Slashdot Mirror
Cops Are Confident iPhone Hackers Have Found a Workaround to Apple's New Security Feature (vice.com)
Joseph Cox, and Lorenzo Franceschi-Bicchierai, reporting for Motherboard: Apple confirmed to The New York Times Wednesday it was going to introduce a new security feature, first reported by Motherboard. USB Restricted Mode, as the new feature is called, essentially turns the iPhone's lightning cable port into a charge-only interface if someone hasn't unlocked the device with its passcode within the last hour, meaning phone forensic tools shouldn't be able to unlock phones. Naturally, this feature has sent waves throughout the mobile phone forensics and law enforcement communities, as accessing iPhones may now be substantially harder, with investigators having to rush a seized phone to an unlocking device as quickly as possible.
That includes GrayKey, a relatively new and increasingly popular iPhone cracking tool. But forensics experts suggest that Grayshift, the company behind the tech, is not giving up yet. "Grayshift has gone to great lengths to future proof their technology and stated that they have already defeated this security feature in the beta build. Additionally, the GrayKey has built in future capabilities that will begin to be leveraged as time goes on,' a June email from a forensic expert who planned to meet with Grayshift, and seen by Motherboard, reads, although it is unclear from the email itself how much of this may be marketing bluff. "They seem very confident in their staying power for the future right now," the email adds. A second person, responding to the first email, said that Grayshift addressed USB Restricted Mode in a webinar several weeks ago.
That includes GrayKey, a relatively new and increasingly popular iPhone cracking tool. But forensics experts suggest that Grayshift, the company behind the tech, is not giving up yet. "Grayshift has gone to great lengths to future proof their technology and stated that they have already defeated this security feature in the beta build. Additionally, the GrayKey has built in future capabilities that will begin to be leveraged as time goes on,' a June email from a forensic expert who planned to meet with Grayshift, and seen by Motherboard, reads, although it is unclear from the email itself how much of this may be marketing bluff. "They seem very confident in their staying power for the future right now," the email adds. A second person, responding to the first email, said that Grayshift addressed USB Restricted Mode in a webinar several weeks ago.
Talk is cheap.
Show us a video, or it's just bullshit.
And what would the cops do if I just stopped USING my iPhone, didn't carry it, or... hell, didn't even HAVE one?!? NOW WHAT? HUH?!? NOW how are you going to break into it and root around in it, if I don't HAVE ONE?!? HUH?!?
CHECK, AND MATE, COPPERS!
(LOL... like I could really live without this damned thing...)
Our reign has gone on long enough. Indeed. Summon the meteors.
The work around is by setting the clock back via the cellular network.
How many times do people charge their phone off a "public" USB charge port in an airport or on public transportation? Any one of those ports could be trying to slurp confidential data. Charge-only without authentication and permission should be default behavior for all phones.
Also, this isn't only about the US government and US police trying to unlock phones. This also protects US citizens against abuses by foreign governments -- i.e. the Chinese or Venezuelans confiscating someone's phone at an airport and "working on it."
Not to mention that not all US law enforcement are the good guys. Plenty of corrupt cops out there who want to snoop without a warrant.
controlling something remotely is different then accessing it once it is off the network and shut off.
Still, if you are going to do something illegal , it is best not to create a record of it. ( and probably better just not to do it).
If you are in a country where you feel the need to engage in acts of civil disobedience in the modern age. Good luck and God bless.
Also, find a way to get a some cheap disposable mobile phones and don't keep them long term.
âoeTolerance applies only to persons, but never to truth. Intolerance applies only to truth, but never to persons.
And what would the cops do if I just stopped USING my iPhone, didn't carry it, or... hell, didn't even HAVE one?
Oh they have a tool for that also, but I don't think you are going to enjoy it much...
It's called "GraySkull".
They have the power.
Because many people have auto-lock set to 1 minute - they'd lose the ability to download more than a fews pictures unattended and end up generating support calls. (Assuming people still do cloudfree picture downloads via USB.)
"Grayshift has gone to great lengths to future proof their technology and stated that they have already defeated this security feature in the beta build"
Umm, if true, how stupid of them to say it.
How many times do people charge their phone off a "public" USB charge port in an airport or on public transportation? Any one of those ports could be trying to slurp confidential data.
If you rely on either your phone's security, or trusting whatever 3rd party provides a charge port, you're doing it wrong.
Just use a charge-only cable that has only power wires, but no data lines in it. Or bring an AC -> DC adapter as well, and use an AC mains outlet. Or bring a powerbank. Or charge from your laptop.
