'GrayKey' iPhone Unlocking Box Used by Law Enforcement Shown Off in Photos

[Marconelly]

I have to say that the worst thing about FaceId is that it actively discourages the use of 6+ digit passwords, or of course the alphanumeric ones. There are several everyday cases where you just have to enter the passcode on the iphone X (phone lying on the desk, holding it landscape, lying down while using the phone). I just can't even imagine using the alphanumeric password on my iphone X with how many times I type in the passcode in it.

 

[cult hero]

For some people, everything is binary. Either only good governments have access to the box or everybody with enough money has access to it. Reality is not quite like that.

Indeed. In reality there are exactly zero "good" governments. It's not even binary. The United States, in particular, was at least founded on the idea the governments are inherently corrupt and—at best—are a necessary evil. The trick is getting people to believe there is such a thing as a "good" government and "good guys" on a nationalist level so that they'll sell their privacy, liberty, and sovereignty for the falsehood that the wolf is going to offer them protection.

Ask villagers in Yemen what they think about the "good" government of the United States.

 

[santaliqueur]

Nope. Just a rectangular box. Dots only appear as you type the code.

Would be nice to have that option on any length passcode.

 

[ignatius345]

I’m more concerned that the box is nothing more than a pc. If that is the case then the software getting out could be a thing. I love that people don’t bother to steal iPhones anymore and would hate to return to the old days. I personally not concerned about it’s use but more by the implications of what this box opens up. I was under the impression Apple had blocked multiple attempts at guessing passwords for good but here we go again.

You do have to admit, it would be a little satisfying if the code inside this company's proprietary box got hacked and sold.

 

[mytdave]

"...it is troublesome knowing such a device could fall into the hands of malicious entities." News flash, some law enforcement agencies are malicious entities - haven't you ever heard of Lois Lerner or Eric Holder?

My question is, how is it even possible to install software onto the phone without already having access to it? Did Apple arrogantly think that the App Store would be the only avenue to add software and completely forget to protect USB connectivity thinking it would only be used for "authorized accessories?"

 

[idunn]

MalwareBytes worries that the portable version of the GrayKey could easily fall into the wrong hands.

As far as I'm concerned this thing has already fallen into the wrong hands: those that created it and their customers. Meaning the NSA, for one, if they do not already have their own devices.

You'll likely remember the recent news of the TSA abducting passenger's phones at the airport, then taking them out of sight for about 10 minutes. Do the math on that in light of this revelation.

Tim Cook can stop talking about his concern for customer's privacy unless quite publicly addressing this issue and being transparent in solutions found to make iPhones and all Apple devices invulnerable to spying.

There is a price for liberty, or as in this instance privacy. That the misdeeds of some will remain private and unknown versus everyone vulnerable to the whims and caprices of every government and associated criminal on this planet.

Per the quote often attributed to Benjamin Franklin: "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."

 

[mguzzi]

A former Apple engineer released GreyKey, a software that breaks the security system on the iPhone.

 

[idunn]

This is why you don't use 6-digit passcodes but instead a complex alphanumeric one.

Yes, but every time one is bothering to remember what to enter time to reflect that the end result will be the same. Only difference being possibly weeks, months or even a few years versus minutes or hours or days until opened.

 

[cmwade77]

Yes, but every time one is bothering to remember what to enter time to reflect that the end result will be the same. Only difference being possibly weeks, months or even a few years versus minutes or hours or days until opened.

And this is exactly why they now say pass phrases are a better choice, the more characters you have the harder a password becomes to guess and if you can easily remember it, then you are less likely to write it down.

So something along the lines of:
This is my password, I am sick of remembering over 100 passwords every 10 days!

Obviously this particular phrase would not be the most secure, but I use it as an example of what I mean when I say passphrases should be used instead of simple passwords. It would take a very powerful computer hundreds of years to decode something along these lines. Now, the reality is a human could probably decode it faster by applying psychology to figuring out someone's password. The other trick is if it is longer like this, then you need to ask for it less, something Face ID doesn't allow for. This makes fingerprint sensors more secure than Face ID.

