Slashdot Mirror
Documents Prove Local Cops Have Bought Cheap iPhone Cracking Tech (vice.com)
GrayShift is a new company that promises to unlock even iPhones running the latest version of iOS for a relatively cheap price. From a report: In a sign of how hacking technology often trickles down from more well-funded federal agencies to local bodies, at least one regional police department has already signed up for GrayShift's services, according to documents and emails obtained by Motherboard. As Forbes reported on Monday, GrayShift is an American company which appears to be run by an ex-Apple security engineer and others who have long held contracts with intelligence agencies. In its marketing materials, GrayShift offers a tool called GrayKey, an offline version of which costs $30,000 and comes with an unlimited number of uses. For $15,000, customers can instead buy the online version, which grants 300 iPhones unlocks.
This is what the Indiana State Police bought, judging by a purchase order obtained by Motherboard. The document, dated February 21, is for one GrayKey unit costing $500, and a "GrayKey annual license -- online -- 300 uses," for $14,500. The order, and an accompanying request for quotation, indicate the unlocking service was intended for Indiana State Police's cybercrime department. A quotation document emblazoned with GrayShift's logo shows the company gave Indiana State Police a $500 dollar discount for their first year of the service. Importantly, according to the marketing material cited by Forbes, GrayKey can unlock iPhones running modern versions of Apple's mobile operating system, such as iOS 10 and 11, as well as the most up to date Apple hardware, like the iPhone 8 and X.
This is what the Indiana State Police bought, judging by a purchase order obtained by Motherboard. The document, dated February 21, is for one GrayKey unit costing $500, and a "GrayKey annual license -- online -- 300 uses," for $14,500. The order, and an accompanying request for quotation, indicate the unlocking service was intended for Indiana State Police's cybercrime department. A quotation document emblazoned with GrayShift's logo shows the company gave Indiana State Police a $500 dollar discount for their first year of the service. Importantly, according to the marketing material cited by Forbes, GrayKey can unlock iPhones running modern versions of Apple's mobile operating system, such as iOS 10 and 11, as well as the most up to date Apple hardware, like the iPhone 8 and X.
So now that the cat's officially out of the bag, are all these calls for backdoors and special access by the FBI simply PR? I wonder how many years they've sat on this, without telling anyone, and without helping law enforcement solve crimes? It would seem that the FBI has lost sight of its primary objective, i.e. public safety.
Debate is a form of harassment. Do not question my truth.
That's a totally irresponsible waste of the taxpayers money! I cracked mine THREE TIMES already without even trying! Just drop it on a concrete floor!
#DeleteFacebook
GrayShift is an American company which appears to be run by an ex-Apple security engineer and others who have long held contracts with intelligence agencies.
Seriously? That ex-security-engineer must be violating like 20 different agreements that Apple makes their employees that build their products sign, and here's hoping to see Apple press the charges for industrial espionage, get that ex-engineer in jail for 25 years and sue him for every $$ he and his company's worth.
Taking innate knowledge and all the trade secrets you learned about your employer's product AND then using that to go to work creating or working for a company whose purpose is to subvert that product is almost as severe a breach of IP a product engineer can commit....
if the DMCA doesn't outlaw this, it should be revamped to cover this
outrageous
If people keep their own copyrighted photos on their phones, then you're definitely circumventing access controls to copyrighted works when you crack a phone. Therefore, DMCA is an extremely relevant law with regard to Greykey.
DMCA has exceptions for law enforcement, so if you're a cop then you're allowed to crack the DRM on peoples' photos. Here's that part:
This means that if Greykey is contracted by the cops, they're also allowed to circumvent the DRM. Ass is covered, similarly to what that Israeli service is rumored to do (where AFAIK they crack the DRM rather than provide a tool for the cops to do it themselves).
The problem, though, is before the cracking: if they have a software product that they sell to cops, were they under contract when they developed it? If they weren't, then they defintely violated the law when they "manufacture[d] a technology, product, service, device, component, or part thereof" for circumvention.
Furthermore, unless the cops contracted them to advertise their services, they might have been violating DMCA when they "import [or] offer to the public" that software product. I find it hard to believe that someone in government contracted them to sell the product to others in government. Maybe the FBI paid them to sell their software to local police, but we might as well make them show that in court, because I think the public would be fascinated to see that contract. Congress would like to see that contract too.
But the manufacturing violation is less iffy. They'll almost certainly get busted by a judge, if you can get 'em to the judge.
Someone (anyone who has an iPhone and has used the camera) should sue them, so that we can get a judge to decide this stuff.
I have previously heard cracking techniques described as "security vulnerabilities". Given the ludicrously cheap price of this GreyTool and the huge amount of cash in Apple's bank accounts if I was Apple I would be buying a copy (via assorted shell companies) and seeing how they work and then rolling the countermeasures back into their products. Doing so would be a great way to get cheap security research done for you.
Alternatively Apple could show that the product doesn't work as advertised, or provide advice on how to mitigate its functionality by updating their "security best practices" document (that I am sure they have somewhere)
I am Slashdot. Are you Slashdot as well?
They need possession of the phone. Which still requires the same probably cause or warrant it always has. This is no different than calling in a locksmith open a wall safe.
Yawn.
So, I don't want to Godwin this entire thread, but quite honestly I view companies which do this as little better than Nazi Sympathizers.
They don't care about the potential harm they do, they don't treat this on a case by case basis -- they're just providing a carte blanche tool to police.
And, like all such people, I'm sure they're fairly indiscriminate about selling to the nastier countries with terrible track records on human rights.
I bet there is little to no judicial oversight in how these tools are being used, because the police don't care for such things.
Sorry, but making and selling tools like this should make you a target. You clearly don't give a damn about the finer details of when this is used and the impact to people's lives .. so why the fuck should we give a fuck about your life?
There is no claim of "how was I to know" or "I was just following orders". This is straight up helping a totalitarian state for profit.
Morally, I don't see the difference between these guys and the people who helped the Nazis.
This is why there can never be backdoors for law enforcement. Fuck 'em all.
How do we know that any of this stuff actually works? For all anyone knows, these companies are selling smoke and mirrors.
This is my opinion. To make sure you don't steal it, it's covered by the DMCA.
The fucking NSA, via ShadowBrokers.
It little behooves the best of us to comment on the rest of us.
I'd decrypt for a third party pledged to access only what the warrant is seeking. I don't think it's fair to decrypt and give blanket access for fishing expeditions.
Cheap storage VM.
No.
It only requires that the Police lie to the judge.
Paid apps are next shit impossible to break as locked with quantum computers never unlocking ever, you bought what is coming with ignorance. Cops sucking the data from the phones of those they stopped like Chinese Communist caused this in the first place. Is there no part of American government not rock stupid?
If he is making use of an Apple trade secret, especially if he has signed contracts to keep such confidential, then he is in violation.
This is not a issue of having the right to continue the same work under different employment.