3 ms·

To everyone replying to this comment saying that you can set a limit and then the phone will wipe itself after the limit has been reached - that point is moot.

To everyone replying to this comment saying that you can set a limit and then the phone will wipe itself after the limit has been reached - that point is moot. Although I wish it wasn't so, there are a couple people who were able to setup a mechanism to brute force an iPhone pin by shutting off the device before it registered an unsuccessful attempt therefore ... giving you limitless potential.

RexRollman 11y ago
Apple fixed that in iOS 8.1.1. (CVE-2014-4451).
scintill76 11y ago
That's patched: https://news.ycombinator.com/item?id=9225317 https://news.ycombinator.com/item?id=9225317 Unless you're talking about a newer instance of the same bug.
- peterhadlaw 11y ago
  Here is what I was referring to: https://youtu.be/meEyYFlSahk https://youtu.be/meEyYFlSahk Seems more of a mechanical setup, rather than this guy's video. Like put a kill switch ON THE PATH (i.e. before signals reach) the "Okay iPhone, register this failed attempt" destination.
  - scintill76 11y ago
    The automatic thing is just an automatic exploit of the same issue[0] (forcefully cutting power rather than powering off with the buttons might make it more reliable.) It's called an iPBOX and AFAICT it doesn't support iOS 8.1.1[1], when the issue was fixed. Other commentors have pointed out that the PIN/crypto stuff is handled by dedicated hardware designed to resist tampering, probably pretty much state-of-the-art. The issue before was a software issue. Now that it's fixed it's very hard to completely hack the hardware and would have to be done to each phone individually: https://news.ycombinator.com/item?id=10424439 https://news.ycombinator.com/item?id=10424439 I'm not an expert, but I imagine intercepting the signal would be just as hard, as the signal is contained within one tiny chip and it might not even be possible to reliably modify a circuit on that scale. You can't just replace the chip with a no-PIN version either, because it contains a unique crypto key to the data you presumably want from the phone. This also makes modifying the chip difficult, because if you screw up you could lose the key. [0] https://www.mdsec.co.uk/2015/03/apple-ios-hardware-assisted-screenlock-bruteforce/ https://www.mdsec.co.uk/2015/03/apple-ios-hardware-assisted-... [1] http://forum.gsmhosting.com/vbb/10720367-post1.html http://forum.gsmhosting.com/vbb/10720367-post1.html
wcummings 11y ago
Exploits are about information asymmetry, if you know about this and you didn't discover it out yourself it won't be around for long.
peterhadlaw 11y ago
I'm not quite sure why I was getting down-voted. This is what I (admittedly should have included earlier) was referring to: https://youtu.be/meEyYFlSahk https://youtu.be/meEyYFlSahk. Try the password and before the system can register the password attempt, cut the power. I'm actually curious if this is something impossible to fix, almost in a mathematically provable way.
- mikehall314 11y ago
  Trivial to fix, I would have thought. Record the attempt before testing for validity, rather than after.

RexRollman 11y ago

Apple fixed that in iOS 8.1.1. (CVE-2014-4451).

scintill76 11y ago

That's patched: https://news.ycombinator.com/item?id=9225317 https://news.ycombinator.com/item?id=9225317 Unless you're talking about a newer instance of the same bug.

peterhadlaw 11y ago
Here is what I was referring to: https://youtu.be/meEyYFlSahk https://youtu.be/meEyYFlSahk Seems more of a mechanical setup, rather than this guy's video. Like put a kill switch ON THE PATH (i.e. before signals reach) the "Okay iPhone, register this failed attempt" destination.
- scintill76 11y ago
  The automatic thing is just an automatic exploit of the same issue[0] (forcefully cutting power rather than powering off with the buttons might make it more reliable.) It's called an iPBOX and AFAICT it doesn't support iOS 8.1.1[1], when the issue was fixed. Other commentors have pointed out that the PIN/crypto stuff is handled by dedicated hardware designed to resist tampering, probably pretty much state-of-the-art. The issue before was a software issue. Now that it's fixed it's very hard to completely hack the hardware and would have to be done to each phone individually: https://news.ycombinator.com/item?id=10424439 https://news.ycombinator.com/item?id=10424439 I'm not an expert, but I imagine intercepting the signal would be just as hard, as the signal is contained within one tiny chip and it might not even be possible to reliably modify a circuit on that scale. You can't just replace the chip with a no-PIN version either, because it contains a unique crypto key to the data you presumably want from the phone. This also makes modifying the chip difficult, because if you screw up you could lose the key. [0] https://www.mdsec.co.uk/2015/03/apple-ios-hardware-assisted-screenlock-bruteforce/ https://www.mdsec.co.uk/2015/03/apple-ios-hardware-assisted-... [1] http://forum.gsmhosting.com/vbb/10720367-post1.html http://forum.gsmhosting.com/vbb/10720367-post1.html

wcummings 11y ago

Exploits are about information asymmetry, if you know about this and you didn't discover it out yourself it won't be around for long.

peterhadlaw 11y ago

I'm not quite sure why I was getting down-voted. This is what I (admittedly should have included earlier) was referring to: https://youtu.be/meEyYFlSahk https://youtu.be/meEyYFlSahk. Try the password and before the system can register the password attempt, cut the power. I'm actually curious if this is something impossible to fix, almost in a mathematically provable way.

mikehall314 11y ago
Trivial to fix, I would have thought. Record the attempt before testing for validity, rather than after.