14 ms·
FBI unlocked iPhone 11 Pro via GrayKey, raising more doubts about Pensacola case
- ec109685 7y agoGrayKey can’t unlock long passcodes: https://appleinsider.com/articles/18/04/16/researcher-estimates-graykey-can-unlock-a-6-digit-iphone-passcode-in-11-hours-heres-how-to-protect-yourself https://appleinsider.com/articles/18/04/16/researcher-estima...
- gempir 7y agoI would assume 90% of iPhone users if not more use 6 digit codes. So this is still a big win for the creators of GrayKey
- saagarjha 7y ago90% of iPhone users with a passcode probably use the (default) 6 digit passcode option, but I would be surprised if that many people set that up.
- mjlee 7y agoThe default is to create a passcode - you have to specifically opt out if you don't want one. https://support.apple.com/en-gb/HT202033 https://support.apple.com/en-gb/HT202033
- thrower123 7y agoA huge percentage of people use stupid passcodes, because convenience is more important than security for them. Six ones, or up and down the middle column, that sort of thing.
- freepor 7y agoGuilty. Convenience is much more important than security for me.
- hwbehrens 7y agoBack in 2016, it was estimated between 85-89% used a passcode [0]; I expect it's probably even higher today. [0]: https://techpinions.com/apples-penchant-for-consumer-security/45122 https://techpinions.com/apples-penchant-for-consumer-securit...
- jaclaz 7y agoAlso - besides its name and the company name - there is nothing AFAIK connecting it to "black/gray market", at least initially those were offered only to LEO and only in US and Canada. And the "long been used" is IMHO a tad bit exaggerated, it came out in the first months of 2018, and - set aside the FBI and whatever other US three or four letter government agencies, it is not likely that US$ 15,000 or US$ 30,000 is something that any police department has in a drawer and can spend instantly, more probably it has taken at least a few months for everyone to get the expense authorized: https://www.forbes.com/sites/thomasbrewster/2018/03/05/apple-iphone-x-graykey-hack/#3111d4ce2950 https://www.forbes.com/sites/thomasbrewster/2018/03/05/apple... No idea on volumes of sale or how many departments got one, in either the "online" or "offline" version, but by now - if it was "widely" used - I presume we would have a lot of evidence based on unlocked iPhones in trials.
- sjy 7y agoThat may not be a safe presumption. Organisations like the FBI keep their investigative techniques secret as long as they can, to preserve their effectiveness in ongoing and future investigations. Trials are the exception; most cases end without one, and the decline of local reporting means the public is less informed about the daily business of the courts.
- jaclaz 7y agoYep. it is actually largely dubitative. I don't know, I simply have no idea of the number of device units of the Gray thingy sold, and how much they could have been used, and as well I have no idea on how many crimes involve the access to a (password protected) iPhone, but unless (yet another piece of data I have no idea about) all suspects either use an Android (or however non-iPhone) or give to the police access to the device without need to "crack" the access code, they should be non-trivial amounts. I mean, I understand that it is a fraction (going to trial) of a fraction (criminal cases involving a phone) of a fraction (suspects not providing access to the device) of a fraction (suspects using specifically an iPhone), still the ubiquity of iPhones and the large number of criminal cases should anyway result in tens or hundreds, while we have AFAICT none or maybe a few actually documented/published about. The declining of local reporting may be indeed another factor, but there would certainly be lawyers making a fuss (right or wrong) about this or that right violated through the use of this or similar tool. The contract with ICE: https://www.forbes.com/sites/thomasbrewster/2019/05/08/immigration-just-spent-a-record-1-million-on-the-worlds-most-advanced-iphone-hacking-tech/#2ce23c7c5a0a https://www.forbes.com/sites/thomasbrewster/2019/05/08/immig... is likely to produce no public court records, just like many national agencies, still the sheer fact that not a single actual court record of its use can be found (at least by me) could mean that the device is not used that much by local police, a few cases should have been brought to the attention of the public.
- pingyong 7y agoSo what's the deal with this? Isn't it just brute force? I would've expected the NSA to have something like that since iPhones first hit the market.
