Apple Refutes Hacker's Claim He Could Break iPhone Passcode Limit (cnet.com)

A security researcher claimed he had figured out a way to bypass the passcode lock limit on an iPhone or iPad, ZDNet reported. But it turned out the passcodes he tested weren't always counted. From a report: "The recent report about a passcode bypass on iPhone was in error, and a result of incorrect testing," Apple said Saturday in an emailed statement. Since the 2014 release of iOS 8, all iPhones and iPads have come with device encryption protected by a four- or six-digit passcode. If the wrong passcode is entered too many times, the device gets wiped, explained ZDNet's Zack Whittaker. But Hacker House co-founder Matthew Hickey figured out a way "to bypass the 10-time limit and enter as many codes as he wants -- even on iOS 11.3," Whittaker wrote.

Comments

He was holding it wrong

[volodymyrbiryuk]

The recent report about a passcode bypass on iPhone was in error, and a result of incorrect testing

He was using/holding it wrong.

Re:He was holding it wrong

[radarskiy]

So what you're saying is that Android has the same problem.

Re:He was holding it wrong

[BronsCon]

I mean, version 1.0 didn't;, then again neither did iOS. Both do now, though.

urgk

[cascadingstylesheet]

What an unclear story. At first read, it sounds like Apple is saying "well, it's just that some of them don't get counted, so neener neener", which is, er, exactly what the guy was alleging.

If I understand the clarifications, what Apple meant was that some of them don't get used at all (to try to unlock the device).

Re:urgk

[Anonymous Coward]

What an unclear story. At first read, it sounds like Apple is saying "well, it's just that some of them don't get counted, so neener neener", which is, er, exactly what the guy was alleging.

If I understand the clarifications, what Apple meant was that some of them don't get used at all (to try to unlock the device).

Well, It's actually that Apple said pretty much nothing but "nope" - that "don't get counted" comes from the retraction from the hacker.

Re:urgk

[Anonymous Coward]

They can claim that, but watch the video he tweeted

https://twitter.com/hackerfantastic/status/1010240042990596096

It looks pretty clearly to my like the iphone responded with 11 failed attempts. 11 times in a row, you can see the 6 dots (representing the digits) fill up and then the phone buzzed indicating a failed attempt and the dots all cleared. On the 12th time, it unlocked.

So are they claiming the phone just pretended to try some of them without actually trying them, thus the user could have actually entered the correct code but the phone would have "rejected" it (gave the user the visual/vibration feedback indicating that it didn't work) without even actually trying?

Re:urgk

[Junta]

Basically he was cramming in a lot of digits into a keyboard buffer, but the phone didn't even think about most of them. Meaning that even if he guessed the correct pin, it's most likely it wouldn't have worked because it would be discarded without checking.

Re:urgk

[cascadingstylesheet]

Basically he was cramming in a lot of digits into a keyboard buffer, but the phone didn't even think about most of them. Meaning that even if he guessed the correct pin, it's most likely it wouldn't have worked because it would be discarded without checking.

Yes. My point was, that wasn't super clear from how this was reported.

While I'm nitpicking ... Apple didn't "refute" this either ... they denied it. "Refuting" would involve presenting some sort of proof, not just saying "you're wrong; check your work".

(Though I notice that Google has now added a second meaning of simply "deny or contradict" ... lovely.)

Re:urgk

[NoNonAlphaCharsHere]

Fucking Apple can't even handle a simple buffer overrun properly. If it were a Microsoft product it would have allowed remote arbitrary code execution with administrator privilege.

Re: urgk

[UnknowingFool]

You mean it was an unclear summary. The story itself lays it out: the hacker said there is a way to send a stream of passcode attempts via cable to the iPhone which would override the 10 attempt limit. He later had to admit is that the method he used did not always send the attempt correctly to the phone and it was ignored thus not hitting the limit. He thought he sent 20 attempts when reality it was 5 or 6.

Re:urgk

[Khyber]

"Though I notice that Google has now added [google.com] a second meaning of simply "deny or contradict" ... lovely."

Looking at a copy of my 1980s Random House dictionary from my old elementary school, the second definition of "refute" includes "To deny or contradict a statement or suggestion."

