6 ms·

GrayKey can’t unlock long passcodes: https://appleinsider.com/articles/18/04/16/researcher-estimates-graykey-can-unlock-a-6-digit-iphone-passcode-in-11-hours-he

GrayKey can’t unlock long passcodes: https://appleinsider.com/articles/18/04/16/researcher-estimates-graykey-can-unlock-a-6-digit-iphone-passcode-in-11-hours-heres-how-to-protect-yourself https://appleinsider.com/articles/18/04/16/researcher-estima...

gempir 7y ago
I would assume 90% of iPhone users if not more use 6 digit codes. So this is still a big win for the creators of GrayKey
- saagarjha 7y ago
  90% of iPhone users with a passcode probably use the (default) 6 digit passcode option, but I would be surprised if that many people set that up.
  - mjlee 7y ago
    The default is to create a passcode - you have to specifically opt out if you don't want one. https://support.apple.com/en-gb/HT202033 https://support.apple.com/en-gb/HT202033
    - thrower123 7y ago
      A huge percentage of people use stupid passcodes, because convenience is more important than security for them. Six ones, or up and down the middle column, that sort of thing.
      - freepor 7y ago
        Guilty. Convenience is much more important than security for me.
  - hwbehrens 7y ago
    Back in 2016, it was estimated between 85-89% used a passcode [0]; I expect it's probably even higher today. [0]: https://techpinions.com/apples-penchant-for-consumer-security/45122 https://techpinions.com/apples-penchant-for-consumer-securit...
jaclaz 7y ago
Also - besides its name and the company name - there is nothing AFAIK connecting it to "black/gray market", at least initially those were offered only to LEO and only in US and Canada. And the "long been used" is IMHO a tad bit exaggerated, it came out in the first months of 2018, and - set aside the FBI and whatever other US three or four letter government agencies, it is not likely that US$ 15,000 or US$ 30,000 is something that any police department has in a drawer and can spend instantly, more probably it has taken at least a few months for everyone to get the expense authorized: https://www.forbes.com/sites/thomasbrewster/2018/03/05/apple-iphone-x-graykey-hack/#3111d4ce2950 https://www.forbes.com/sites/thomasbrewster/2018/03/05/apple... No idea on volumes of sale or how many departments got one, in either the "online" or "offline" version, but by now - if it was "widely" used - I presume we would have a lot of evidence based on unlocked iPhones in trials.
- sjy 7y ago
  That may not be a safe presumption. Organisations like the FBI keep their investigative techniques secret as long as they can, to preserve their effectiveness in ongoing and future investigations. Trials are the exception; most cases end without one, and the decline of local reporting means the public is less informed about the daily business of the courts.
  - jaclaz 7y ago
    Yep. it is actually largely dubitative. I don't know, I simply have no idea of the number of device units of the Gray thingy sold, and how much they could have been used, and as well I have no idea on how many crimes involve the access to a (password protected) iPhone, but unless (yet another piece of data I have no idea about) all suspects either use an Android (or however non-iPhone) or give to the police access to the device without need to "crack" the access code, they should be non-trivial amounts. I mean, I understand that it is a fraction (going to trial) of a fraction (criminal cases involving a phone) of a fraction (suspects not providing access to the device) of a fraction (suspects using specifically an iPhone), still the ubiquity of iPhones and the large number of criminal cases should anyway result in tens or hundreds, while we have AFAICT none or maybe a few actually documented/published about. The declining of local reporting may be indeed another factor, but there would certainly be lawyers making a fuss (right or wrong) about this or that right violated through the use of this or similar tool. The contract with ICE: https://www.forbes.com/sites/thomasbrewster/2019/05/08/immigration-just-spent-a-record-1-million-on-the-worlds-most-advanced-iphone-hacking-tech/#2ce23c7c5a0a https://www.forbes.com/sites/thomasbrewster/2019/05/08/immig... is likely to produce no public court records, just like many national agencies, still the sheer fact that not a single actual court record of its use can be found (at least by me) could mean that the device is not used that much by local police, a few cases should have been brought to the attention of the public.
pingyong 7y ago
So what's the deal with this? Isn't it just brute force? I would've expected the NSA to have something like that since iPhones first hit the market.
- sp332 7y ago
  The main trick is bypassing the increasing timeouts for multiple incorrect guesses.
  - pingyong 7y ago
    Shouldn't you always be able to completely bypass that by taking out the chip or something and just probing it directly? I guess that might be a bit much for normal police work, but in terms of "can the government (read: NSA) get into this" this doesn't really seem to change anything.
    - kop316 7y ago
      Possibly, but that still defaults back to brute forcing a long passphrase with a salt. If guessing the passphrase goes above a certain entropy and Apple derives the password with a key stretching algorithm, then the timeouts won't matter.
      - pingyong 7y ago
        That's exactly what I mean - the usual key complexity rules apply, and have always applied.
        testvox 7y ago
        But they shouldn't. The key you enter as a user is actually only half of the key needed to decrypt the data. The other half of the key is generated by the secure enclave when the device was first powered on. This part of the key alone should be impossible to brute force and is stored in tamper resistant flash memory on the secure enclave co-processor. So you would need to break open the co-processor without destroying its contents and read the secure enclave key before any brute forcing could happen directly on the encrypted data. And no you can't just try to brute force it by sending decryption requests to the secure enclave. The secure enclave itself implements a exponentially increasing lockout time and won't respond to decryption requests during it. [0] [0] https://www.apple.com/in/business-docs/iOS_Security_Guide.pdf https://www.apple.com/in/business-docs/iOS_Security_Guide.pd...

