5 ms·
Computationally I understand that cracking PINs is trivial for modern computers. But does anyone know by what means these mobile forensics tools are able to bru
by jmt_ 6y ago
Computationally I understand that cracking PINs is trivial for modern computers. But does anyone know by what means these mobile forensics tools are able to brute force? I thought iPhone's will lock you out for a certain amount of time after a certain amount of failed attempts. Depending on the device/OS, are there ways to extract some sort of hashed password then crack on desktop like usual? Is a vulnerability of some sort always required to extract phone hashes?
- mcphage 6y ago> I thought iPhone's will lock you out for a certain amount of time after a certain amount of failed attempts. One of the techniques used is, copying the memory from your phone onto another phone, and then testing passwords on that. When it locks up, wipe it and recopy. I don't know if that is still used, however.
- jmt_ 6y agoConceptually that makes sense to me but if you're already locked out of the phone how would you access the memory in the first place?
- WJW 6y agoOpen up the phone, solder leads to the memory bus? EDIT: If you can access the real time clock chip and set the clock to a point in the future where the lockout has elapsed, that might work as well.
- dboreham 6y agoNo. The memory in question is inside a special chip designed explicitly for the purpose of not allowing easy access.
- WJW 6y agoNot allowing "easy" access is not the same as "no" access though. I could easily imagine a radar/MRI imaging system generating instructions for a cnc drilling rig that would make micrometer accurate holes through the chip packaging, then inserting extremely precise probes directly into the wires inside the package. I could also imagine a team of 5-10 engineers making such a system in a year (total costs <10 million), with 20-50 million in off-the-shelf hardware costs as a pessimistic estimate. As a company, you then "only" have to amortize this cost over 20 countries each wishing to crack the phones of 5 phones of high-profile criminals and/or dissidents each to get to an average cost of 600k per phone. It would easily be worth that much to the US to crack the phone of a high profile drug lord. Long story short, private companies (even with as much resources as Apple) either need watertight mathematical proofs of security or accept that they stand no chance at all against nation state adversaries.
- Shivetya 6y ago(out of my league here) why not copy memory to another device and run a crack against a segment of the memory known to hold specific values until you match? I am not sure if they can block taking encrypted data off a device. So my question is, case intrusion. Can this be detected in various forms in order to render the contents of the device useless? The safety factor to the owner is that they would have backed up the device to a trusted source before they voluntarily submitted a phone to being physically opened. you would need to not only check for separation but drilling through either side.
- Scoundreller 6y agoCould be the latter. But Every process can be prone to glitching. Just mess with the “how many password failures have occurred? If >10 start erasing” process and there’s no such thing as too much failure anymore. iPhones used to increment (or save the increment) after the password entry failure, so bypassing used to be as simple as quickly disconnecting power before your failure got recorded. It’s also possible they can make copies of enough data and have a “slave” iPhone embedded in the device to continue cracking offline, just in case only the guts of an iPhone can do the decoding.