Looks like both you and Google are well behind the times.

Re:urgk

[cascadingstylesheet]

Looks like both you and Google are well behind the times.

I sincerely hope so. Following the times on every stupid change is kind of ... stupid.

"Refute" in its most common usage was very useful; it meant essentially "to publicly dispute something conclusively, with convincing evidence".

Now people use it to mean simply "dispute", which is not nearly as useful.

Re: urgk

[UnknowingFool]

In the article the hacker admits that in reviewing his hack it appears that not all the attempts were received and processed by the phone. He says out of the 20 attempts, the phone may have actually got 5 or 6. This is not Apple saying it. This is the hacker.

Re:urgk

[Junta]

I think it's not that it's "supposed" drop anything, it's just that he was injecting the data faster than any human could, and it *looking* like it was being accepted, but in reality it just fell on the floor.

There may be some incorrect technical behavior or just an expected limitation of the input, but either way it doesn't matter for normal use because it's way faster than a human would ever input data.

Re:Wipe phone??

[Anonymous Coward]

So I can wipe someone's phone without their consent? Is this a feature or a bug?

Well, yes. Of course after 5 attempts you have to wait an increasing time before another attempt - so all you have to do is type in 10 wrong passcodes spread unevenly over 3 hours.

Re:I had a similar problem

[Anonymous Coward]

This cannot have anything to do with the phone. The PIN is verified and eventually blocked by the SIM card itself, the phone only submits the PIN to the card as provided and has no way to know if it is correct or not until the card responds. That is unless it caches a succesful PIN entry and then verifies subsequent PIN entries autonomously without submitting them to the card. That would be a crazy thing to do and certainly not a bug but a deliberate backdoor (not to mention that you could have changed the PIN in the meantime using another phone) .

Re:I had a similar problem

[SharpFang]

Did entering the correct PIN unlock the phone?

'cause I'd be unsurprised if upon entering the correct PIN you got the same 'wrong PIN', authors of the phone just being lazy and implementing 'SIM doesn't work without PIN, ask for PIN regardless of lockout status'.

but they don't count, so no unlock

[Anonymous Coward]

This is like saying I can pull the trigger on a gun and never run out of bullets because the doing in the magazine isn't there...so while both are true the intended outcome isn't possible...a bullet leaving through the barrel. Here, the phone will never unlock since the unlocking mechanism is disabled.

yes it did

[aepervius]

I had changed the pin and could not remember the order of the digits but could remember the digits, so I tried permutation of the numbers until it unlocked. I got it after 10 or so tried.

Re:6 months - 2 years..

[jon3k]

It's fascinating to see how Slashdot has changed. Not that I agree with parents post (I don't) but a low 6 digit UID slamming Apple used to get a +5 Insightful or at least a +5 Funny.

Re:6 months - 2 years..

[Daemonik]

RIght? It's not even like Apple hasn't demonstrated exactly the behavior I pointed out before either. BendGate, KeyboardGate, AntennaeGate, BatteryGate. All instances where Apple shouted to high heaven the perfection of their devices then slowly had to walk it back after mass customer disillusionment and evidence they couldn't avoid.

Re:6 months - 2 years..

[Daemonik]

Oh, and when they do come up with a fix, it will require an Apple Certified PIN Repair Pro certificate that doesn't exist, and parts they haven't ordered into their supply chain.

Option in settings...

[The New Guy 2.0]

I can type ten bad passwords into my iPhone and not have it wiped. It's an option in settings that when turned off causes the phone to freeze and not accept a new attempt for a progressively longer time.

So there you have it, not all iPhones wipe after ten bad attempts.

Re:Option in settings...

[thegarbz]

Cool story. Not even remotely related to what is being done here, but cool none the less.

Not just 4-6 digits; Passphrase if you want

[Anonymous Coward]

This is a badly written article. Users don't just have a 4 or 6 digit pin as an option; I use a whole passphrase to unlock my iPhone (in the situation where touch ID isn't allowed - when touch-id failed too many times, it's been too long since it was unlocked, the device was powered off, or I did the five button press to disable it)

Can someone wipe my phone?

[Filter]

Does this mean that some jackass can wipe my phone by grabbing it and entering the wrong password 10 times? That would be a nasty prank.