- sp332 7y agoThe main trick is bypassing the increasing timeouts for multiple incorrect guesses.
- pingyong 7y agoShouldn't you always be able to completely bypass that by taking out the chip or something and just probing it directly? I guess that might be a bit much for normal police work, but in terms of "can the government (read: NSA) get into this" this doesn't really seem to change anything.
- kop316 7y agoPossibly, but that still defaults back to brute forcing a long passphrase with a salt. If guessing the passphrase goes above a certain entropy and Apple derives the password with a key stretching algorithm, then the timeouts won't matter.
- pingyong 7y agoThat's exactly what I mean - the usual key complexity rules apply, and have always applied.
- testvox 7y agoBut they shouldn't. The key you enter as a user is actually only half of the key needed to decrypt the data. The other half of the key is generated by the secure enclave when the device was first powered on. This part of the key alone should be impossible to brute force and is stored in tamper resistant flash memory on the secure enclave co-processor. So you would need to break open the co-processor without destroying its contents and read the secure enclave key before any brute forcing could happen directly on the encrypted data. And no you can't just try to brute force it by sending decryption requests to the secure enclave. The secure enclave itself implements a exponentially increasing lockout time and won't respond to decryption requests during it. [0] [0] https://www.apple.com/in/business-docs/iOS_Security_Guide.pdf https://www.apple.com/in/business-docs/iOS_Security_Guide.pd...
- theshrike79 7y agoBasically GrayKey can unlock numeric passcodes by bypassing the cumulative limits that engage when the wrong code is typed in. The process still takes a long-ish time. It can't do anything for FaceID, TouchID or alphanumeric passcodes.
- rahuldottech 7y agoIsn't numeric passcode the default fallback to biometrics that millions of users use? Also, isn't it supposed to be safer than FaceID or TouchID? Apparently GrayKey can't crack long passwords, since it's essentially brute-forcing, but almost everyone I know uses a four-digit code. Also, this is troublesome because in the US, we're told that cops can force you to hand over your fingerprint but not your passcode. It's a bit problematic if those passcodes are easy to crack.
- deleted 7y ago[deleted]
- thenewnewguy 7y ago4 digit codes are obviously easy to crack. That's a pathetically low number of combinations.
- matthewmacleod 7y agoThis isn’t really obvious. While there are clearly a limited number of codes with four digits, the idea is that the Secure Enclave can throttle and limit cracking attempts to the point that an attack would be infeasible.
- codesuela 7y agoThe phone was released with iOS 13 which prominently featured enhancements to USB restricted mode[1] which was supposed to defend against GrayKey/Cellebrite attacks. Seems like GrayKey can easily bypass that feature. Does not really inspire much trust in Apples security team as the USB restricted mode was already a bandaid itself. [1] https://blog.elcomsoft.com/2019/09/usb-restricted-mode-in-ios-13-apple-vs-graykey-round-two/ https://blog.elcomsoft.com/2019/09/usb-restricted-mode-in-io...
- matthewmacleod 7y agoI think it’s important to stress that we have essentially no solid information as to whether these attacks are real, and if they are, then the methods they use or the amount of time they take, nor what measures can be used against them. Let’s not sing the requiem for their security team just yet.
- londons_explore 7y agoApple's security team has been given the near impossible task of defending a physical device in the hands of an attacker. I wouldn't blame them for any lack of success. Perhaps instead blame them for suggesting to the user physical security is possible at all.
- Thorrez 7y ago> the near impossible task of defending a physical device in the hands of an attacker. If you assume the device is off and the user chose a strong password, it's pretty easy to defend. You simply encrypt the data with a key which is encrypted with the user's password. If you want to protect devices that are on, or want to protect devices with less than stellar passwords, then it becomes harder.
- afthonos 7y ago“if you assume the device is off”? I suppose if you assume the user never puts data on the device, it also becomes easier.
