FBI reportedly bought exploit from hackers to access San Bernardino iPhone

The agency is still working through questions about sharing the vulnerability with Apple

The FBI reportedly paid professional hackers a one-time fee for a previously unknown vulnerability that allowed the agency to unlock the iPhone of San Bernardino shooter.

The exploit allowed the FBI to build a device capable of brute-forcing the iPhone's PIN without triggering a security measure that would have wiped all of its data, the Washington Post reported Tuesday, citing unnamed sources familiar with the matter.

The hackers who provided the exploit to the FBI find software vulnerabilities and sometimes sell them to the U.S. government, the newspaper reported.

Previous media reports suggested Israeli mobile forensics firm Cellebrite was the unnamed third party that helped the FBI unlock Farook's iPhone 5c. That was not the case, the Post's sources said.

In February, a judge ordered Apple to write special software that could help the FBI disable the iPhone's auto-erase protection. Apple challenged the order, but in late March the FBI dropped the case after successfully unlocking the iPhone using a technique acquired from an unnamed third-party.

Last week, speaking at Ohio’s Kenyon College, FBI director James Comey said the unlocking tool the agency used works only "on a narrow slice of iPhones," such as the 5c and older models.

That's probably because newer models store cryptographic material inside a secure hardware element called the secure enclave, first introduced in the iPhone 5s.

The FBI did not immediately respond to an inquiry seeking confirmation on whether the agency bought the iPhone 5c exploit from professional hackers.

However, the existence of a shadowy and largely unregulated market for exploits not reported to software vendors is no secret. There are hackers and security researchers who sell "zero-day" exploits to law enforcement and intelligence agencies, often through third-party brokers.

In November, a vulnerability acquisition firm called Zerodium paid US $1 million for a browser-based zero-day exploit that could fully compromise iOS 9 devices. The company shares the exploits it acquires with its customers, which include "government organizations in need of specific and tailored cybersecurity capabilities," according to the company's website.

The files leaked last year from surveillance software maker Hacking Team included a document with zero-day exploits offered for sale by an outfit called Vulnerabilities Brokerage International. Hacking Team sells its surveillance software to law enforcement agencies along with exploits that can be used to silently deploy the software on users' computers.

It's not clear if the FBI plans to eventually report the vulnerability to Apple. During the discussion at Kenyon College last week, Comey said the FBI is still working through that question and other policy issues related to the tool it obtained.

In April 2014, after reports of the National Security Agency stockpiling vulnerabilities, the White House outlined the government’s policy on sharing exploit information with vendors. There is "a disciplined, rigorous and high-level decision-making process for vulnerability disclosure" that weighs the pros and cons between disclosing a flaw and using it for intelligence gathering, Michael Daniel, special assistant to the president and cybersecurity coordinator, said in a blog post then.

Some software vendors have set up bug bounty programs and pay hackers for privately reporting vulnerabilities found in in their products. However, the rewards paid by vendors cannot compete with the amount of money that governments can and are willing to pay for the same flaws.

"I would rather vendors not try to compete in the bidding, but rather focus on eliminating the market entirely by creating secure products from the very beginning," said Jake Kouns, chief information security officer at vulnerability intelligence firm Risk Based Security, via email.

Software vendors should instead "invest significant money, energy, and time" into training developers on secure coding practices and reviewing code before releasing it, he added.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles


GGG Evaluation Team

Kathy Cassidy


First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni


For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell


The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi


The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott


My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?