GrayKey develops box to brute force iPhone unlock codes

[ScratchCat]

https://blog.malwarebytes.com/security-world/2018/03/graykey-iphone-unlocker-poses-serious-security-concerns/

https://www.forbes.com/sites/thomasbrewster/2018/03/05/apple-iphone-x-graykey-hack/#36a893d02950

 

A company named GrayKey has developed a device for brute forcing iPhone unlock credentials without incrementing the failed unlock attempts counter, allowing automated searching of the keyspace.

Quote

In late 2017, word of a new iPhone unlocker device started to circulate: a device called GrayKey, made by a company named Grayshift. Based in Atlanta, Georgia, Grayshift was founded in 2016, and is a privately-held company with fewer than 50 employees. Little was known publicly about this device—or even whether it was a device or a service—until recently, as the GrayKey website is protected by a portal that screens for law enforcement affiliation.

According to Forbes, the GrayKey iPhone unlocker device is marketed for in-house use at law enforcement offices or labs. This is drastically different from Cellebrite’s overall business model, in that it puts complete control of the process in the hands of law enforcement.

The device is not publicly available for good reason, resulting in little information being know about it. The company seems to use an approach similar to Cellebrite who supposedly unlocked the San Bernadino shooter's iPhone. However unlike Cellebrite GrayKey allow the cracking devices to leave the company resulting in the possibility for the devices to be stolen and sold on the black market.

 

Quote

Two iPhones can be connected at one time, and are connected for about two minutes. After that, they are disconnected from the device, but are not yet cracked. Some time later, the phones will display a black screen with the passcode, among other information. The exact length of time varies, taking about two hours in the observations of our source. It can take up to three days or longer for six-digit passcodes, according to Grayshift documents, and the time needed for longer passphrases is not mentioned. Even disabled phones can be unlocked, according to Grayshift.

 

The system allows multiple iPhones to be attacked at the same time, the majority of the time being disconnected from the main box. This would suggest GrayKey have developed a way to allow the iPhone to effectively attack itself, being the host for the brute force attempt. As shown in the above picture the attack can use non brute force methods such as searching for repeated characters to improve the speed of the attack.

 

Quote

After the device is unlocked, the full contents of the filesystem are downloaded to the GrayKey device. From there, they can be accessed through a web-based interface on a connected computer, and downloaded for analysis. The full, unencrypted contents of the keychain are also available for download.

As can be seen in the screenshot above, the GrayKey works on the latest hardware, and at least on iOS up to 11.2.5 (which was likely the most current system at the time this image was captured).

The attack allows the entire file system to be extracted as well as the keychain, containing all stored logins including passwords unencrypted. Additionally the attack supports iOS 11, 10 and in the future iOS 9, placing the vast majority of iPhone users at risk if this system were to find its way into the wild.

 

 

Quote

The GrayKey device itself comes in two “flavors.” The first, a $15,000 option, requires Internet connectivity to work. It is strictly geofenced, meaning that once it is set up, it cannot be used on any other network.

However, there is also a $30,000 option. At this price, the device requires no Internet connection whatsoever and has no limit to the number of unlocks. It will work for as long as it works; presumably, until Apple fixes whatever vulnerabilities the device relies on, at which time updated phones would no longer be unlockable.

Only law enforcement bodies may purchase the product, at $15000 for the geofenced version it is not cheap however it wields immense power by placing almost every model of iPhone at risk (most likely also the iPad and iPod). The $30000 'unlocked' version is dangerous as it would be possible to sell the device on the black market for great profit, enabling almost any stolen iPhone to be unlocked, the credentials extracted and resold as a used model rather than for parts.

 

This device is interesting at the very least and has the potential to be a great threat. Hopefully Apple will patch the vulnerability soon though it is highly unlikely Apple will be able to obtain one to analyze the exploit. With the earlier release of the iBoot source code, the complete rewrite of iOS for 64 bit applications and the GrayKey box Apple will have to be vigilant about reviewing the security of their products

[ItsMitch]

I bet the FBI would love to spend money on this

[ARikozuM]

Hopefully the 5th amendment and judges still protect our security and privacy. 

[Zodiark1593]

21 minutes ago, ScratchCat said:

This device is interesting at the very least and has the potential to be a great threat. Hopefully Apple will patch the vulnerability soon though it is highly unlikely Apple will be able to obtain one to analyze the exploit. With the earlier release of the iBoot source code, the complete rewrite of iOS for 64 bit applications and the GrayKey box Apple will have to be vigilant about reviewing the security of their products

It would be quite foolish to underestimate Apple's sheer resources. Even if the company is unwilling to sell to Apple, even at millions of dollars, there isn't anything stopping Apple from borrowing such a unit from a police in exchange of a donation. Heck, if I had Apple's resources, I wouldn't be above having an insider at one of these police forces run some experimentation for me, if I wanted access badly enough.

[mr moose]

15 minutes ago, ARikozuM said:

Hopefully the 5th amendment and judges still protect our security and privacy. 

I don't think the 5th amendment applies to evidence does it?

 

I wonder if the FBI will stop asking for a backdoor now or if there are other issues this box can;t bypass like fingerprint?

[ARikozuM]

5 minutes ago, mr moose said:

I don't think the 5th amendment applies to evidence does it?

It protects against self-incrimination, I believe. I would hate to see this used, without proper protocol such as a warrant, without permission *by accident*. If they accidentally stumble upon evidence they can obtain it more easily when they know where to search. 