Re:Can someone wipe my phone?

[PPH]

It is assumed that people who care enough about the data

... probably back it up someplace. And that backup should be accessible without the phone being connected (think broken phone, etc.) So you recover your phone, smack your jackass friend a couple of times, connect to the backup and pull your data back.

Re:Can someone wipe my phone?

[apoc.famine]

Some jackass can also grab your phone and toss it in the toilet, or smash it. How is this different?

If someone has physical access to your device, yes, they can destroy the data on it. In many different and exciting ways.

Re:Wipe phone??

[jellomizer]

Hey, no trying to use reasonable facts to get us off our irrational hate Apple Rant. We need to feel good about our Android Phones, sure Android has its own problems, but gosh darn it! Apple is evil ... EVIL!

Re: pocket/butt erasing

[Anonymous Coward]

It isnâ(TM)t enabled by default. So apparently you didnâ(TM)t.

Apple better fix it

[omfglearntoplay]

From the comments and stuff I'm reading, Apple needs to step up and fix their junk.

Re:Wipe phone??

[Immerman]

>So I can wipe someone's phone without their consent? Is this a feature or a bug?
A feature, obviously. That's what lets you repair a hopelessly borked device.

Physical access to the device voids virtually all security on any electronic device - the best you can hope for is to keep the new owner from accessing existing data on the device (which Apple does fairly well). Guess what - anyone with physical access to your laptop, desktop, flash drive, phone, tablet, etc. can do the exact same thing, and do so far more quickly and easily than by attempting to log in with an invalid password several times over the course of a few hours.

Re:I had a similar problem

[mysidia]

caches a succesful PIN entry and then verifies subsequent PIN entries autonomously without submitting them to the card

They might do this to improve login performance due to the SIM card having a slow response time ---
cache the user's correct PIN and verify it locally before submitting to the card, but if a SIM card change is
detected then expunge the cache.

Re:6 months - 2 years..

[shaitand]

Yup. Slashdot has obviously been taken over and since people who actually understand technology don't use Apple solutions... lets just say it may be time to move on.

Re:6 months - 2 years..

[jon3k]

Didn't we already put "BendGate" to bed? The iPhone 6 Plus wasn't even the least likely to bend of the tested phones.

I don't remmeber Apple "shouting to the high heavens" about "KeyboardGate" (I assume the current keyboard problem?) or "BatteryGate" (not sure what this is? The performance throttling to stop the phone from shutting off?). AntennaGate I'm assuming is the "you're holding it wrong" and I'm with you on that one, my recollection of that was a huge PR mess for Apple with lots of blaming the user.

Re:Wipe phone??

[BronsCon]

So you've never taken your eyes off your phone for more than 3 hours at a time? Say, while sleeping?

Re:I had a similar problem

[BronsCon]

And if the sim card is removed, PIN changed on another phone, and SIM card is reinserted, all while the phone is off? SIM change not detected.

Re:6 months - 2 years..

[BronsCon]

Having been hit by KeyboardGate, I implore you to apply that theory to me. Even if we say I'm 29, the upper end of your assertion for that to be true I would have to have been 12 when I joined Slashdot after lurking for 4 years, starting at age 8. If you go back to my early posts (I'm not sure it's even possible to go back that far, I can only seem to go as far back as the end of 2008 for post history; my UID dates my account, though), you'll note that they were likely not written by a 12 year old.

Since one of your baseless assertions is clearly incorrect, it would be reasonable to assume that the other two are equally incorrect, as they are equally baseless.

One might also infer projection.

Re:6 months - 2 years..

[BronsCon]

We did, until Apple documents came to light showing that they knew the phones bent too easily.

Re:Wipe phone??

[F.Ultra]

I would assume that the people who enable it (yes you have to enable it) have made a decision that the risk of having the phone accidentally wiped is less than the risk of the information on it getting leaked. There is also this odd thing called backups that you can do which will severely lessen the problem of a deliberate wipe.

Re:Wipe phone??

[BronsCon]

Now there's a reasonable argument. You see, the one I replied to was not.

Re:Wipe phone??

[BronsCon]

I did? Where?

