Slashdot Mirror
Cops Are Confident iPhone Hackers Have Found a Workaround to Apple's New Security Feature (vice.com)
Joseph Cox, and Lorenzo Franceschi-Bicchierai, reporting for Motherboard: Apple confirmed to The New York Times Wednesday it was going to introduce a new security feature, first reported by Motherboard. USB Restricted Mode, as the new feature is called, essentially turns the iPhone's lightning cable port into a charge-only interface if someone hasn't unlocked the device with its passcode within the last hour, meaning phone forensic tools shouldn't be able to unlock phones. Naturally, this feature has sent waves throughout the mobile phone forensics and law enforcement communities, as accessing iPhones may now be substantially harder, with investigators having to rush a seized phone to an unlocking device as quickly as possible.
That includes GrayKey, a relatively new and increasingly popular iPhone cracking tool. But forensics experts suggest that Grayshift, the company behind the tech, is not giving up yet. "Grayshift has gone to great lengths to future proof their technology and stated that they have already defeated this security feature in the beta build. Additionally, the GrayKey has built in future capabilities that will begin to be leveraged as time goes on,' a June email from a forensic expert who planned to meet with Grayshift, and seen by Motherboard, reads, although it is unclear from the email itself how much of this may be marketing bluff. "They seem very confident in their staying power for the future right now," the email adds. A second person, responding to the first email, said that Grayshift addressed USB Restricted Mode in a webinar several weeks ago.
That includes GrayKey, a relatively new and increasingly popular iPhone cracking tool. But forensics experts suggest that Grayshift, the company behind the tech, is not giving up yet. "Grayshift has gone to great lengths to future proof their technology and stated that they have already defeated this security feature in the beta build. Additionally, the GrayKey has built in future capabilities that will begin to be leveraged as time goes on,' a June email from a forensic expert who planned to meet with Grayshift, and seen by Motherboard, reads, although it is unclear from the email itself how much of this may be marketing bluff. "They seem very confident in their staying power for the future right now," the email adds. A second person, responding to the first email, said that Grayshift addressed USB Restricted Mode in a webinar several weeks ago.
Talk is cheap.
Show us a video, or it's just bullshit.
And what would the cops do if I just stopped USING my iPhone, didn't carry it, or... hell, didn't even HAVE one?!? NOW WHAT? HUH?!? NOW how are you going to break into it and root around in it, if I don't HAVE ONE?!? HUH?!?
CHECK, AND MATE, COPPERS!
(LOL... like I could really live without this damned thing...)
Our reign has gone on long enough. Indeed. Summon the meteors.
They can completely control all our "devices" (PCs running Linux or Qubes OS is no exception) remotely. All this BS about "end-to-end encryption" and "forensics experts" failing to extract any data they want is absolutely sickening to hear. Do you all actually believe this?
The work around is by setting the clock back via the cellular network.
How many times do people charge their phone off a "public" USB charge port in an airport or on public transportation? Any one of those ports could be trying to slurp confidential data. Charge-only without authentication and permission should be default behavior for all phones.
Also, this isn't only about the US government and US police trying to unlock phones. This also protects US citizens against abuses by foreign governments -- i.e. the Chinese or Venezuelans confiscating someone's phone at an airport and "working on it."
Not to mention that not all US law enforcement are the good guys. Plenty of corrupt cops out there who want to snoop without a warrant.
Why is it even 1 hour? Why not lock the USB port whenever the phone is locked?
I remember when we all were told encryption was never going to be hacked. Never say never because its all a marketing ploy for Apple anyway. Just as it always said Mac OS could never get malware. If your going to commit a crime, you best not be carrying a tracking device and snitch like a cell phone.
And what would the cops do if I just stopped USING my iPhone, didn't carry it, or... hell, didn't even HAVE one?
Oh they have a tool for that also, but I don't think you are going to enjoy it much...
It's called "GraySkull".
They have the power.
