Slashdot Mirror
Apple Releases iOS 11.4.1, Blocks Passcode Cracking Tools Used By Police (theverge.com)
An anonymous reader quotes a report from The Verge: Apple today released iOS 11.4.1, and while most of us are already looking ahead to all the new stuff coming in iOS 12, this small update contains an important new security feature: USB Restricted Mode. Apple has added protections against the USB devices being used by law enforcement and private companies that connect over Lightning to crack an iPhone's passcode and evade Apple's usual encryption safeguards.
If you go to Settings and check under Face ID (or Touch ID) & Passcode, you'll see a new toggle for USB Accessories. By default, the switch is off. This means that once your iPhone or iPad has been locked for over an hour straight, iOS will no longer allow USB accessories to connect to the device -- shutting out cracking tools like GrayKey as a result. If you've got accessories that you want to continue working after your iPhone has been sitting locked for awhile, you can toggle the option on to remove the hour limit. Apple's wording is a bit confusing. You should leave the toggle disabled if you want your iPhone to be most secure.
If you go to Settings and check under Face ID (or Touch ID) & Passcode, you'll see a new toggle for USB Accessories. By default, the switch is off. This means that once your iPhone or iPad has been locked for over an hour straight, iOS will no longer allow USB accessories to connect to the device -- shutting out cracking tools like GrayKey as a result. If you've got accessories that you want to continue working after your iPhone has been sitting locked for awhile, you can toggle the option on to remove the hour limit. Apple's wording is a bit confusing. You should leave the toggle disabled if you want your iPhone to be most secure.
I feel better now that if anyone wants to access my phone, they need to ask me first. If only the carriers would stand up for us the same way.
Except, Apple has done enough of some sort of *mumble*mumble* that China lets them sell their gadgets in China.
Do you really think if it's important, US agents don't bring it back with them from China to use here?
just stop the false advertising as if iPhones are some security behemoth.
choke holds crack all sorts of passwords and fingerprints and facial recognition software. usb is for on the sly. LE doesn't have to do that shit.
stop pumping lies.
Why is this story always about iPhone?
Are Android and other mobile OS not an encryption concern for LEO?
Thanks.
It little behooves the best of us to comment on the rest of us.
An hour is a really long time. Feels like a PR move to still make it possible for cops to crack the phone and simultaneously sell this as a feature to idiot criminals.
Do remember to turn it on, then, because it's off by default:
If you go to Settings and check under Face ID (or Touch ID) & Passcode, you’ll see a new toggle for USB Accessories. By default, the switch is off.
Which is pretty standard with Apple. Can't break "it just works" for minor concerns like security.
What if you will be out driving and don't want the police to have access to your phone, but don't want to wait one hour after using it before leaving the house? Is there a way to bypass the one-hour wait feature and tell the phone to immediately disable the USB when you next lock the phone? People should be able to activate maximum device security whenever they please.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
Apple's trying to keep your phone safe. Not from law enforcement, but from random black hats. Whatever OS you use, if it is allowed for sale in the U.S., law enforcement has their backdoors.
So you have an hour to get the phone to the lab and have the warrant in hand before cracking it. That means taking a cop away from a crime scene to transport a single phone, get a warrant and have the tech standing by the moment the phone gets to the tech. All while maintaining chain of evidence and custody. That is assuming that the cops find the phone at minute zero. The cops don't know how much time is left on the count down when they find the phone. The police are going to get into Keystone cops/Benny Hill adventures where every time they find a phone someone has to go tearing off to get a warrant and rush the phone to the technician. And if another phone is found five minutes after the cop leaves another warrant request and cop will be needed to transport the new phone to the technician. You are going to end up with angry judges and technicians answering "Really, I just signed a warrant to search the previous phone, stop bothering me until you can itemize all the phones you want to search" and technicians complaining all the other work they have to get done is being punted by people running in "You have to unlock this phone before the time limit"
Architectural plans are like computer source code with a couple of differences: You only compile once.
Law enforcement of all colors has amply demonstrated that they do not understand device security and why it is important. Hence this is good news.
Incidentally, if you let the police decide what freedoms and protection against the state people have, you end up with a police-state. These people have entirely the wrong mindset. When you remember that the primary purpose of the police is protecting the rich and powerful and fighting (slave) upraisings, this becomes much more obvious. All that "to serve and protect" crap is basically propaganda.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Apple iPhones already upload all your personal information to iCloud,
This is utterly false. Uploads to iCloud are completely optional.