Additionally, the GrayKey has built in future capabilities that will begin to be leveraged as time goes on
Holy Crap! Should invest in those guys because they are from the future, so much so they have built in capabilities for bugs and security features that don't exist yet! So sweet! (Other than that, sounds like marketing on GrayShift's part)
How is this not a violation of the DMCA? Couldn't Apple simply bury these companies under mountains of lawsuits to make them go away?
Do what thou wilt shall be the whole of the Law - Aleister Crowley
How about get a phone that supports wireless charging then physically destroy the usb port.
what about an very local tower with some kind of Emergency call mode that unlocks stuff?
law enforcement is dmca exempt!
Aren't the cops and their vendors violating the DMCA by hacking into Apple's phones?
Since hacking is illegal, why are cops buying from Grayshift instead of raiding their offices?
Because in practice it's only illegal to hack those whom the State favors. Hacking those who are not in the State's (and the corrupt individuals in power's) good graces for whatever reason is A-OK, especially if the State gets the benefit of obtaining the data in readable form. The only real exception to this is if the hacker(s) in question are also not seen favorably by those in power.
Strat
Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
Does the exemption extend to a non government software vendor?
Also, GreyShift is an Israeli company, and historically the US government kowtows to Israel like nobody's-fucking-business.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
They aren't a US company. True, by selling to US persons they are availing themselves of US law but I suspect that the law enforcement exemption covers the sales to law enforcement and the law doesn't reach their R&D activity in Israel.
Companies such as GreyKey should be sanctioned and their owners and developers brought up on hacking charges! They have no right to circumvent security technologies PERIOD! We as a society need to embrace security, even if that means that some bad guys will go free. We must not allow ourselves to fall prey to the machinations of those who would see an Orwellian world made manifest.
Support your local school shooter, give them your firearms.
I bet they are just giving out little USB dongle type devices that a cop would connect to the phone upon arrest. This would likely keep the USB port unlocked passed the timeout...
Re "Do you all actually believe this?" .
PRISM https://en.wikipedia.org/wiki/... showed the USA and UK had ways in. Direct and for years. That US brands made junk crypto code to help the NSA.
The software and device and brand, all 'approved' updates then becomes a part of a NSA collect it all network.
End-to-end encryption is offered to keep gov workers and police under internal affairs investigation trusting their new devices.
Without repeated and updated reassuring tech news that the brand is still safe digital collection globally stops for the NSA.
PRISM and BULLRUN https://en.wikipedia.org/wiki/... DROPOUTJEEP https://en.wikipedia.org/wiki/...
The device and the network, the brands and the telcos are all open to gov/mil experts.
The only trick is to keep most users thinking the next product line will be secure because?
Brand reputation? Politics? Stock market? Lawyers? Skill of staff?
PRISM showed who experts are happy to be working for and with. Big government.
Domestic spying is now "Benign Information Gathering"
is for the next person who gets arrested and has their phone subjected to such hacking measures is to simply challenge it in court and demand to see everything about the extraction / bypass process.
After all, since you ARE hacking into the phone, we need to verify it's doing nothing nefarious and / or corrupting the data contained within it.
Much like how the LE Community will drop charges without revealing how / when / where they are using Stingrays, they'll drop the charges before they're forced to show their hand here as well.
I wonder how long it will be until somebody figures out how to implement a "dead man's switch" requiring a code to be entered at user-determined intervals, or the device would use all its remaining battery power to commit suicide.
I have a feeling it wouldn't be easy to extract data from a phone that decided to do its very best impression of a Note 7.
Added bonus: potential havoc at the cop shop.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Immediate fail, tosser. (1) Apple decided privacy was important long, long before the Facebook hysteria. (2) Apple security is better than the opposition and always has been so they do not need to do work that has been done. Instead they improve.
You seem to have a five minute life. Anything that happened ten minutes ago is background blur to you.
Nah, lots of morons of any age do that. It is even semi legitimate as English has grammatical indication for a long 'o'.
This has always struck me as a dumb implementation. Why not simply require passcode to enable USB data mode with no timer? Plug in USB, get prompted for passcode. No passcode, no data.
"I like systems, their application excepted", George Sand (French)
That was a joke. The irony of acknowledging how serious what AHuxley has posted - which kind of makes it funnier considering who wants access to your phone. Tough crowd.
My ism, it's full of beliefs.
That is exactly what i do with my iPhone 6(hopefully it lasts a while, new models suck)