"Grayshift has gone to great lengths to future proof their technology and stated that they have already defeated this security feature in the beta build"
Umm, if true, how stupid of them to say it.
How many times do people charge their phone off a "public" USB charge port in an airport or on public transportation? Any one of those ports could be trying to slurp confidential data.
If you rely on either your phone's security, or trusting whatever 3rd party provides a charge port, you're doing it wrong.
Just use a charge-only cable that has only power wires, but no data lines in it. Or bring an AC -> DC adapter as well, and use an AC mains outlet. Or bring a powerbank. Or charge from your laptop.
Use strong passwords instead of 4-6 digits..
Additionally, the GrayKey has built in future capabilities that will begin to be leveraged as time goes on
Holy Crap! Should invest in those guys because they are from the future, so much so they have built in capabilities for bugs and security features that don't exist yet! So sweet! (Other than that, sounds like marketing on GrayShift's part)
So you were expecting them to say this perhaps:
"GrayKey marketing team admits total defeat. We'll be rolling back operations beginning next month and employees can collect their last paychecks end of July. Thanks for the ride guys!"
Since hacking is illegal, why are cops buying from Grayshift instead of raiding their offices?
How is this not a violation of the DMCA? Couldn't Apple simply bury these companies under mountains of lawsuits to make them go away?
Do what thou wilt shall be the whole of the Law - Aleister Crowley
How can you possibly doubt the hackers? They're hackers!
what about an very local tower with some kind of Emergency call mode that unlocks stuff?
law enforcement is dmca exempt!
Aren't the cops and their vendors violating the DMCA by hacking into Apple's phones?
Does the exemption extend to a non government software vendor?
Rules for thee, not for me. Slavery is freedom. War is peace.
Breaking into your homes, now with consent!
They aren't a US company. True, by selling to US persons they are availing themselves of US law but I suspect that the law enforcement exemption covers the sales to law enforcement and the law doesn't reach their R&D activity in Israel.
Companies such as GreyKey should be sanctioned and their owners and developers brought up on hacking charges! They have no right to circumvent security technologies PERIOD! We as a society need to embrace security, even if that means that some bad guys will go free. We must not allow ourselves to fall prey to the machinations of those who would see an Orwellian world made manifest.
Support your local school shooter, give them your firearms.
I bet they are just giving out little USB dongle type devices that a cop would connect to the phone upon arrest. This would likely keep the USB port unlocked passed the timeout...
is for the next person who gets arrested and has their phone subjected to such hacking measures is to simply challenge it in court and demand to see everything about the extraction / bypass process.
After all, since you ARE hacking into the phone, we need to verify it's doing nothing nefarious and / or corrupting the data contained within it.
Much like how the LE Community will drop charges without revealing how / when / where they are using Stingrays, they'll drop the charges before they're forced to show their hand here as well.
I wonder how long it will be until somebody figures out how to implement a "dead man's switch" requiring a code to be entered at user-determined intervals, or the device would use all its remaining battery power to commit suicide.
I have a feeling it wouldn't be easy to extract data from a phone that decided to do its very best impression of a Note 7.
Added bonus: potential havoc at the cop shop.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
and the law doesn't reach their R&D activity in Israel.
No, but a missile sure does.
...then stick your finger up your arse and run it lovingly around the lip of their cup. Do not pass up the opportunity to serve these malignant little nerds with something noxious.
If you work in any other industry, then please adapt accordingly.
We will see how confident they are of their staying power when their employees start contracting Hepatitis A for unknown reasons.
This is the only way that we're ever going to teach vile little nerds like this about how society works.
and the law doesn't reach their R&D activity in Israel.
No, but a missile sure does.
So Iran is our only hope?
This has always struck me as a dumb implementation. Why not simply require passcode to enable USB data mode with no timer? Plug in USB, get prompted for passcode. No passcode, no data.
"I like systems, their application excepted", George Sand (French)
and then trump can get an emergency war order and force apple to put in unlock codes in the ios update.