The NSA has no interest in criminals...
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
And not just dead like normal dead, dead as in shot dead by LE, for you know... shooting up the town basically.
Or shot himself, itself, herself... I can't keep all the mass shootings that have been happening in recent times all straight in my head anymore.
I work at a school with many ipads where the students sometimes initiate an update and then set a passcode that I don't know and they don't remember. I have to then connect via USB to factory reset the ipad. Will the new "restricted mode" still allow me to factory reset via USB after an hour without knowing the passcode as I could in the past or will I essentially have bricked device that can't connect via USB without the passcode?
My concern about 11.4.1 is does it fix the horrible battery drain of 11.4? I'll update tonight, because i have nothing to lose.
Some mornings it's hardly worth chewing through the restraints to get out of bed.
Nope. You have an hour for the cop to take the logger device out of his or her pocket
I assure you there is NO WAY some magic iPhone cracker device (which remember still has to break through passcode security) is inexpensive enough there is going to be more than one per city, and probably only major cities at that. If there is a cop close at hand with one it would probably mean they had spent months gathering evidence on an extremely guilty person.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Is there a way to bypass the one-hour wait feature and tell the phone to immediately disable the USB
There is already the button press combo to force a passcode be required to unlock vs. a fingerprint or FaceID, I imagine that would also trigger the USB lock.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
When law enforcement is presented with the challenge of obtaining a search warrant within 1 hour, rest assured that abuse won't stop with merely abusing the shit out of warrant request/approval powers. No, they'll instead find some way yet again to label damn near any crime involving an iPhone as a terrorist plot and a threat to national security, and will request a waiver from respecting due process.
Nobody EVER backs up their phone to the cloud.
LE LE LE LE LE LE. Now that you got that LEO worship out of your system, let me tell you why you speak like a true slave. I don't care that the cops can't hack my phone. The 5th should extend to devices we carry our life in.
If the phone is hackable, it is hackable by anyone with the technology. Cops aren't the only ones who can do it, in fact they weren't the ones who figured it out, an Israeli company did who is now selling the device. So the cops are probably not the target for the fix either. The hack is available to anyone with the money to buy the hacking device, which could mean any border patrol agent who temporarily takes your devices out of sight, any spy agency, anyone curious enough to go through your lost phone couple years from now (tech gets simpler and cracking a 4S is now child's play).
Let's see them try to break into my voice/SMS-only 2G bar-phone with their fancy gear! Bahahah!
But seriously, this might mean that lawmakers will be more predisposed to drop the need for a search warrant in respect to searching someone's phone. It would be much easier to lobby that the need for a warrant could now significantly hamper investigations because of the short window of opportunity.
So don't look too smug, Apple may have shot you all in the foot.
Do you have any evidence of that? Not trolling, I really want to look into it.
Now. I really gotta wonder about this one though. They are actively trying to put a stop to law enforcement gaining access to devices they have confiscated? Who does this? Why would someone do this? It's one thing to make a product very secure and shrug when LE finds a way around it to get evidence, but it's an entirely another thing when one sees what LEO is doing to break into devices and FIXING IT!
The problem with this logic is assuming that US law enforcement are the only ones trying to break into locked phones. Apple sells more phones around the world than they do in the US. It could be oppressive nation-states looking to punish citizens who oppose them, or criminals looking to steal peoples' identity, money, etc.
- Vincit qui patitur.
Apple does not allow users to reduce the security level. If kids type your passcode many times, it locks / erases the phone. There is really no option to disable it.
Then what do you have to do? Buy apple paid backup service to avoid loosing data.
I typically plug the charger into my iPhone at night for use the next day. This new feature would seem to indicate that the port will be disconnected after one hour. The question that comes to mind is how does one get a full charged iPhone. One would hope that the software is able to determine if an "external device" is plugged in or a charger.
It's not just 1 hour... if they see you coming and trigger the SOS mode, you're screwed. So now you have to make sure you grab them when they are separated from their phone... so when the owner is asleep and the phone is charging, or shoot the owner I guess and grab the phone quickly, or hope to get them with their hands away from their phone and say hands-up/don't move.
So will this cause the lightning-to-3.5mm adapter to stop working after an hour?
Also drug lords and other assorted criminals.
No he doesn't.