 

[mariusignorello]

Where did you change the number from 10 failures to five?

Via a configuration profile. It cannot be done on-device. You can use Apple Configurator.
[doublepost=1521228530][/doublepost]

They did not store it on stuff that was network-accessible and they did not store it on stuff that they carried around with them all the time. And they did not store it all in one single physical place/object. Sure, some of it they carried around (like the credit card, but then not necessarily all their credit cards). But a lot of other things they didn't carry around with them.
[doublepost=1521203501][/doublepost]
Though anybody writing the software to crack the passcode would likely try 7-digit codes next after having tried all 6-digit codes.

It will slow them down significantly.
[doublepost=1521228597][/doublepost]

But you just wrote it on the internet.

Genius.

I can always make it shorter or longer too. The length will always remain a secret.

 

[justperry]

I just read the forbes article linked somewhere else, seems like it is $30.000 offline for 1 year instead of lifetime.

 

[Morgenland]

I read a little in the european press this morning. Newspapers and gazettes without technical expertise say something like "Apple's iPhone can be cracked". Such inevitably simplistic representations of the press are extremely dangerous for Apple's future plans (e.g. health sector). Apple should in its own interest fight all these windy companies (Cellebrite, GreyKey and other henchmen) as opponents and immediately block access to the iPhone and thus go to the press as quickly as possible.

 

[Ploki]

That tradition worked well in Chinese dynasties. All "high-tech" was created at the pleasure of the emperor, and the creator of such could not share it. Modern NDAs and employment contracts attempt to limit disclosure but they don't work nearly as well as the tried and true inventor+bag+rocks+lake method.

so only a matter of time then.

 

[Tech198]

I have to say that the worst thing about FaceId is that it actively discourages the use of 6+ digit passwords, or of course the alphanumeric ones. There are several everyday cases where you just have to enter the passcode on the iphone X (phone lying on the desk, holding it landscape, lying down while using the phone). I just can't even imagine using the alphanumeric password on my iphone X with how many times I type in the passcode in it.

I've had to enter my Passcode regularly because for whatever reason (probably hands were dry), Touch ID failed a few times, and fell back to passcode entry...

Didn't mind that on iPhone 6s, but i always have to grin every-time it happens.

 

[shplock]

So, when you have wet hands or dry cracked fingertips (TouchId) or FaceID refuses to open your iPhone you have input that difficult password each and every time, 6 digit should be good to go.

With respect you obviously know nothing about cyber security. Using your logic then you should not even have a passcode at all because it would be too bothersome to even input 6 digits and while we are at it why not disable Touch id or face id because sometimes you know they won't work. If it is a pain the **** for you then it will be a HEADACHE for the hackers/thieves.

 

[dewski]

So you are ok with the criminals getting into your phone? As soon as you create/discover some kind of back door/'break glass' option to get into a locked phone it is there for anyone to use/exploit.

Well they wouldn't need it for mine as I dont even used a passcode, but yeah I don't care. Its my property and if I lose it, then oh well, I should have kept up with it better.

 

[chucker23n1]

No it doesn't. Storing sensitive information is just one, arguably smallish feature of smart phones.

Let's see.

THE TOP 10 DAILY USES OF OUR SMARTPHONES:

1. Text - 88 per cent

2. Email - 70 per cent

3. Facebook - 62 per cent

4. Camera - 61 per cent

5. Reading news - 58 per cent

6. Online shopping - 56 per cent

7. Checking the weather - 54 per cent

8. WhatsApp - 51 per cent

9. Banking - 45 per cent

10. Watching videos on YouTube - 42 per cent

How many of those can you say bye-bye to without privacy?

I suppose checking the weather applies.

 

[shplock]

Simplest solution: don't store anything you would not want to fall into anyone else's hands on a tiny mobile device.

