3 ms·

According to these estimates: https://appleinsider.com/articles/18/04/16/researcher-estimates-graykey-can-unlock-a-6-digit-iphone-passcode-in-11-hours-heres-ho

by jaclaz 7y ago

According to these estimates: https://appleinsider.com/articles/18/04/16/researcher-estimates-graykey-can-unlock-a-6-digit-iphone-passcode-in-11-hours-heres-how-to-protect-yourself https://appleinsider.com/articles/18/04/16/researcher-estima... 4 digit = less than 15 minutes 6 digit = less than 24 hours 8 digit = less than 92 days Besides those estimates, other sources talk of 4 digit = a couple of hours 6 digit = some three days https://blog.malwarebytes.com/security-world/2018/03/graykey-iphone-unlocker-poses-serious-security-concerns/ https://blog.malwarebytes.com/security-world/2018/03/graykey... even if those could be "lucky" events. The "clever" bit, according to reports is that the procedure "frees the device", i.e.: 1) you connect the iPhone to the Graykey 2) Graykey does something in a few minutes 3) you disconnect the iPhone and it is the phone itself that in due time unlocks itself Which plainly means that several devices can be processed per hour (and then kept on a shelf, connected to a power supply as long as it is needed).

colejohnson66 7y ago
> 2) Graykey does something in a few minutes It’s probably using some kind of exploit to upload a custom ramdisk (similar to jailbreaks). Except, unlike jailbreaks, it doesn’t jailbreak the device, but instead tests the passwords. What’s also interesting is that the Secure Enclave (which holds the encryption key) is supposed to enforce the 10 password limit, so they’re doing something really clever here.
- daxorid 7y ago
  Occam's Razor here suggests that the SEP doesn't actually enforce the limit (it's clearly not enforcing the delays, either), and that the almighty Marketing Department defeated the security engineers once again. It's much more likely that a marketing-driven product development culture would lie to its customers than it is that Grayshift engineers have compromised the SEP itself. Researchers have been "compromising" HSMs by standing on its external signaling implementation rather than the chip itself for decades, now.

by jaclaz 7y ago

colejohnson66 7y ago

> 2) Graykey does something in a few minutes It’s probably using some kind of exploit to upload a custom ramdisk (similar to jailbreaks). Except, unlike jailbreaks, it doesn’t jailbreak the device, but instead tests the passwords. What’s also interesting is that the Secure Enclave (which holds the encryption key) is supposed to enforce the 10 password limit, so they’re doing something really clever here.

daxorid 7y ago
Occam's Razor here suggests that the SEP doesn't actually enforce the limit (it's clearly not enforcing the delays, either), and that the almighty Marketing Department defeated the security engineers once again. It's much more likely that a marketing-driven product development culture would lie to its customers than it is that Grayshift engineers have compromised the SEP itself. Researchers have been "compromising" HSMs by standing on its external signaling implementation rather than the chip itself for decades, now.