Hacker News Reader

Comment by xevb3k | Hacker News Reader

From the article, it seems to be a passcode bruteforcing tool. They state in the article 3 days or longer for a 6 digit passcode. Which I assume means 3 days for a 4 digit code. That’s about 26 seconds per guess.

So if you care about securing against this, use a longer passcode (and alphanumeric) is the message I guess.

View on HN

Isn't there a setting for wiping the device if the wrong password is entered X times?

This device pranks the hardware to allow unlimited attempts at guessing the password.

I don’t know the details: is it as simple as grounding the “password entered incorrectly” pin? Or is it about injecting so much noise on a signal line that the message to increment the PIN attempt count never gets through? I don’t know.

So use a passphrase, not a PIN.

Last year someone demonstrated the possibility of dumping and restoring the state of the security hardware in between entry attempts, so that the phone always thought you were on your first try. I assume this is the technique being used by the GreyKey.

EDIT: Pretty sure this is the one I'm thinking of: https://www.digitaltrends.com/mobile/cambridge-researcher-ha...

I guess it was two years ago.

With all the work that I've heard went into secure enclave (IIRC that's apples hardware+software security latest-and-greatest), does that mean someone (or an entire team) at Apple is absolutely sweating bullets/thinking frantically right now?

Security and a focus on user privacy protection (from other entities, at least) is definitely a differentiator for apple devices

I guess they copy something off the phone, validate passcode attempts against that piece and the phone gets correct passcode only.

Maybe.. but I think the system is designed so that isn't possible. There is a secret device key inside the secure enclave used to salt your passcode... I bet they're bypassing the limit on number of password guesses.

On the other hand, is it possible to programatically enter the passcode? From the picture, it looks like it's unlocked via lightning cable. It's not emulating unlocking via touchscreen. I wonder how much security would it add to require input via screen.

I bet they just connect (or rather, emulate) a physical keyboard connected via Lightning/USB, and use it as an input device.

Yep! And with these guessing speeds, the amazing device can wipe an entire iPhone in less than a second!

Yes, I wonder if this device has a way to bypass that.

>>So if you care about securing against this, use a longer passcode (and alphanumeric) is the message I guess.

Yeah but "normal" people don't think that cops will have a reason to look at their phone. Until it's too late.

Cat and mouse game, let's hope Apple does something. Typing 10 characters a gazillion times a day can become frustrating

Why do you have to type it that often? I usually have to type mine once per day and the rest is with fingerprint or faceID

If you are using fingerprint or faceID, then they do not even have to use this tool.

both touchID and faceID are ephemeral and expires after 24 hours (configurable, i think). Unless the device was obtained from the person immediately any hardware hack to bypass them won't work.

True.

It is still a 24h block (let's use the default) where the device is vulnerable. In many countries there are no protections against pressing your finger on the phone, or worse yet, turning it to face you.

It works fine for every day use, and if I ever find myself in a situation where I could conceive a higher than normal risk of getting arrested, I would reboot the device so the password is required to unlock it. This can be done with one hand in the pocket in a matter of seconds.

Tap the power button 5 times to activate Emergency controls. Offers to power off, display Medial ID information, or instigate an Emergency SOS where your GPS location is sent in an SMS to a designated emergency contact and a call to the emergency services is initiated.

It also disables biometric unlocking until the password is entered.

Sometimes you don't expect such situations/events. And then it's to late.

You can just hold the side button. I believe that’s added for exactly that use case.

FaceID requires you to have your attention on your device... if you look away it won't unlock.

You can hold the side button for a bit to force it to require a passcode again.

Specifically lock plus either volume button.

Does anyone have a guess as to whether pair-locking an iPhone will prevent this exploit?

You are correct.

Reply on news.ycombinator.com