Whether this thing is legal or not, whether it's ethical or not, whether we hate it because Apple probably will or we love it because it's able to beat Apple's encryption system... etc, we can't stop it by whining about it in a thread. Easiest defeat of anything like this is to NOT have anything on your phone that you don't want to get out if the wrong people got your phone.

Apple buying one of these and finding a way to defeat it doesn't automatically stop the next one... and there's always a next one. In fact, there's probably multiple versions of THIS one and we're just hearing about this one because it's probably the oldest one.

Earlier today, there was a thread about new Intel chips defeating variants of chip-level exploits. Great right? Until new variants come out that sufficiently differ from those variants to no longer be protected by whatever Intel did. That's the game there: secured:unsecured, secured:unsecured.

Same here. Apple can buy one and adjust the code to beat it... but then the next one rolls out to beat Apple's code. However, if we don't store anything on a mobile device that we would not want the bad guys to be able to see, no exploit would matter anymore.

Boy are you so wrong! You don't seem to know anything about what you talk about!!!!!!!1

It is not a case of not storing anything on our phones we don't want getting into the wrong hands It is a case of protecting our very lives. I mean think for a second, (hard I know)we all have so much on our phones these days. From banking to sensitive emails, from health info to more. so we have to protect that info. Now i know that you will still claim that we could all just only use our phones for texting and calling. But then firstly, why have such powerful phones hat are only used for calling/texting ? I bet if all the world's phone companies suddenly stopped making smart phones and made dumb phones instead you would be first to moan. Now I bet you will say "Oh yes but what about games/apps?" well those apps could not do anything other than be games because remember we have to get rid of anything that could be of benefit to hackers(which is just about everything). So we are only really left with games and most of those all let you buy in game currency. So you therefore can not buy any because that requires storing a credit card on file and that could then be used by the hacker to gain financially.
PLus I and others should not have to radically change our lives just to please either you or to stop the hackers. There are other ays you know, like having strong security and strong security practices.
That is much better because at the end of the day what you fail to grasp is that security is a state of mind and should not be a chore(which your idea would be...a chore that is).
if you make it a chore then you will fail to adequately protect yourself.

 

[chucker23n1]

Lol. Can’t believe some of the theories and posts here. I’m sure this does exist. But it’s not copying to the device but rather pulling from the device an Apple filesystem screenshot or partial clone of the device from the device and then bruteforce/stragitcally guessing the password using the clone.

Source?

How does it set itself up as a trusted device?

How does it access the file system?

Is the hash even stored on the file system at all, rather than on the Secure Enclave?

This easily bypasses all security because you’re making virtual copies of the copies (in software) and guessing passwords on the clones which are discarded and rebuilt as the software guesses. This is done in millionths of a second.

This is the second claim I see being made about the speed of brute forcing. Someone else claimed each attempt takes 80ms. Now you're saying one attempt (presumably?) is done in a microsecond.

Unknown is if it does it on the device (box) or the box itself transmits all of this to the cloud via its own secured cellular system (much more likely) and is done on the companies own super network.

No, unknown is how it even accesses the hash in the first place.

It’s able to easily copy the exact files it needs to do the guess work from a locked phone because of obvious baseband level exploits that someone who worked in iOS security would have access to.

What does the baseband have to do with anything? Why would it have access to iOS authentication?

Also knowing the exact part of the system where the encrypted key lay as well as the exact hashes and parts to copy would be already known, so it would just be a matter of plugging the phone in, pulling this info from the attached phone (using iTunes-like baseband level protocol permissions)

iTunes doesn't get those permissions. You have to explicitly opt in your computer running iTunes.

 

[shplock]

Your tax dollars at work. Since I have no issue that Police are allowed to kill without consequence, I certainly have no issue with them cracking a phone.