5 minutes ago, mr moose said:

I wonder if the FBI will stop asking for a backdoor now or if there are other issues this box can;t bypass like fingerprint?

 

[mr moose]

4 minutes ago, ARikozuM said:

It protects against self-incrimination, I believe. I would hate to see this used, without proper protocol such as a warrant, without permission *by accident*. If they accidentally stumble upon evidence they can obtain it more easily when they know where to search. 

 

 

I guess when you have police randomly taking phones from people and cracking them open you have bigger problems than just protocol issues.

[dizmo]

Haha, I find it hard to believe a thief would have $30,000k to drop on an iPhone unlocker

That'd be quite the organized group if they do.

[mr moose]

1 minute ago, dizmo said:

Haha, I find it hard to believe a thief would have $30,000k to drop on an iPhone unlocker

That'd be quite the organized group if they do.

They could loan it to the FBI in exchange for immunity. 

[dizmo]

1 minute ago, mr moose said:

They could loan it to the FBI in exchange for immunity. 

...quoted the wrong person?

That makes no sense in context with what I said.

[ARikozuM]

6 minutes ago, dizmo said:

That makes no sense in context with what I said.

Maybe he's saying the FBI amount to thieves?

[mr moose]

5 minutes ago, dizmo said:

...quoted the wrong person?

That makes no sense in context with what I said.

I was just making a joke about a thief buying a phone unlocker. 

[mr moose]

Just now, ARikozuM said:

Maybe he's saying the FBI amount to thieves?

No, it just struck me as amusing the thought that a thief would buy one,  I couldn't think of any reason they would need one.

[ARikozuM]

4 minutes ago, mr moose said:

No, it just struck me as amusing the thought that a thief would buy one,  I couldn't think of any reason they would need one.

It flew right over me. 

[suicidalfranco]

1 hour ago, mr moose said:

1 hour ago, mr moose said:

No, it just struck me as amusing the thought that a thief would buy one,  I couldn't think of any reason they would need one.

 

buy this unlocker, steal iPhones from random people, unlock them, sell on eBay, ????????, Profit

[dizmo]

 

1 hour ago, mr moose said:

I was just making a joke about a thief buying a phone unlocker. 

Hahaha. Ah. I blame being sick on missing that one.

1 hour ago, ARikozuM said:

 

It flew right over me. 

x2

[dizmo]

4 minutes ago, suicidalfranco said:

buy this unlocker, steal iPhones from random people, unlock them, sell on eBay, ????????, Profit

And what...profit in how many years? People that steal for a living aren't the brightest, and are generally extremely poor with their money.

You're more likely to get caught long before you break even.

[DrMacintosh]

I hope every law enforcement agency buys these so I can watch them cry when Apple changes how pass codes function. 

 

Also alpha numeric pass codes are not vulnerable to this apparently. 

[mr moose]

45 minutes ago, suicidalfranco said:

buy this unlocker, steal iPhones from random people, unlock them, sell on eBay, ????????, Profit

Unlocking won't help when apple has the imei number on a stolen phone database and you can't reactivate the phone.

[Beef Boss]

I when people say "recently uncovered" we've had these since 2016. From one's like these that "take control" of the phone to one's with sensors that attach to the screen in boot modes. 

[ScratchCat]

5 hours ago, DrMacintosh said:

I hope every law enforcement agency buys these so I can watch them cry when Apple changes how pass codes function. 

 

Also alpha numeric pass codes are not vulnerable to this apparently. 

They are vulnerable, just much harder to break unless a dictionary attack were to be used.

Quote

It can take up to three days or longer for six-digit passcodes, according to Grayshift documents, and the time needed for longer passphrases is not mentioned. Even disabled phones can be unlocked, according to Grayshift

 

[divito]

Very interesting vulnerability if this is true. It'd be cool to see it in action.

[captain_to_fire]

I'm just glad that "987987" is not my iPhone's passcode.

 

12 hours ago, dizmo said:

Haha, I find it hard to believe a thief would have $30,000k to drop on an iPhone unlocker

That'd be quite the organized group if they do.

That would be nothing for rich people and government intelligence organizations. But if it's just the typical run in the mill thief in the street, I think he's better off robbing a bank than trying to unlock someone's iPhone.

 

13 hours ago, ScratchCat said:

The attack allows the entire file system to be extracted as well as the keychain, containing all stored logins including passwords unencrypted. Additionally the attack supports iOS 11, 10 and in the future iOS 9, placing the vast majority of iPhone users at risk if this system were to find its way into the wild.

Uhm what? Since when did a mobile OS from 2015 became the future of iOS? ?

 

But it would be interesting how they manage to get around iOS's anti brute force feature "Erase Data" which will initiate a secure wipe after accumulating 10 failed passcode attempts. I wonder if "Erase Data" is enabled by default on all iPhones sold once passcode is added. Is this the case @DrMacintosh

[divito]

23 minutes ago, hey_yo_ said:

Uhm what? Since when did a mobile OS from 2015 became the future of iOS? ?

They'll be adding support for iOS 9 in the future, not that it is the future.

[Valentyn]

12 hours ago, suicidalfranco said:

buy this unlocker, steal iPhones from random people, unlock them, sell on eBay, ????????, Profit

Activation Lock will still be in affect; so with device IMEI being black listed; and device Activation Locked through Apple ID, it’s just a fancy paper weight.

 

It’s mostly law in forcement that’ll use this to try and get evidence most likely .