- 7y ago
- me551ah 7y agoCompletely locking down a physical device and making it unhackable is downright impossible. If the attacker has physical access to the device and the ability to regulate network access, then it's only a matter of time before the device gets hacked. Right now they are using USB to gain access to the device. There is nothing stopping an attacker from actually prying open the device and fitting alternative components that can bypass security. Consoles are cited as an example of an unhackable device, which is not true. Consoles were designed to be unhackable by cheap mass-market methods but a determined hacker can still do it, just that he will have to spend more to do it than the cost of a new console. The hacker in this scenario is FBI with a lot of money and resources with the physical device in their custody. I doubt if FBI is going to lose the ability to hack devices anytime soon.
- minxomat 7y agoLots of iPhone decryption kits, specifically kits which reset the time or limit on unlocks worked and do work by unsoldering chips and processing them externally.
- brokenmachine 7y agoIs this true? You can buy iphone decryption kits that require desoldering chips?
- DagAgren 7y agoReplacing components does not give you access to the secure enclave which is on-chip. And that is where the encryption key for the storage lives.
- dandare 7y ago> So why are the FBI, President Trump, Attorney General William Barr, and others all calling on Apple itself to break iPhone encryption? The most obvious possibility... The most obvious possibility is that Apple can one day succeed and iPhone will be uncrackable by these tools.
- mlang23 7y agoI always considered the "you can't get at the data of an iPhone" a marketing slogan, not really worth my trust. I am still off the opinion, once you give up/loose physical access to a device, the game is over. Also, I dont see why this is such a big deal for so many people. Is the percentage of people that have the FBI as their adversary really so high? :-)
- csunbird 7y agoIf FBI can do it, that means any other third party is able to do it too, it is just a matter of time.
- baobabKoodaa 7y agoA phone thief may theoretically spend a few months to unlock your phone, but in practice they won't.
- have_faith 7y agoWhen an exploit is leaked and turned into software that can run on commodity hardware then the thief might only have to spend a few minutes.
- faeyanpiraat 7y agoTime also helps, because the software on the phone stops getting the fresh security fixes.
- fastbeef 7y agoAny other third party with funding on the level of FBI
- michaelt 7y agoSo long as the reports are "FBI can unlock iPhones by unknown means" we don't know the cost to execute the exploit. Just because the FBI pay $$$$ per unlock, doesn't mean the marginal cost to the supplier is $$$$, that could just be GrayKey trying to cover the $$$$$$$ they paid for an exploit, and make some profit.
- reaperducer 7y agoFor those who want to read the original journalism and not a blog's re-hash of someone else's hard work: https://www.forbes.com/sites/thomasbrewster/2020/01/15/the-fbi-got-data-from-a-locked-iphone-11-pro-max--so-why-is-it-demanding-apple-unlock-older-phones/ https://www.forbes.com/sites/thomasbrewster/2020/01/15/the-f...
- eganist 7y agoI'll take the blog re-hash so long as Forbes insists on trying to force me to accept their (compromised once-monthly) ad network, but the effort in digging up and reposting the link is well-spent generally, so thanks. (to be clear: if Forbes handled their ads on their own or used ad networks that invest in the security of their platform, I'd actually probably bite the bullet, but if I visit the site on mobile and end up being redirected to another "your phone is infected!" ad exploiting their current provider... I'll keep steering clear without ublock enabled.)
- camiat 7y agohttps://i.imgur.com/dmgV13H.png https://i.imgur.com/dmgV13H.png Image copy of the article for the interested.
- arthurfm 7y agohttps://outline.com/Pxqsdw https://outline.com/Pxqsdw
- soupfordummies 7y agoThank you for saying this and explaining it. I've noticed that a lot with Forbes and a couple other sites. So basically bad actors are hijacking the ad network that Forbes is using because it's a poorly secured ad network. I didn't realize that was what was going on but that explains a great deal.
- boutad 7y agoOnce again, it seems that it was an excuse to weaken the security of all iPhone users rather than getting information from a specific device. In the case of San Bernandino the FBI was able to use Cellebrite to crack the attacker iPhone without Apple creating backdoors.
