Slashdot Mirror
State Department Seemingly Buys $15,000 iPhone Cracking Tech GrayKey (vice.com)
An anonymous reader quotes a report from Motherboard: Grayshift, a company that offers to unlock modern iPhones for as little as $50 each, has caused a buzz across law enforcement agencies, with local police already putting down cash for the much sought-after tech. Now, it appears a section of the U.S. State Department has also purchased the iPhone cracking tool, judging by procurement records reviewed by Motherboard. Grayshift's iPhone product, dubbed GrayKey, can unlock devices running versions of Apple's latest mobile operating system iOS 11, according to marketing material obtained by Forbes. An online version of GrayKey which allows 300 unlocks costs $15,000 (which boils down to $50 per device), and an offline capability with unlimited uses is $30,000. According to a recent post from cybersecurity firm Malwarebytes, which obtained leaked details on GrayKey, the product itself is a small, four inch by four inch box, and two iPhones can be connected at once via lightning cables. Malwarebytes adds that the time it takes to unlock a device varies depending on the strength of the user's passcode: it may be hours or days. Notably, Grayshift includes an ex-Apple engineer on its staff, Forbes reported.
On March 6, the State Department ordered an item from Grayshift for just over $15,000, according to a purchase order listing available on the U.S. government's public federal procurement data system. The listing is sparse on details, putting the order under the generic label of "computer and computer peripheral equipment." But Motherboard confirmed that the Grayshift in the State Department listing is the same as the one selling iPhone cracking tech: the phone number of the vendor in both the purchase order and documents Motherboard previously obtained detailing a GrayKey purchase by Indiana State Police is the same. The "funding office" for the Grayshift purchase was the Bureau of Diplomatic Security, according to the procurement records. The Bureau acts as the law enforcement and security arm of the State Department, bearing "the core responsibility for providing a safe environment for the conduct of U.S. foreign policy," the State Department website reads.
On March 6, the State Department ordered an item from Grayshift for just over $15,000, according to a purchase order listing available on the U.S. government's public federal procurement data system. The listing is sparse on details, putting the order under the generic label of "computer and computer peripheral equipment." But Motherboard confirmed that the Grayshift in the State Department listing is the same as the one selling iPhone cracking tech: the phone number of the vendor in both the purchase order and documents Motherboard previously obtained detailing a GrayKey purchase by Indiana State Police is the same. The "funding office" for the Grayshift purchase was the Bureau of Diplomatic Security, according to the procurement records. The Bureau acts as the law enforcement and security arm of the State Department, bearing "the core responsibility for providing a safe environment for the conduct of U.S. foreign policy," the State Department website reads.
apple will just drop lightning cables in next phone
6 billion a pop damges offense according according the RIA.
Silly peasant thinking those laws apply to police.
What does it mean for a passcode to be particularly strong or weak when the passcode must be all digits and must be some fixed number of digits long?
File under 'M' for 'Manic ranting'
That's amusing, but of course there has to be some way to access the phone. Whatever they use, the cracking software will use that.
When you get suckers desperate for “magic keys”, you are in a prime position to troll them. It would serve the law “enforcement” a lesson.
...and then it will use it to determine how it is cracking the login, and then they will fix it, and the security will be even stronger for Apple. Sounds like a good deal. :P
Its obvious that they must have found an exploit that allows them to bypass the number-of-attempts security mechanism. I wonder if this is handled in IOS or if it is a more serious Security Enclave bug.
dmca does apply to police.
like there's anything we can do that will stop them from invading our privacy, it's over, we're done ....
Probably cheaper to buy the entire company.
What and standardize on the USB-C connector that they helped popularize? Ironically, I really doubt it.
Notably, Grayshift includes an ex-Apple engineer on its staff
*Grabs the popcorn and waits for the 8+ figure lawsuit.*
Has to? HAS TO? Challenge Accepted!
--signed, Tim Cook.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Did someone in the justice department finally learn how to google?? I have had to do this for +10 years in IT just for my job for users that forget their passkey's to unlock there phones. Usually the biggest issue is, can I beat the price of the 1st one I found - and were only talking about the difference of $3-200.
Have courage.
Has there been any verification that this software works? I've seen reports of police purchasing it,but no report it actually works.
Sent from my TARDIS
It will charge only using AppleTooth, wirelessly.
So a company will crack an iPhone for 50 bucks? What does that imply about the security of financial information on a lost smartphone? Is it even easier to crack Android Phones? If a smartphone comes into possession of a theft-ring, how long does it take to crack a phone with all current security updates in place?
Sure, it could be that Android devices are super secure. Or that you can find Rubber Ducky scripts that do that.
And this is exactly why, legislated, forced decryption will never work. If you store an 'extra' key on a device, even 'securely' store an 'extra' key, then someone will find out how to access that key.
Why would the State Department be cracking phones? They provide neither a law enforcement nor an intelligence function.
Have gnu, will travel.
Add one more Government department at war with its own citizens.
Good thing Americans have all those guns. They'll totally fix these attacks on freedom and the Constitution... right gais?
Filthy spies and criminals and unamericans and we need to open their iphones to prove this!
Apple is being forced into a corner to provide a backdoor so this hardware hack will probably be allowed to stand. So what does this hack do? Try all possible 6 digit passcodes until it unlocks? I had heard that after "X" number of bad passcode entries that the iPhone would wipe itself, but have never found out how to set this up.
It's time for variable-length passphrases.
The State Department provides Plausible Deniability for the FBI, CIA, local law enforcement, etc. Sure, it's paper-thin, but how much do you want to bet they'll try to use it?
Also, the OP claims they bought the $15,000, good-for 300 unlocks version. I'll further bet that at least one of the following will happen (or prove to be true):
1). They actually bought the $30,000, unlimited version;
2). They will short upgrade to the $30,000, unlimited version;
3). They will rip off the vendor and use their $15,000, good-for 300 unlocks version for unlimited use.
There's no way this stays at a usage level of 300 phones. The Feds and law enforcement have thousands of phones they want to crack.
So...do you suppose that Apple will just buy Grayshift next, and resolve the issue? And how long before they do the same with Cellebrite?
Awk! Pieces of eight. Pieces of eight. Pieces of seven... ERROR: General Protection Fault. [Paroty Error.]
Yes, but will they drop Fingerprint scanners?
And to think, the State Department could have saved $15,000 just by using a knife or a bullet to obtain a finger.
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
Be as annoyingly helpful as you can be, and you will piss them off because you are wasting their time.
As an example: Taking all your stuff out of your luggage at the TSA checkpoint and taking up 5 bins.
Reporting *EVERY* item in your luggage because it adds up to more than $200 dollars (or whatever the local quantity of stuff you are supposed to bring in is.)
As long as your items aren't on the restricted item list and the worth of the items (or at least VISIBLE) items is less than they care about, they will just get annoyed and shoo you through without inspecting any further.
Remember the old adage about hiding in plain site. It has always applied to travel and checkpoints/customs.
... to the Computer Fraud and Abuse Act?
Can't the police, FBI and State Department be charged under the CFAA every time they use this device? "Oh, but we were doing it to serve the law!" is not an excuse otherwise White Hats would be immune from prosecution.
That only works if you are dumb enough to turn on device unlocking with your fingerprint...