Apple Says Bug Exploited by $500 Passcode Guessing Box to Crack iPhone 7 is Patched in iOS 11

[Michael Scrip]

No. It's basically , if you change your password before you have upgraded to iOS 11, plan to not lose your phone in the first few minutes after you change it.

Yep... the best advice is to be more careful and not lose your phone in the first place.

We shouldn't be worried about the risks outlined in this article though.

The chances of someone finding my phone and having one of these $500 boxes is ridiculously low.

 

[gnasher729]

Yep... the best advice is to be more careful and not lose your phone in the first place.

We shouldn't be worried about the risks outlined in this article though.

The chances of someone finding my phone and having one of these $500 boxes is ridiculously low.

AND you losing the phone just after changing the passcode, and that person getting to that box within 10 minutes of you changing the passcode.

 

[Sbu]

I wonder if this was an intentional choice by the programming team? I could see someone arguing that "right after changing the passcode, people are going to be more prone to mistakes - so let's not penalize them for the first few minutes".

Good thinking , I also don't think this was a bug. They just didn't expect someone to exploit it.

 

[OldSchoolMacGuy]

And yet, we've been selling a device to government agencies which will retrieve the passcode, Keychain passwords, browser history, text messages, contacts, network connections, and much more since 2008 and it still won't be patched in iOS 11.

 

[Markoth]

AND you losing the phone just after changing the passcode, and that person getting to that box within 10 minutes of you changing the passcode.

I'm guessing that this was some sort of convenience backdoor left in by a dev, figuring that it wouldn't matter in the wild anyway. He was right. It doesn't.

 

[bizzaregood]

I'm guessing that this was some sort of convenience backdoor left in by a dev, figuring that it wouldn't matter in the wild anyway. He was right. It doesn't.

Right? How absolutely ridiculous is this... It’s more likely that someone sees me enter my passcode because Touch ID wasn’t working then successfully exploiting this cool down period. I agree this was probably put in place as a grace period for people who just changed their passcode, or a leftover from a development stage

 

[rctlr]

4 digit passcodes?

I updated to 6 digit alphanumeric 4 years ago.