Terrorist cell phone: FBI pays close to million for iPhone hack

 A small Australian security company plays a major role in the thriller about the San Bernardino bombers who killed 14 people and lost their own lives in the process. In focus - an iPhone 5C.

It was the most serious terrorist attack since 9/11 and it occurred in the small town of San Bernardino in the US state of California. On December 2, 2015, city employee Syed Rizwan Farook and his wife Tashfeen Malik shot indiscriminately at a nonprofit facility for people with disabilities during a Christmas party, killing 14 people and injuring 21 others, some seriously.

Perpetrators are killed, leaving behind an iPhone 5C with no unlocking capability

The perpetrators initially managed to escape, but were then confronted near their home and died in a brief firefight. Two days later, the U.S. Federal Bureau of Investigation (FBI) declared the incident an act of terrorism. The perpetrators had pledged allegiance to the leaders and targets of the Islamic State terrorist organization on social media.

During the investigation, the FBI had seized Farook's on-duty smartphone. It was an iPhone 5C from the smartphone manufacturer Apple. The investigators hoped that the contents of the device would provide them with more detailed information about the circumstances and the possible people behind the crime. Above all, they were interested in the answer to the question of who the assassins might have contacted immediately before and after the crime.

However, the investigators failed in their attempt to gain access to the smartphone. Apple had shortly before introduced the new iOS 9 operating system. For the first time, it introduced the option of setting the device to be completely deleted after ten unsuccessful attempts to unlock it. And Farook had already installed this OS update.

FBI tries to force Apple to program a backdoor

This meant that the FBI could not use its previous tactic of simply brute forcing combinations until one fit. The agency turned to Apple and asked for help in unlocking the device.

Apple helped in various ways, but refused to create a backdoor that would allow investigators to access the content. Apple CEO Tim Cook publicly refused to develop software to do so for the iPhones, finding that it carried too high a potential for abuse.

The FBI filed a lawsuit against Apple to force the manufacturer to cooperate. Only a short time later, the FBI withdrew the lawsuit. Then, at the end of March 2016, the U.S. Department of Justice announced that investigators had ultimately gained access to the contents of the San Bernardino bomber's iPhone 5C without Apple's involvement. It was widely suspected that the controversial Israeli security firm Cellebrite may have played a role in this.

Small Australian firm employs regular hacking geniuses

Meanwhile, the mystery surrounding the FBI's helpers has been solved. It was neither Apple nor Cellebrite. Rather, the small Australian security firm Azimuth Security is said to be behind the hack of the terror iPhone. This was reported by the Washington Post.

Azimuth specializes in finding significant vulnerabilities in operating systems and then exploiting them in so-called exploits. Azimuth founder Mark Dowd is an Australian programmer who colleagues say can "break into pretty much any computer if he just looks at it for a second" and is the "Mozart of exploit design."

Also working at Azimuth is David Wang. He is said to have picked up a keyboard for the first time at the tender age of 8. Later, he is said to have dropped out of Yale and, at the age of 27, won the prestigious Pwnie Award - an Oscar for hackers - for "jailbreaking" an iPhone.

Azimuth Security builds multi-step exploit chain

By the time the FBI approached Azimuth, company founder Dowd, a former IBM X-Force researcher, had already found the relevant vulnerability. It was a flaw in an open-source Mozilla module that Apple used to allow accessories to use the iPhone's Lightning port.

Dowd is said to have documented the gap and found it interesting enough to include in a hacking tool, but had been overloaded with other projects, so the problem did not receive further attention at first. Mozilla, by the way, does not want to know about such a gap, as spokeswoman Ellen Canale emphasized to the Washington Post.

In any case, the Mozilla gap is said to have only meant the proverbial foot in the door. Dowd and his comrades-in-arms are said to have orchestrated a veritable chain of exploits in the aftermath to gain access to the contents of Farook's service iPhone. Later, this exploit chain would be named "Condor."

The Azimuth researchers ultimately gained access to the device via three exploits. The solution for the final step was already available at Azimuth. Wang had already developed an exploit earlier that made it possible to take control of the device's processor.

Condor cracks Farook's smartphone

Once at that point, software was again all that was needed to simply run through all possible passcode combinations - much as the FBI had done in the past. Dowd and Wang had managed to get behind the security barrier. The FBI reportedly compensated them for this achievement with a fee of $900,000.

After a few internal attempts on third-party iPhones, the FBI then dared to access Farook's smartphone. Condor did a good job and the investigators got the desired access to the contents.

What they found was nothing.