- saurik 7y agoIn that case, Apple already had a backdoor, or they wouldn't have been able to comply in the first place: the device in question did not yet have the "secure enclave" enforcement of pin code back-off and supported firmware updates by Apple without the user's pin code. Apple spending the time to make a firmware--which incidentally anyone with Apple's private firmware signing key (the real back door) could easily have done (as we seriously already have had custom firmwares for ssh bootstrap and pin code brute force in the community)--isn't them "creating" a backdoor, it is them "using" a backdoor. Thankfully, it is my understanding that Apple decided to fix both of these issues in subsequent devices, and so while there are clearly still bugs there hopefully are no longer any obvious backdoors.
- gruez 7y ago>Thankfully, it is my understanding that Apple decided to fix both of these issues in subsequent devices, and so while there are clearly still bugs there hopefully are no longer any obvious backdoors. Does this mean. There's a new unpatched exploit out there that greykey is using?
- nostalgk 7y agoFrom what I can tell, it simply tries to brute force the password (perhaps with some informed suggestion). It does appear to have access to an exploit that bypasses/disables the encryption lock that wipes data off the phone after failed attempts, but it does not appear to utilize an exploit/backdoor to gain access to the device; it gains access the "legitimate" way.
- masukomi 7y agoisn't breaking encryption like this illegal under the DMCA? Wouldn't that mean that the FBI was actively breaking the law by using it?
- scumbert 7y agoThey have a court order to access the data, similarly, you're not burglarizing a house you have a warrant to enter doesn't mean Apple has to accommodate
- ChrisLomont 7y agoBreaking encryption is not illegal under the DMCA except in the cases listed in the DMCA. Lots of things are illegal without a warrant or without some other legal requirement. The FBI breaking encryption in a legal investigation is not illegal.
- htfu 7y ago> Breaking encryption is not illegal under the DMCA except in the cases listed in the DMCA. isn't it the other way around?
- ChrisLomont 7y agoNo. DMCA makes most breaking of encryption illegal when used to circumvent copyright. "Most" because it has exemptions even for copyright circumvention. This is a very limited place to make it illegal. I can probably think of hundreds of places you can still do it and it's not illegal. Some examples: in school classes to learn, at home for practice, researchers attacking each others new algorithms, estate clearance to get dead person assets released, for interoperability in may cases, for archiving old things in many cases, and on and on. In fact, almost any place I can think of where I might break encryption (which I have done both as a hobby and professionally and as while a PhD student) is perfectly legal. It becomes illegal when used to do something else illegal, like violating copyright, or stealing things. So no, breaking encryption is not illegal as a whole. Here, break this: Lbh qvqa'g oernx gur ynj.
- nimbius 7y agofrom the GrayKey website: >GrayKey is not for everyone. We kindly request that you tell us a bit about yourself and your organization. This feels like its begging for DMCA litigation, but its likely Apple already knows how and why GrayKey works. Keeping GrayKey around serves apple as law enforcement has (for now) an easy means of hacking some iphones at an entry cost, while permitting Apple to continue insisting their phones are just too secure to help hack.
- Jamwinner 7y agoTMK, There are multiple independent implementations of the attack their current gen tech is based on. Any determined actor could hire a greyhat and have their own system.
- Hamuko 7y ago>while permitting Apple to continue insisting their phones are just too secure to help hack. How? If the FBI can get into someone's iPhone with their magic box and you can read about it in the news, how can Apple convince people that the iPhone is "too secure"?
- brokenmachine 7y agoHow else will Apple market the iPhone 12 with Secure Enclave v2™?
- deleted 7y ago[deleted]
- gok 7y agoI suppose it's possible that in one case the device had USB Restricted Mode off, but it was on in the Pensacola case?
- macinjosh 7y agoI fear where this will end up or already ended up is in a place where Apple gets to say they are pro user privacy, doing everything they can to keep my data secure, etc. When in reality they could be purposefully not closing vulnerabilities so they have an out with the police. Until I see Apple genuinely go after these companies like Cellebrite and GrayKey in court I will remain skpetical.
- freepor 7y agoThe government is just trying to establish its preferred pecking order — government, oligarchs, then Soylent Green. Expect more High Publicity cases especially those involving child victims.
- baybal2 7y agoThe box on their website looks really similar to iphone unlock tools sold around in the unlock industry. Can it be that Greykey is just a relabeled Chinese unlock box made to crack the lock screen?