Re:I had a similar problem

[BronsCon]

Phone requires a reboot if the SIM is removed and reinserted, before it will read the SIM; if we were talking about cache in RAM, this conversation wouldn't be happening.

Re:Wipe phone??

[porlryan]

Rotten to the core you might say.

A non-story

[Provocateur]

Maybe it is a non-story, then; the voice of a man crying out in the wilderne--wait, he's got cable.

Re:6 months - 2 years..

[jon3k]

The company found that the iPhone 6 is 3.3 times more likely to bend than the iPhone 5s, and the iPhone 6 Plus is 7.2 times more likely to bend than the iPhone 5s, according to the documents.

But being more likely to bend isn't necessarily a problem. The Macbook Air is more likely to bend than a Macbook Pro, but that doesn't make it a failure or poor engineering. Materials and engineering choices are made all the time. Every company chooses a particular level their device will bend or break at. In the iPhone 6 they choose to make a larger device, thinner, and were wlling to accept that it was more likely to break, assuming it is still within reasonable tolerances. Which is what Consumer Reports found, that it wasn't more likely to bend than other premium phones from other manufacturers. Just because it now wasn't 5x or 7x better than the competition doesn't make it a poor product.

But for some reason people seem to hold Apple to some higher standard of quality, usually while simultaneously complaining about how poor quality their products are.

Re:I had a similar problem

[mysidia]

If the SIM was plugged into another phone and then modified and saved with a new PIN, then the result of the
SIM Status and READ commands which the phone can check prior to PIN authentication to retrieve the base files
on the SIM filesystem will no longer be matching files, if the cached data includes their checksum and/or
SIM status information, and the CCID and Update timestamps; they will reflect that some update has
been written to the card, and the phone could be designed to expunge the cache in this case.

Re:I had a similar problem

[BronsCon]

Somehow, it just doesn't seem that secure to hint at your contents prior to authentications. You sure that's how it works?

Re:6 months - 2 years..

[BronsCon]

What Consumer Reports found is that it wasn't more likely to bend than other premium phones when pressure was applied in the specific way Consumer Reports tested the device. Where the two disagree (and they do), you can be fairly certain that Apple's testing was more thorough and correct than CR's, and should tend to favor that. I can pick out flaws in CR's testing, but I'll give you a big one right out of the gate: their results are the opposite of Apple's, with the 6 being more likely to bend than the 6 Plus.

Somebody got it wrong, and my money is on the company with a decades-long history of flubbing these sorts of tests.

But for some reason people seem to hold Apple to some higher standard of quality,

Probably because the company itself, along with its group of obnoxious fanbois, insist that they have always met that standard, and that they still do today.

usually while simultaneously complaining about how poor quality their products are.

Probably because quality is relative and a lower-middle-tier product that would be perfectly acceptable if that's what you had paid fo and expected to get becomes complete crap when it's advertised and priced as high-end. Think about it: nobody complains when their $20 pair of Wal Mart shoes only lasts a year; everybody would be bitching if that were true of a $200 pair, though.

Go look at some objective side-by-side comparisons of Apple and non-Apple laptops sometime. Look at the best Apple has to offer vs the best LeNovo or Dell has to offer, and tell me you still think Apple isn't junk for the price. Do they compare to the lower-middle-end of the typical PC manufacturer's range? Sure; but they're not sold as that and they cost considerably more than that. That's why it's a problem.

Sent from my 2016 MacBook Pro which, thankfully, isn't having keyboard issues this week.

Re:I had a similar problem

[mysidia]

Somehow, it just doesn't seem that secure to hint at your contents prior to authentications. You sure that's how it works?

The PIN is used only to gain authorization required to perform management operations on the card's secure applications or to perform cryptographic operations using the secure keypair from write-only key storage in order to prove the user's identity to the network.

The SIM card's Status can be queried and the files and contents of the SIM filesystem, The names and Phone numbers of any contacts stored on the card, etc. Are not encrypted or locked by the PIN and could technically be read in without even authenticating ---- that's just ancillary information available on the card which is separate from the Network Identity and cryptographic material that the SIM card is designed to secure.

Re:I had a similar problem

[BronsCon]

good information; so updating only the PIN leaves visible traces elsewhere on the card? still seems like bad design.