9 ms·
Instructions show how cops use GrayKey to brute force iPhones
- airza 5y agoDoes being at low battery make attacks against the device easier? Seems like it does from the report here but i'm not sure why.
- lazide 5y agoSpeculation - maybe it turns off some rate limiting, or disables some sanity checking that is more CPU/energy intensive or similar?
- kadoban 5y agoI read that as just being a list of what circumstances you can still use the attack that you might otherwise think you couldn't. For example having a broken screen it seems clear couldn't provide any benefit, but that's also in that same list.
- alias_neo 5y agoI too wondered why this is significant, couldn't you simply charge the device first? Wouldn't it be charging while connected to the GreyKey?
- Anunayj 5y agoI remember seeing a similar attack on iphones before. What I understood was it cutoff the power to the device before the TPM could log a passcode attempt. This [1] seems to be similar to what I remember. [1] https://techcrunch.com/2015/03/19/iphone-bruteforce-pin/ https://techcrunch.com/2015/03/19/iphone-bruteforce-pin/
- athrun 5y agoIt's interesting how the instructions say that an agent can be installed on the phone even _before_ attempting to brute force the password. How can an application be installed if the phone is locked?
- kadoban 5y agoMy understanding was that this requires some kind of exploit, but this exploit does not actually give you the passcode. I'm guessing from context that it also doesn't allow you to unlock even if the phone is on? That seems somewhat surprising to me.
- gumby 5y agoPresumably via an exploit they have found in the USB subsystem connected to the lightning port.
- Tangokat 5y ago183 days to try 63 million passwords. Roughly 4 per second by my math.. that seems pretty low to me. Any decent password would be uncrackable in that case - but of course if people mostly use numerical 4 digit passwords that's plenty fast.
- tempay 5y agoI believe the secure enclave, which is responsible for mapping the passcode to an encryption key, has hardware level rate limiting so I suspect GrayKey is limited by that.
- jackric 5y agoWho was smart enough to implement rate limiting there, but not an exponential lockout period?
- bildung 5y agoThe probable standard answer for every large organization: Those were the responsibilities of different teams.
- vxNsr 5y agoThey did, the exploit here is shutting down the phone before it has a chance to log there was a password attempt.
- TwoBit 5y agoDoesn't that apply only to older phones?
- Scoundreller 5y agoSomeone who never got DDoS’d by their own app after their server went down, that’s who.
- dylan604 5y agoHaven't there been stories of parent's losing their phones because their kids randomly entering in passcodes forced the exponential time outs to be into the years (and longer) time frames?
- EMM_386 5y agoEasiest way to do this is probably what is mentioned at the end of the article: > As part of a feature called HideUI, GrayKey also allows agencies to install the agent which surreptitiously records the user's passcode if authorities hand their phone back to them, NBC News reported.
- csunbird 5y agoA keylogger, as it seems. So, if you give your phone unlocked to authorities, e.g. during a border check, they can log your passcode and you are now screwed.
- squarefoot 5y agoI think it's time for phone manufacturers, at least the few unknown ones that care for users privacy, to implement plausible deniability in the form of two or more bootable systems where one is the main one and the others boot would be triggered by a special password, so that they would not contain certain phone numbers, messages, etc. and anything installed there wouldn't have access to other partitions/systems. The system should be clever enough to let some innocuous information slip from other systems. For example, let's say a border guard asks me for a password and I give the one that boots the system I'd use when travelling, with no other stuff than a few family photos and cat videos, if he checked the phone calls he would immediately spot that I didn't make a phone call (with that system) in one month or more, which would immediately raise alarms, so there should be a way to tell the other systems to slip in there some information like phone calls to relatives or the restaurant, chats with girlfriend, etc. just so that one could pretend that the system was used daily.
- Scoundreller 5y agoI advise turning your phone off at border crossings. But even that is getting cut down on. Maybe I can set this up with automation and geofencing.
- alias_neo 5y agoWhat does turning the phone off solve? Can you not be compelled to turn it on? I always assumed a border agent in the US would simply insist you turn it on for them, and you have no choice.
- gjsman-1000 5y agoOf notable curiosity not mentioned by VICE, but Apple actually modified their A12, A13, and A14 (I believe) CPUs while still in production to have a new second-generation Secure Enclave embedded within them sometime around Fall 2020. We don't know the full extent of the changes, but it sounds like the 2nd-generation enclave comes with much stronger hardware-based rate limiting on PIN code guessing through a "mailbox" system. For me, that means I have my eyes all on whether an iPhone 12, iPhone 12 Pro, or (new) iPhone SE 2nd Gen get hacked. Right now the highest confirmed GrayKey hack is an iPhone 11, which wouldn't have the change. We'll see whether Apple got them this time.
