Graybox should have anyone security conscious ensure that they and all people they care about are using custom alphanumeric passwords for their iOS devices.
Even "999999!" would be hard to guess if the domain space is unbounded.
Even "999999!" would be hard to guess if the domain space is unbounded.
A snippet from that article:
iOS estimated passcode cracking times (assumes random decimal passcode + an exploit that breaks SEP throttling):
4 digits: ~13min worst (~6.5avg) 6 digits: ~22.2hrs worst (~11.1avg) 8 digits: ~92.5days worst (~46avg) 10 digits: ~9259days worst (~4629avg)
The passcode is 'entangled' with a per-device 'UID' that only exists in silicon, not accessible by any firmware.
It seems that the current GrayKey attacks are closer to ~1s/guess.
My last post on the topic: https://news.ycombinator.com/item?id=16833802
[0] Page 15 https://www.apple.com/business/docs/iOS_Security_Guide.pdf
I'm not sure how GrayKey bypasses this...