Then how about the Police kill someone you deeply love and care about then they say to you"They were innocent of any and all crimes, they were not posing danger or a risk to anyone but hey we just felt like killing them, do go f**k yourself" afterwards you just say "hey that's ok Officers because you are allowed to do what you want and kill who you want with no consequence to your actions and I do not blame you at all for killing someone I care for and love deeply who was innocent"
Somehow I doubt that!
The thing is that everyone has to be held accountable for their actions EVEN THE POLICE!
[doublepost=1521233118][/doublepost]

Right...and I'm not sure if any iOS devices use alphanumeric. I don't use passwords on my devices because given Apple's newer password policy, it will lock me out after a few bad guesses...and lock me out for days/weeks if repeated. Imagine if I went into the bathroom for 2 minutes and my 5 year old started banging away at the passwords. Or if someone is a jerk and purposely guesses wrong 15 times while you run out to your car. I know a few people who were locked out for days due to this stupid policy.

Apple should enable an option that allows unlimited guesses like the iOS versions from a few years ago. However, a)make it alphanumeric and b)make the length be up to 16 or 20 characters.

Trying to crack a 6-10 DIGIT password will only take a few minutes or hours depending on the length. Cracking a 6-10 ALPHANUMERIC will take days to weeks. Alphanumeric passwords of 16+ would take dozens (or more) years.

Alphanumeric would be 52 letters (upper and lower case in English), 10 digits totaling 62 characters. 62 to the power of 10 would be 839,299,365,868,340,224 combinations for the machine to guess. That's 839 quadrillion guesses. Add in the ability to use some symbols and the password could be 72 characters.

Erm I don't know about you but I CAN do that. I have a 12 digit alphanumeric code enable on my iPhone X. I also think you are wrong on the other point. if it is possible to do as many guesses as possible the n it would take mere seconds to break most people's codes. I mean you can not force people to use more than 6 digit codes. Look at how much flack Apple got for just saying people had to use 6 not 4!
Some people could not remember 12 or 20 digit alphanumeric codes or even just numeric codes.
The point is to slow down the hackers etc by trying the best to only allow a certain amount of code guesses per second etc.
[doublepost=1521233204][/doublepost]

I'm sure greykit can be updated too in order to break whatever the latest iOS is. Just guessing though.

not if the exploit is patched. then they would need to find another exploit which may not exist.
[doublepost=1521233468][/doublepost]

Well, you can be damn sure that the manufacturer of this box will not sell it to Apple (and neither are government agency very likely to give one they bought to Apple).

Yes but Apple have a LOT of cash and a lot of ways and means.I bet if they wanted to get hold of one they would do. I mean with their cash they could set up various shell companies and then use one of them to buy one from a 'friendly' (meaning corrupt)law officer with access to one.

 

[justperry]

With respect you obviously know nothing about cyber security. Using your logic then you should not even have a passcode at all because it would be too bothersome to even input 6 digits and while we are at it why not disable Touch id or face id because sometimes you know they won't work. If it is a pain the **** for you then it will be a HEADACHE for the hackers/thieves.

You have a point.
But believe me, input your not so easy password multiple times in a day as we used to do before touchID is a nuisance.

I do know a bit about security, I have a very long and difficult password set for multiple important sites/ID's like my AppleID.
I also have an always on VPN, adblockers, I block all Google crap, I have Gasmask running and Little snitch!

 

[mytdave]

I wonder how well this thing would do with my 10 character alpha-numeric passcode?

 

[jerwin]

Oh, irony of ironies. I hope they get hacked. hard.

 

[trellus]

This was inevitable, unfortunately.

 

[JRobinsonJr]

I disagree with your logic. Misuse of such technology affects everyone. For just one example, let's say the government is doing something evil (unthinkable, I know) and they use this tech to find/silence/discredit a whistleblower. That hurts everyone.

Agreed, so please allow me to clarify. My point was about the logistics of the device rather than the morality. Until more than a few of these are in operations (and we really don't know how many there are) it won't impact most people.

That said, I am not - in any way - on the "if you're not breaking the law you've got nothing to hide" bandwagon. We all have a right to both the expectation and delivery of privacy.