The FBI reportedly bought a previously unknown security bug from a group of professional hackers to gain entry to the San Bernardino iPhone 5C, according to the Washington Post.
The report suggests hackers supplied at least one so-called zero-day flaw in the iPhone 5C’s security that allowed the FBI to circumvent the lockscreen and automatic wipe feature that kicks in after 10 wrong passcode entries.
The hack meant the FBI dropped its attempt to force Apple to create software to unlock the iPhone 5C, which the company said would put all iPhones at risk.
The FBI has already clarified that the hack bought for a one-time-fee cannot break into newer iPhones, including the iPhone 5S or later, but the hack could affect any iPhone 5C or older, including the iPhone 5 and 4S.
The hackers are said to be professional security experts who probe software, devices and services to find vulnerabilities that they can exploit. They then sell the bugs to governments and third-parties, including those who make surveillance tools similar to the software exposed during a data breach of Italian firm Hacking Team.
The security bugs are not disclosed to the makers of the software or hardware, in this case Apple, because they only retain value while functional. The US government has yet to decide whether it will disclose the vulnerability to Apple, but its hand may be forced if it is required to disclose the information in a criminal case under the rules of discovery.
It is unknown how the hack operates or whether the hackers sold the flaw to any other agencies or third-parties, but if it is not disclosed to and fixed by Apple, it could leave anyone with an iPhone without a fingerprint sensor at risk of having their smartphone hacked.
