Apple's Beats brand in April unveiled the Powerbeats Pro, a redesigned wire-free version of its popular fitness-oriented Powerbeats earbuds.
Maker of 'GrayKey' iPhone Unlocking Box Suffers 'Brief' Data Breach, Receives Money Demands
Grayshift, the company that makes the GrayKey iPhone unlocking boxes that have been sold to multiple law enforcement agencies across the United States, recently suffered a data breach that allowed hackers to access a small portion of the GrayKey code, reports VICE's Motherboard.
GrayKey box, via MalwareBytes
Last week, unknown hackers leaked portions of the GrayKey code and demanded two bitcoin from Grayshift with the threat of additional data being leaked. According to Motherboard, the code in question "does not appear to be particularly sensitive," but Grayshift did confirm that a "brief" data leak had occurred.
The GrayKey is a small, portable gray box equipped with dual Lightning cables. An iPhone is plugged into one of the cables to install proprietary software that's able to guess the passcode to an iPhone in as little as a few hours to a few days, based on the strength of the passcode.
GrayKey, which is priced starting at $15,000, can crack the latest iPhones running modern versions of iOS, including iOS 11. While the box is designed to provide law enforcement officials with easy access to locked iPhones for criminal investigations, there have been fears that the GrayKey technology could fall into the wrong hands.
The box has been sold to multiple law enforcement agencies across the country, and the data breach that Grayshift suffered, however inconsequential, is not at all reassuring for those who are worried about the security of the GrayKey boxes. The underlying functionality that allows the GrayKey to crack iPhones could be discovered and replicated, and the GrayKey boxes themselves are said to download data from cracked iPhones, which could also be at risk in a data breach.
According to Motherboard, Grayshift has not paid the extortionists their two bitcoin fee, as the Bitcoin addresses provided have received no funds. An additional Bitcoin address promising to provide interested parties with GrayKey information has also not received funds.
Grayshift says that "changes" have been made to help customers prevent unauthorized access to GrayKey boxes in the future, but Motherboard discovered another exposed GrayKey device broadcasting similar code.
Those worried about GrayKey and similar technologies can implement stronger and more secure passcodes and passwords that are more difficult to guess through brute forcing to prevent these kinds of tools from working. A 6-digit numeric passcode, Apple's default, can be guessed in as little as 11 hours, but an 8-digit numeric code can take over a month, while a 10-digit numeric code can take years.
Security experts recommend alphanumeric passcodes that are at least seven characters long with numbers, upper and lowercase letters, and symbols included. The longer the password, the more secure it is from GrayKey-style guessing methods. For more information on Grayshift's data breach, check out Motherboard's full report.
Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.
Last week, unknown hackers leaked portions of the GrayKey code and demanded two bitcoin from Grayshift with the threat of additional data being leaked. According to Motherboard, the code in question "does not appear to be particularly sensitive," but Grayshift did confirm that a "brief" data leak had occurred.
Indeed, Grayshift told Motherboard in a statement "Due [to] a network misconfiguration at a customer site, a GrayKey unit's UI was exposed to the internet for a brief period of time earlier this month."Grayshift says that no sensitive IP or data was exposed, and Motherboard confirms that the leaked code appears to be related to the user interface that displays messages on the GrayKey, but it's clear that Grayshift security is not airtight, raising questions about what kind of data might be accessible to hackers.
"During this time, someone accessed the HTML/Javascript that makes up our UI. No sensitive IP or data was exposed, as the GrayKey was being validation tested at the time. We have since implemented changes to help our customers prevent unauthorized access," the statement added.
The GrayKey is a small, portable gray box equipped with dual Lightning cables. An iPhone is plugged into one of the cables to install proprietary software that's able to guess the passcode to an iPhone in as little as a few hours to a few days, based on the strength of the passcode.
GrayKey, which is priced starting at $15,000, can crack the latest iPhones running modern versions of iOS, including iOS 11. While the box is designed to provide law enforcement officials with easy access to locked iPhones for criminal investigations, there have been fears that the GrayKey technology could fall into the wrong hands.
