Slashdot Mirror
Apple Just Killed The 'GrayKey' iPhone Passcode Hack (forbes.com)
Apple's newest version of iOS has rendered the GrayKey hacking tech useless, a report said Wednesday. How Apple pulled it off wasn't immediately clear, but it would have a huge implication for the law enforcement agencies around the world that have relied on GrayKey to break into locked iPhones. Forbes reports: Apple has put up what may be an insurmountable wall. Multiple sources familiar with the GrayKey tech tell Forbes the device can no longer break the passcodes of any iPhone running iOS 12 or above. On those devices, GrayKey can only do what's called a "partial extraction," sources from the forensic community said. That means police using the tool can only draw out unencrypted files and some metadata, such as file sizes and folder structures.
Previously, GrayKey used "brute forcing" techniques to guess passcodes and had found a way to get around Apple's protections preventing such repeat guesses. But no more. And if it's impossible for GrayKey, which counts an ex-Apple security engineer among its founders, it's a safe assumption few can break iPhone passcodes. Police officer Captain John Sherwin of the Rochester Police Department in Minnesota said of the claim iOS 12 was preventing GrayKey from unlocking iPhones: "That's a fairly accurate assessment as to what we have experienced."
Previously, GrayKey used "brute forcing" techniques to guess passcodes and had found a way to get around Apple's protections preventing such repeat guesses. But no more. And if it's impossible for GrayKey, which counts an ex-Apple security engineer among its founders, it's a safe assumption few can break iPhone passcodes. Police officer Captain John Sherwin of the Rochester Police Department in Minnesota said of the claim iOS 12 was preventing GrayKey from unlocking iPhones: "That's a fairly accurate assessment as to what we have experienced."
Apparently STILL the only phone OEM STILL looking out for the USER'S Privacy...
Exactly. You want a secure phone that nobody can hack, they don't exist!
Whenever you save or do something on your phone, take a moment to think: can this be used against me? If it can, don't save or do it!
And just to throw the police off create a bunch of files like "masterUSPlan.doc" with nothing but wombat images. Then when asked about the "wombats" you know they have dug into your phone and you can tell them all about how wombats have ruined your life.
No, all "content" is encrypted. It's the meta data (file sizes, folder structure) that is unencrypted.
No photos, videos, etc, are left unencrypted.
When you activate a PIN / Touch ID / FaceID it uses the computed has as an encryption key for the entire user filesystem. Everything gets encrypted, and has for years.
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
No, not exactly. But close.
Those hashes are used to reverse a hash of a master key for your system which unlocks the file system. That way, both that hash and your pin code work. You need a master key, and then your authentication vectors re-encrypt the master key. You therefore have multiple avenues of logging in and authenticating, because each way provides you with a key you can unlock
Actually, the article is likely a bit off about that. The iPhone uses encrypted APFS, you shouldn't be able to get much other than "yep, there's a file system there".
What I was getting at is that I thought GreyKey was still getting past the basic whole file system encryption, but that it was stymied getting to individual app files that had been encrypted until the app opened...
That's how I read it anyway, otherwise why even bother to mention GreyKey could "still access unencrypted files" if it couldn't even get to the filesystem? It implies it can see some files at all.
Could just be bad wording on the part of the summary or article but the fact it mentions files makes me suspect it can still get into the filesystem.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I'd be wondering right now whether they actually can't crack my iPhone, or if they're just saying that so that I will keep using it, thinking it's "safe."
For 6+ year, everything on iOS is encrypted all the time and you can't turn it off.
All that changes is policy around how the key material is managed - some of that policy is mandatory access controls and some of it is discretionary.
LOL
I thought they already addressed Graykey in iOS 11.4.1
Only the people in charge use desktop computers, junior.
Including the people who write the 'apps' they allow you to run on your little gadgets.
That's because people assume GrayKey is a magical box that you plug in and have full access to the device. It's not even close to how it works.
First, it basically does a tethered jailbreak - and injects a special app because of it. (Jailbroken apps have full access to the system - that's the original meaning of the "jailbreak" - the app could break out of the OS jail it was put in to run). This app uses those abilities to crack the device PIN. Once the PIN is broken you take the phone and connect it to a PC and use it download all the data.
What happened now is Apple changed things around that it can no longer crack the PIN - so either Apple patched the flaw that lead to the jailbreak, or fixed things that the injected app can't do the PIN search anymore. Thus the injected app only has the permissions a regular app has and access to whatever the OS allows it. Those are the limited "unencrypted" files. Likely it also cannot access the screen and thus you cannot answer the "App wants permission to access photos" dialogs as well to access photos.
No, all "content" is encrypted. It's the meta data (file sizes, folder structure) that is unencrypted.
Everything is encrypted at least with a key built into the CPU, and a key stored on the flash drive. The key on the flash drive means that the whole iPhone can be erased in a millisecond by erasing that key. _Most_ things use the passcode as an additional key.
Things that don't use the passcode are those that Apple wants to be available even if you don't unlock your phone. For example, you can _take_ photos without unlocking the phone, and those photos could be extracted until you unlock your phone and then they get encrypted. Photos taken while the phone is unlocked are encrypted immediately.
What I was getting at is that I thought GreyKey was still getting past the basic whole file system encryption, but that it was stymied getting to individual app files that had been encrypted until the app opened...
Nobody ever got past the encryption. People managed to find the passcode - and if you have the passcode then you can unlock the phone and access all the files on it.
Finding the passcode could be done in theory by trying out all passcodes. Apple prevents this or tries to prevent this by making you wait longer until you can try another passcode; more than an hour after ten attempts. Or you can set up your phone to erase everything after ten wrong attempts. _That_ protection is what they got around.
But you can protect your phone: Trying a passcode takes 80 milliseconds _even if you got around any protection that Apple puts into place_. With a 6 digit passcode, that's a million combinations, it takes 80ms times a million to try all combinations, that's a bit less than a day. So you take ten digits, or eight letters and digits, and nobody can get in in your life time, independent of what Apple is doing.
Of course what they are doing now makes sure that you cannot even crack a phone with a 4 digit code.
Fuck, man, how did you know about the wombats??? Are you working for them? They're INSIDE THE HOUSE now. I can hear them in the walls. Nobody believes me!!
https://www.eff.org/https-everywhere
Thanks, I wasn't sure just what GreyKey was doing. Then I guess the idea they could "access unencrypted files" is just totally wrong, as there are none without a filesystem...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I think the PIN/password is used to access the master key, which is kept in the Secure Element in the CPU silicon. The master key has far more possible values than the PIN - probably 256-bit. The Secure Element is presumably designed to make it impossible to directly extract the master key.
So, when iOS wants to decrypt the hard drive it first has to retrieve the master key using the PIN.
The right to protest the State is more sacred than the State.