- gjsman-1000 5y agoQuote from Apple Platform Security > Hardware Security > Secure Enclave: "Devices first released in Fall 2020 or later are equipped with a 2nd-generation Secure Storage Component. The 2nd-generation Secure Storage Component adds counter lockboxes. Each counter lockbox stores a 128-bit salt, a 128-bit passcode verifier, an 8-bit counter, and an 8-bit maximum attempt value. Access to the counter lockboxes is through an encrypted and authenticated protocol. Counter lockboxes hold the entropy needed to unlock passcode-protected user data. To access the user data, the paired Secure Enclave must derive the correct passcode entropy value from the userʼs passcode and the Secure Enclaveʼs UID. The user’s passcode can’t be learned using unlock attempts sent from a source other than the paired Secure Enclave. If the passcode attempt limit is exceeded (for example, 10 attempts on iPhone), the passcode-protected data is erased completely by the Secure Storage Component." https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/1/web/1 https://support.apple.com/guide/security/secure-enclave-sec5...
- TwoBit 5y agoI once had auto reset enabled on my phone after 10 attempts, and then somehow while it was in my gym bag it proceeded to accidentally get buttons pressed and reset itself. Better to set that number to 1000 instead of 10.
- gjsman-1000 5y ago
- cbsks 5y ago“GrayKey also allows agencies to install the agent which surreptitiously records the user's passcode if authorities hand their phone back to them” Yikes. This is something that probably would trip up a lot of people. After arresting you and taking your phone, they say you can make a phone call and pass your phone back to you. You unlock and it’s game over.
- gjsman-1000 5y agoGood to know though - if you are ever arrested, reboot your iPhone before entering the PIN. At least for the last 5 years since (I believe) the A9, no malware or jailbreak has managed to be persistent on an iPhone beyond a reboot that we know of. This is likely because all of the exploits jailbreaks or malware use are flaws in already running processes, but when the phone is rebooted, hardware root of trust verifies everything that loads is signed by Apple, clearing out the virus/jailbreak unless it was manually invoked (or plugged into the GrayKey) again to re-exploit those processes. Of course, in the unlikely event that you happened to have an iPhone without the new Secure Storage component mentioned on this thread, be arrested, and the cops were trying to "Hide UI" on you, it would be really awkward for them if you rebooted your phone first ruining the trap. "Wait, no, you're supposed to enter your PIN right now!"
- gruez 5y ago>Good to know though - if you are ever arrested, reboot your iPhone before entering the PIN. how do you trust that the phone was actually rebooted? ie. the ui fakes a reboot screen.
- gjsman-1000 5y agoThere is always that risk. However, if you are this paranoid, you need to remember that you can do a Force Restart. This is handled by hardware, not by software, so if you know what to look for it cannot be faked. https://support.apple.com/guide/iphone/force-restart-iphone-iph8903c3ee6/ios https://support.apple.com/guide/iphone/force-restart-iphone-...
- 5y ago
- yohannparis 5y agoSo... now I should just brake my phone in half before giving it to the Police. Lovely!
- junon 5y agoMost likely will land you an obstruction of justice or evidence tampering charge - or both. I don't rec this.
- Scoundreller 5y agoI’ve had enough of trip crap. Has anyone rewired their lightning connector so it only works with your own cables and everything else fails?
- gruez 5y agoThat's an interesting idea, although I suspect for it to be effective you have to make it self-destruct the data if a wrong cable is inserted. Otherwise they'll plug the cable in, see it's not working, and send it off to a forensics lab to "fix" the phone at which point they'll discover your modification and revert it. Based on the teardown photos[1][2], it doesn't look like there's much space to work with here, so getting any sort of modification in there would be non-trivial. [1] https://guide-images.cdn.ifixit.com/igi/v16ARReBbanfWoOb.huge https://guide-images.cdn.ifixit.com/igi/v16ARReBbanfWoOb.hug... [2] https://guide-images.cdn.ifixit.com/igi/VP4BE2cGikTdBXKi.huge https://guide-images.cdn.ifixit.com/igi/VP4BE2cGikTdBXKi.hug...
- zionic 5y agoYou could always physically destroy the port and just use wireless charging
- gruez 5y agoDestroying the port would also be a minor roadblock, because they can just solder on a new port (see prior comment about shipping off the phone to a forensics lab to fix it).
- Scoundreller 5y agoStill prevents an evil maid attack malware upload. Security isn’t about being 100%, it’s about making your stuff as a target unworthwhile, or delaying things until long after you’re dead (where apple’s password cracking prevention obviously lacks) With enough epoxy when you reconstruct, resoldering isn’t so straightforward.
