A USB-based vulnerability that allows for the brute forcing of a passcode on an iOS device has been discovered by security researcher Matthew Hickey, reports ZDNet.
The method, which bypasses the 10-entry attempt that erases an iOS device when the setting is enabled, allows a hacker to plug an iPhone or iPad into a computer and send all passcodes, from 0000 to 9999, all at once, triggering an input routine that takes priority over anything else on the device. Hickey demos the hack in the video below.
Hickey's iPhone cracking method takes between three and five seconds for each four-digit passcode, which means it's slow and not as advanced as other passcode cracking methods employed by companies like Grayshift, which makes the GrayKey box. For this method to guess a six-digit passcode, Hickey says it would take weeks.
Apple in iOS 12 is introducing a new USB Restricted Mode that may put a stop to the vulnerability that Hickey has discovered, as well as vulnerabilities exploited by tools like the GrayKey Box.
With USB Restricted Mode, enabled by default on iOS devices running iOS 12, USB access to an iPhone or iPad is cut off if it's been more than an hour since the device was last unlocked.
That means computers and other accessories can't be used to access a locked iPhone if it's been locked for over an hour, disabling access via a USB to Lightning cable.
Update: In a statement obtained by iMore, Apple says "the recent report about a passcode bypass on iPhone was in error, and a result of incorrect testing."
The method, which bypasses the 10-entry attempt that erases an iOS device when the setting is enabled, allows a hacker to plug an iPhone or iPad into a computer and send all passcodes, from 0000 to 9999, all at once, triggering an input routine that takes priority over anything else on the device. Hickey demos the hack in the video below.
"Instead of sending passcodes one at a time and waiting, send them all in one go," he said.All that's required to use this brute force password cracking method is an iPhone or iPad that's turned on and locked and a Lightning cable, according to Hickey. It works on iOS devices up to iOS 11.3.
"If you send your brute-force attack in one long string of inputs, it'll process all of them, and bypass the erase data feature," he explained.
Hickey's iPhone cracking method takes between three and five seconds for each four-digit passcode, which means it's slow and not as advanced as other passcode cracking methods employed by companies like Grayshift, which makes the GrayKey box. For this method to guess a six-digit passcode, Hickey says it would take weeks.
Apple in iOS 12 is introducing a new USB Restricted Mode that may put a stop to the vulnerability that Hickey has discovered, as well as vulnerabilities exploited by tools like the GrayKey Box.
With USB Restricted Mode, enabled by default on iOS devices running iOS 12, USB access to an iPhone or iPad is cut off if it's been more than an hour since the device was last unlocked.
That means computers and other accessories can't be used to access a locked iPhone if it's been locked for over an hour, disabling access via a USB to Lightning cable.
Update: In a statement obtained by iMore, Apple says "the recent report about a passcode bypass on iPhone was in error, and a result of incorrect testing."
64 comments
Apple in 2018 is planning to hold a four day "shopping" event that will presumably see Apple products available at a discount or with some kind of gift with purchase.
On Apple's...
Apple today shared a new short video focused on the recently released 11 and 12.9-inch iPad Pro models, listing five reasons why the tablets can be your next computer.
Apple's list of...
Last month, a person wearing an Apple Maps backpack with LiDAR equipment was spotted at the intersection of Stockton and Sutter streets in San Francisco, suggesting Apple now has employees collecting...
In recent weeks, Apple slashed production orders for its latest iPhone XS, iPhone XS Max, and iPhone XR models due to "lower-than-expected demand," among other reasons, according to unnamed...
Apple CEO Tim Cook appeared on HBO on Sunday in a pre-recorded interview with Axios, in which he discussed several issues including Apple's relationship with Google and the need for privacy...
Alongside the new 11 and 12.9-inch iPad Pro models, Apple introduced a second-generation Apple Pencil, which is designed to work exclusively with its latest tablets.
In our latest YouTube video,...
Apple's new 11 and 12.9-inch models are its thinnest yet, measuring in at just 5.9mm, and both forum complaints and a new bend test video suggest the two devices have the potential to bend...
We're now one week away from Black Friday holiday shopping, which will take place on Friday, November 23. Of course Black Friday isn't just one day any more, and sales have already kicked off...