gempir 7y ago

I would assume 90% of iPhone users if not more use 6 digit codes. So this is still a big win for the creators of GrayKey

saagarjha 7y ago
90% of iPhone users with a passcode probably use the (default) 6 digit passcode option, but I would be surprised if that many people set that up.
- mjlee 7y ago
  The default is to create a passcode - you have to specifically opt out if you don't want one. https://support.apple.com/en-gb/HT202033 https://support.apple.com/en-gb/HT202033
  - thrower123 7y ago
    A huge percentage of people use stupid passcodes, because convenience is more important than security for them. Six ones, or up and down the middle column, that sort of thing.
    - freepor 7y ago
      Guilty. Convenience is much more important than security for me.
- hwbehrens 7y ago
  Back in 2016, it was estimated between 85-89% used a passcode [0]; I expect it's probably even higher today. [0]: https://techpinions.com/apples-penchant-for-consumer-security/45122 https://techpinions.com/apples-penchant-for-consumer-securit...

jaclaz 7y ago

Also - besides its name and the company name - there is nothing AFAIK connecting it to "black/gray market", at least initially those were offered only to LEO and only in US and Canada. And the "long been used" is IMHO a tad bit exaggerated, it came out in the first months of 2018, and - set aside the FBI and whatever other US three or four letter government agencies, it is not likely that US$ 15,000 or US$ 30,000 is something that any police department has in a drawer and can spend instantly, more probably it has taken at least a few months for everyone to get the expense authorized: https://www.forbes.com/sites/thomasbrewster/2018/03/05/apple-iphone-x-graykey-hack/#3111d4ce2950 https://www.forbes.com/sites/thomasbrewster/2018/03/05/apple... No idea on volumes of sale or how many departments got one, in either the "online" or "offline" version, but by now - if it was "widely" used - I presume we would have a lot of evidence based on unlocked iPhones in trials.

sjy 7y ago
That may not be a safe presumption. Organisations like the FBI keep their investigative techniques secret as long as they can, to preserve their effectiveness in ongoing and future investigations. Trials are the exception; most cases end without one, and the decline of local reporting means the public is less informed about the daily business of the courts.
- jaclaz 7y ago
  Yep. it is actually largely dubitative. I don't know, I simply have no idea of the number of device units of the Gray thingy sold, and how much they could have been used, and as well I have no idea on how many crimes involve the access to a (password protected) iPhone, but unless (yet another piece of data I have no idea about) all suspects either use an Android (or however non-iPhone) or give to the police access to the device without need to "crack" the access code, they should be non-trivial amounts. I mean, I understand that it is a fraction (going to trial) of a fraction (criminal cases involving a phone) of a fraction (suspects not providing access to the device) of a fraction (suspects using specifically an iPhone), still the ubiquity of iPhones and the large number of criminal cases should anyway result in tens or hundreds, while we have AFAICT none or maybe a few actually documented/published about. The declining of local reporting may be indeed another factor, but there would certainly be lawyers making a fuss (right or wrong) about this or that right violated through the use of this or similar tool. The contract with ICE: https://www.forbes.com/sites/thomasbrewster/2019/05/08/immigration-just-spent-a-record-1-million-on-the-worlds-most-advanced-iphone-hacking-tech/#2ce23c7c5a0a https://www.forbes.com/sites/thomasbrewster/2019/05/08/immig... is likely to produce no public court records, just like many national agencies, still the sheer fact that not a single actual court record of its use can be found (at least by me) could mean that the device is not used that much by local police, a few cases should have been brought to the attention of the public.

pingyong 7y ago

So what's the deal with this? Isn't it just brute force? I would've expected the NSA to have something like that since iPhones first hit the market.

sp332 7y ago
The main trick is bypassing the increasing timeouts for multiple incorrect guesses.
- pingyong 7y ago
  Shouldn't you always be able to completely bypass that by taking out the chip or something and just probing it directly? I guess that might be a bit much for normal police work, but in terms of "can the government (read: NSA) get into this" this doesn't really seem to change anything.
  - kop316 7y ago
    Possibly, but that still defaults back to brute forcing a long passphrase with a salt. If guessing the passphrase goes above a certain entropy and Apple derives the password with a key stretching algorithm, then the timeouts won't matter.
    - pingyong 7y ago
      That's exactly what I mean - the usual key complexity rules apply, and have always applied.
      - testvox 7y ago
        But they shouldn't. The key you enter as a user is actually only half of the key needed to decrypt the data. The other half of the key is generated by the secure enclave when the device was first powered on. This part of the key alone should be impossible to brute force and is stored in tamper resistant flash memory on the secure enclave co-processor. So you would need to break open the co-processor without destroying its contents and read the secure enclave key before any brute forcing could happen directly on the encrypted data. And no you can't just try to brute force it by sending decryption requests to the secure enclave. The secure enclave itself implements a exponentially increasing lockout time and won't respond to decryption requests during it. [0] [0] https://www.apple.com/in/business-docs/iOS_Security_Guide.pdf https://www.apple.com/in/business-docs/iOS_Security_Guide.pd...