- gjsman-1000 5y agoThis is also interesting and something VICE missed, look at the first image which was from the FOIA Request! It's Firefox, and in the bookmarks bar, you have GrayKey login, GrayKey/GrayShift Support, and a certain page from Apple support explaining how to enter recovery mode... https://support.apple.com/en-us/HT201263 https://support.apple.com/en-us/HT201263 To me, that suggests that these cops have it bookmarked because GrayShift is using some sort of Recovery Mode exploit, similar to Checkm8 did through Checkra1n for the A10 and below, and the cops have it bookmarked so they remember how to do it.
- musicale 5y agoDoes Apple encrypt iCloud backups now?
- thetinguy 5y agoNo. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
- artificialLimbs 5y agoThe table in your link says yes.
- xvector 5y agoThe table is intentionally misleading. Read the text. It's not E2EE.
- beermonster 5y agoYou can encrypt them locally using Finder. Then they can also make it onto your Time Machine backup too. Just need an offsite copy after that. Though looking at what iCloud backup includes it mainly seems to be settings and app data. App data is often centralised anyway or uses iCloud Drive
- gnu8 5y ago> The instructions open with asking readers to make sure they do have legal authorization to search the device; this can be in the form of a search warrant. This is a joke. As a rule, law enforcement does not respect fourth amendment rights and see the constitution only as red tape to be ignored or circumvented whenever convenient.
- 2OEH8eoCRo0 5y agoDo you have a source for that claim?
- 4ec0755f5522 5y agoThis is, unfortunately, in the 'water is wet' category of observable reality.
- 2OEH8eoCRo0 5y agoNo. I personally know law enforcement officers who go above and beyond, often getting warrants they think they don't need to err on the side of caution. So. Do you have a source for that?
- serf 5y agoI don't know what kind of proof or sources would satisfy you; I concur with the earlier poster that claims that this kind of thing should be considered a 'water is wet' statement, but if I thought that police conducted their affairs 'by the book', i'd have some questions and misgivings about the disproportionately large sums of money that come out of city coffers to pay for settling police misconduct cases[0]. or i'd check out Justice Robert's thoughts on fourth amendment violations with regards to violent police actions[1]. Apparently getting shot can be considered a seizure; plenty of people every day shot in the midst of unwarranted and illegal police actions, by police officers who often fail to convince the courts that their actions could ever be considered reasonable. I'm not going to bother linking data about 'Police Brutality United States 2020' or 'Police Misconduct United States 2020' -- the datasets are numerous , feel free to google those phrases. I feel as if I were to link one you'd just judge whichever I chose For every law enforcement officer, who you may anecdotally know personally, that does things 'The Right Way', there is an un-told number of LEOs that fail to share the same altruistic and noble priorities that your friends might. [0]: https://fivethirtyeight.com/features/police-misconduct-costs-cities-millions-every-year-but-thats-where-the-accountability-ends/ https://fivethirtyeight.com/features/police-misconduct-costs... [1]: https://news.bloomberglaw.com/us-law-week/woman-shot-by-police-wins-supreme-court-seizure-case https://news.bloomberglaw.com/us-law-week/woman-shot-by-poli...
- codezero 5y agoSearching for some of the phrases in that list, you can find some interesting PasteBin texts from 2018… https://pastebin.com/ytdUCrwV https://pastebin.com/ytdUCrwV https://pastebin.com/uTdSyUj4 https://pastebin.com/uTdSyUj4
- brokenmachine 5y agoNobody paid the 2 btc for the code... https://www.blockchain.com/btc/address/1Cg61mVzMCvs2ZP148VeoBnQnv8rHxAZES https://www.blockchain.com/btc/address/1Cg61mVzMCvs2ZP148Veo... https://www.blockchain.com/btc/address/1BqFDiNKjAKBopdr37Mw7vM2oG8pgWvzNL https://www.blockchain.com/btc/address/1BqFDiNKjAKBopdr37Mw7...
- brokenmachine 5y agoEveryone's discussing technical measures to lock their phone or prevent these measures from working under particular circumstances, but nobody is commenting on the dystopian nightmare we find ourselves in. Phones contain so much private information that it's incredible that they are not given special treatment in law. Data on a phone never killed anyone. Cops are conducting warrantless searches of people's phones with impunity and it has become normalized. The potential for misuse or damage from leaks of that data is huge. And even worse, no political party is even talking about changing that anachronistic, disgusting status quo. It's just more and more draconian laws to hack and spy on innocent citizens, "for our safety", and even worse, mass spying that is actually illegal goes unpunished. Even worse, the whistleblowers who brought these illegalities to light are being disappeared in various ways. I don't know what we can do about it but it is just so disappointing and sad. Where are the good guys to protect us?