The box has been sold to multiple law enforcement agencies across the country, and the data breach that Grayshift suffered, however inconsequential, is not at all reassuring for those who are worried about the security of the GrayKey boxes. The underlying functionality that allows the GrayKey to crack iPhones could be discovered and replicated, and the GrayKey boxes themselves are said to download data from cracked iPhones, which could also be at risk in a data breach.
According to Motherboard, Grayshift has not paid the extortionists their two bitcoin fee, as the Bitcoin addresses provided have received no funds. An additional Bitcoin address promising to provide interested parties with GrayKey information has also not received funds.
Grayshift says that "changes" have been made to help customers prevent unauthorized access to GrayKey boxes in the future, but Motherboard discovered another exposed GrayKey device broadcasting similar code.
Using the computer search engine Shodan, Motherboard found a seemingly exposed GrayKey device, broadcasting similar chunks of code to the open internet.The technology used for the GrayKey will likely be outdated at some point through updates to the iOS operating system, but as far as we know now, it's still functional for even the latest versions of iOS and the newest iOS devices, including the iPhone X.
"To brute force a complex alphanumeric passcode, upload a custom password dictionary. If a dictionary is not uploaded, GrayKey will not attempt to brute force custom alphanumeric passcodes," one section of the apparent device's code reads.
Those worried about GrayKey and similar technologies can implement stronger and more secure passcodes and passwords that are more difficult to guess through brute forcing to prevent these kinds of tools from working. A 6-digit numeric passcode, Apple's default, can be guessed in as little as 11 hours, but an 8-digit numeric code can take over a month, while a 10-digit numeric code can take years.
Security experts recommend alphanumeric passcodes that are at least seven characters long with numbers, upper and lowercase letters, and symbols included. The longer the password, the more secure it is from GrayKey-style guessing methods. For more information on Grayshift's data breach, check out Motherboard's full report.
Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.
[ 101 comments ]
Top Rated Comments
(View all)
17 months ago
This is far beyond irony or karma, this is exactly what we've been screaming the warnings about for years now about why backdoors are an incredibly bad idea.
17 months ago
This is exactly why Tim Cook said you shouldn't build back-doors into products. Hackers will get at those back-doors one way or another.
17 months ago
Oh, and this technology will be exclusive to law enforcement and will never get in the hands of bad actors. Right.
17 months ago
Sure, let's build a "secure" government back door into all customer data and communications, what could go wrong?
17 months ago
I just want Apple to fix this bug so the stupid boxes become expensive paperweights.
Users have a right to privacy.
Users have a right to privacy.
17 months ago
I wish someone had hacked the whole thing and demanded a Kings ransom.
17 months ago
This is dumb. Someone did a ‘view source’ on the GrayKey UI. That’s not a data breach or any kind of security issue.
[ Read All Comments ]
For this week's giveaway, we've teamed up with Vessel to offer MacRumors readers a chance to win a Signature 2.0 Backpack.
Vessel makes all kinds of backpacks, briefcases, and bags, but...
Discounts on the latest iMacs remain ongoing this month, with Amazon and B&H Photo now offering a new all-time-low price on the 27-inch Retina iMac with 8GB RAM and a 1TB Fusion Drive. This model...
Google and Apple calendars are not playing friendly right now.
As alerted to us by multiple MacRumors readers, there appears to be a syncing issue with Google Calendar and Apple's...
Apple Music today launched a new curated playlist called "New Music Daily," which as the name suggests, is updated every day with fresh songs.
Made up of "new music you simply...
Taylor Swift revealed today on Instagram that she will be the next partner in Apple's "Music Lab" sessions, which are available in Apple retail stores.
The Music Lab session will...
Satechi today announced the Type-C Dual Multimedia Adapter, which plugs into two of the MacBook Pro's USB-C ports to offer a handful of add-on ports.
In total, this includes: one 4K HDMI...
Spotify today announced that it is extending its free-trial period for Spotify Premium to three months, up from the previous one month that users would have to try out the paid service. With this...
OtterBox today announced a new expandable wireless charging system that it calls "OtterSpot," which includes one charging base that can power up multiple batteries and a smartphone...
