3 ms·

Is there any info on how GrayKey worked? My understanding is that in recent models the SEP was supposed to prevent that kind of brute forcing of passcodes at th

Is there any info on how GrayKey worked? My understanding is that in recent models the SEP was supposed to prevent that kind of brute forcing of passcodes at the hardware level — and also enforce a secure boot chain that prevents loading hostile firmware (which it looks like GrayKey did based on screen shots). This would seem to involve an exploit of the SEP which is very serious... or was there some simpler exploit? Anyone?

earenndil 8y ago
I believe that graykey was able to try passcodes at a faster-than-should-be-allowed rate, which does indicate a flaw but not a serious one.
- saagarjha 8y ago
  That sounds plenty serious to me.
  - thisacctforreal 8y ago
    There is a hard limit of 80ms per attempt, from the number of PBKDF2 iterations tuned for the secure enclave.
    - saagarjha 8y ago
      Which means that it can get through the entire six digit password keyspace in under a day.
    - abalone 8y ago
      It's much more than that. According to Apple's iOS security whitepaper, the SEP is supposed to enforce escalating time delays in between attempts -- up to one hour after the 9th attempt. And survive restarts. It certainly seems like GrayKey bypassed a fundamental SEP protection, which would constitute a very serious flaw. The SEP protections are supposed to be a whole 'nother level (which is what this article gets at.. it's Hard to even get at the firmware). If that aspect of the SEP is compromised, what else about it is? This is extra disturbing because Apple's "fix" was to disconnect unauthorized peripherals -- not, apparently, a fix to the SEP itself. This is why I am stunned there was not more coverage of this. It's smoke that indicates a really fundamental flaw in the SEP. [1] https://www.apple.com/business/site/docs/iOS_Security_Guide.pdf https://www.apple.com/business/site/docs/iOS_Security_Guide.... (page 18)

earenndil 8y ago

I believe that graykey was able to try passcodes at a faster-than-should-be-allowed rate, which does indicate a flaw but not a serious one.

saagarjha 8y ago
That sounds plenty serious to me.
- thisacctforreal 8y ago
  There is a hard limit of 80ms per attempt, from the number of PBKDF2 iterations tuned for the secure enclave.
  - saagarjha 8y ago
    Which means that it can get through the entire six digit password keyspace in under a day.
  - abalone 8y ago
    It's much more than that. According to Apple's iOS security whitepaper, the SEP is supposed to enforce escalating time delays in between attempts -- up to one hour after the 9th attempt. And survive restarts. It certainly seems like GrayKey bypassed a fundamental SEP protection, which would constitute a very serious flaw. The SEP protections are supposed to be a whole 'nother level (which is what this article gets at.. it's Hard to even get at the firmware). If that aspect of the SEP is compromised, what else about it is? This is extra disturbing because Apple's "fix" was to disconnect unauthorized peripherals -- not, apparently, a fix to the SEP itself. This is why I am stunned there was not more coverage of this. It's smoke that indicates a really fundamental flaw in the SEP. [1] https://www.apple.com/business/site/docs/iOS_Security_Guide.pdf https://www.apple.com/business/site/docs/iOS_Security_Guide.... (page 18)