face ID, Password, Auto Format... Double and Triple Security Systems
Ultimately, to access information inside the iPhone, the only way is to unlock the phone's passcode and look directly.
Currently, iPhones mainly recognize users through 'Face ID.' Face ID is a technology that recognizes the user's face by projecting about 30,000 laser dots, measuring not only the shape but also the depth of the face, making it nearly impossible to hack.
If unlocking via Face ID fails, the alternative is to enter a 6-digit passcode to unlock the phone. The 6-digit passcode is created by combining numbers and uppercase and lowercase English letters, theoretically resulting in 56 billion possible combinations.
If the passcode is entered incorrectly more than five times, a 1-minute delay occurs; thereafter, each incorrect attempt causes delays of 5 minutes, 15 minutes, and 1 hour sequentially. If the passcode is entered incorrectly more than 10 times, an 'auto format' occurs, permanently deleting data stored on the phone.
In the latest digital forensics, to avoid triggering auto format, a technique called 'NAND mirroring' is used, which involves separating the data storage device inside the device and duplicating its contents. This creates a kind of 'virtual iPhone' that mimics the iPhone's operating environment.
By creating as many 'virtual iPhones' as possible, random passcodes are continuously input to unlock the phone. Since only up to 10 passcode attempts can be made per virtual iPhone, the time required to unlock varies greatly. If lucky, it may be unlocked within a month, but it could take several months or even fail entirely.
An anonymous security company official said, "In the case of iPhones, the many security measures built into the device itself pose a challenge," adding, "Whether the user has set many security options on the device will determine the difficulty of forensics."
Because unlocking is complicated, governments and investigative agencies sometimes use special analysis devices. One such device is sold by the Israeli cryptography company Cellebrite, which is said to prevent automatic deletion or permanent locking of phone data due to incorrect password entries.
Apple Prioritizes Consumer Privacy... Conflicts with US Department of Justice
As a result, conflicts have arisen overseas between Apple's strict security policies and governments.
In the United States, where Apple's headquarters are located, the US Department of Justice, which wants easier access to iPhone internal information, has continuously clashed with Apple.
Last December, regarding the issue of unlocking the iPhone used by the suspect in the shooting at the Pensacola Naval Base in Florida, US Attorney General William Barr said at a press conference, "We ask Apple and other tech companies to cooperate in finding solutions that can protect and prevent the lives of American citizens."
At that time, Barr expressed dissatisfaction, saying, "We requested Apple's help to unlock the shooter's iPhone, but Apple has not provided substantial assistance so far."
However, Apple defended its encryption policy in a statement posted on Twitter, saying, "We have responded timely and thoroughly to many government requests after the shooting," while supporting the iPhone's encryption policy.
Apple emphasized, "Law enforcement agencies currently have access to more data than ever before," and "Apple believes encryption is essential to protect both national and customer data."
© The Asia Business Daily(www.asiae.co.kr). All rights reserved.
