Apple Says Bug Exploited by $500 Passcode Guessing Box to Crack iPhone 7 is Patched in iOS 11
Aug 18, 2017 3:27 pm PDT by Juli Clover
iOS 11 patches an exploit that could be used to crack an iPhone 7 or iPhone 7 Plus passcode using a $500 hardware hacking solution, Apple confirmed to TechCrunch this afternoon.

The exploit, demonstrated by YouTube user EverythingApplePro yesterday, was never really of any concern to iPhone users because of the extreme parameters required to make it work in a timely manner, according to TechCrunch. It uses a $500 piece of hardware, requires physical access to an iPhone 7 or 7 Plus, realistically only works with a 4 digit passcode, and slows down drastically more than 10 minutes after an iPhone's passcode was last changed.


The "box" shown off in the video is similar to tools used by law enforcement officials, and while passcode-guessing hardware like this does not normally work at this speed because iOS devices lock you out after several failed passcode entry attempts, there is a bug in iOS 10 that makes it possible to guess a passcode over and over for a short period directly after the passcode has been changed. TechCrunch explains:
On iOS 10, there is a "bug" for lack of a better term, that allows repeated, rapid guesses of the passcode if you've changed it within the last minute or so. This allows the box to work within that period. Once another threshold is crossed -- say 10 minutes after a passcode is changed -- you no longer have the freedom to guess rapidly.
Without the rapid guessing enabled by the iOS 10 bug, it takes much, much longer for a solution like box to get into an iPhone because it's slowed down by Apple's passcode timeout. A six digit passcode (now the default on iOS devices) that had not been changed recently would take approximately 9.5 years to crack, for example.

According to Apple, the behavior that allows the box to work has been patched as of iOS 11 beta 4.

Top Rated Comments

(View all)

11 months ago

So basically don't use your iPhone 7 until iOS 11 comes out lol.


Or don’t change your passcode then give your phone to some shady looking dude with a $500 password cracking tool in his hands, within 10 minutes... until iOS 11 comes out?
Rating: 20 Votes
11 months ago
He sneakly didn't mention in the video that the passcode needed to be changed in the last ten minutes.

I wonder what made them bring this useless tool to market.
Rating: 14 Votes
11 months ago

He sneakly didn't mention in the video that the passcode needed to be changed in the last ten minutes.

I wonder what made them bring this useless tool to market.

To flog to YouTubers hoping to make money from adverts.
Rating: 10 Votes
11 months ago
This "tool" seems to be about as effective as penis enlargement products, although I have no personal experience with this passcode generator :)
Rating: 8 Votes
11 months ago

If not you get guys like these who think they're "hackers" by selling an overpriced iterative pin code guesser hahahaha


They don't think they're hackers - they know how simple the product is. The person buying it thinks they're a hacker because they have the product.
Rating: 8 Votes
11 months ago
I wonder if this was an intentional choice by the programming team? I could see someone arguing that "right after changing the passcode, people are going to be more prone to mistakes - so let's not penalize them for the first few minutes".
Rating: 6 Votes
11 months ago

Yep... the best advice is to be more careful and not lose your phone in the first place.

We shouldn't be worried about the risks outlined in this article though.

The chances of someone finding my phone and having one of these $500 boxes is ridiculously low. :p


AND you losing the phone just after changing the passcode, and that person getting to that box within 10 minutes of you changing the passcode.
Rating: 4 Votes
11 months ago

So basically don't use your iPhone 7 until iOS 11 comes out lol.

No. Don't let someone who has this box steal your iPhone within 10 minutes after changing the passcode.
Rating: 4 Votes
11 months ago
On a side note... that video is a case in point of why I avoid YouTube videos when I'm trying to learn about anything - the dude took what should've been maybe a 1-2 minute video, but padded it out to 12+ rambling minutes.

The "best" how to's... and I've seen several of them... are the ones where it's just a camera showing the terminal screen of some guy typing Unix commands. Seriously, dude, one short web page with a single screen capture would answer my question, but you want me to listen to your whiny voice while I watch you type for six minutes?!
Rating: 4 Votes
11 months ago
That's just very bad programming if I may say so... As a software dev. you should know that at every passcode screen, a limited number of attempts should be set in place. If not, you get guys like these who think they're "hackers" by selling an overpriced iterative pin code guesser hahahaha
Rating: 3 Votes

[ Read All Comments ]
Newer Article Older Article