Basically GrayKey can unlock numeric passcodes by bypassing the cumulative limits that engage when the wrong code is typed in. The process still takes a long-ish time.
It can't do anything for FaceID, TouchID or alphanumeric passcodes.
It can't do anything for FaceID, TouchID or alphanumeric passcodes.
https://appleinsider.com/articles/18/04/16/researcher-estima...
4 digit = less than 15 minutes 6 digit = less than 24 hours 8 digit = less than 92 days
Besides those estimates, other sources talk of 4 digit = a couple of hours 6 digit = some three days
https://blog.malwarebytes.com/security-world/2018/03/graykey...
even if those could be "lucky" events.
The "clever" bit, according to reports is that the procedure "frees the device", i.e.:
1) you connect the iPhone to the Graykey
2) Graykey does something in a few minutes
3) you disconnect the iPhone and it is the phone itself that in due time unlocks itself
Which plainly means that several devices can be processed per hour (and then kept on a shelf, connected to a power supply as long as it is needed).
It’s probably using some kind of exploit to upload a custom ramdisk (similar to jailbreaks). Except, unlike jailbreaks, it doesn’t jailbreak the device, but instead tests the passwords.
What’s also interesting is that the Secure Enclave (which holds the encryption key) is supposed to enforce the 10 password limit, so they’re doing something really clever here.
It's much more likely that a marketing-driven product development culture would lie to its customers than it is that Grayshift engineers have compromised the SEP itself. Researchers have been "compromising" HSMs by standing on its external signaling implementation rather than the chip itself for decades, now.
Apparently GrayKey can't crack long passwords, since it's essentially brute-forcing, but almost everyone I know uses a four-digit code.
Also, this is troublesome because in the US, we're told that cops can force you to hand over your fingerprint but not your passcode. It's a bit problematic if those passcodes are easy to crack.
It's not settled law that you can't be compelled to provide a passcode. In general, the 5th Amendment prohibits compelled testimony that is incriminating. Disclosing a password to your own phone is usually not per se incriminating. Contrast that with disclosing a password to a device you're accused of hacking, where showing knowledge of the password is evidence of guilt. Many (most?) courts haven't yet been prepared to defend such a fine distinction, and seem to be more comfortable with a simpler rule that prohibits compelling password disclosure, period. But that could easily change, especially at the Supreme Court.
That's why my passcode is always "I murdered her, officer".
I anal but isn’t this basically slavery/forced indenture? Could a court of law compel Apple to write some software? If so, can a court of law require George RR Martin to write a novel and send him to prison if he declines?
I'd imagine neither of your examples could or would happen given the power Apple and Martin's representatives have, and how absurd forcing someone to write a book as part of a court decision would be, but I'm fairly sure you could find examples of relatively similar things. I could certainly see something like a contract-related case being resolved by essentially legally compelling someone to write a book that they said they'd write, or else be fined/imprisoned.
Again, I anal so I don't know the law but contracts sound like a strictly civilian (not government vs not government) court case where there should be no possibility of imprisonment. If there is it sounds like a bug to me and we ought to amend the laws so that it is not possible.
Conceptually I agree with you, the law is not as clear.
The whole notion of Miranda rights is still highly contentious, especially among conservative jurists, and that's why an increasingly conservative Supreme Court has narrowed and carved out exception to Miranda rights. Because of the conservative exceptions, you should never just remain silent. You should politely ask for an attorney whenever a question is asked, but even then you might still get dinged for refusing to answer some types of questions. For example, if you're not yet in custody, or for simple questions like your name. It's complicated, which is precisely what the original Miranda rights were intended to safeguard against.
The irony is the right against self-incrimination, and many other rights copied from English law and enshrined in the constitution, were originally judge-made rules. By creating Miranda rights the "liberal" Supreme Court was following in the footsteps of traditional Anglo-American legal practice, and exercising their inherent powers. Courts have inherent, constitutionally protected authority to control what is and is not allowed to be presented in court. (Though it overlaps with legislative powers to control court procedures.) Almost all the rules for doing so were crafted by the English courts over nearly a millennium. It's not at all out of sorts for the highest court in the land to craft a new rule instructing lower courts that testimony is presumptively compelled if given before a Miranda warning and to reject it at trial.
To be fair, the conservative counter argument is that in England the highest court in the land was the House of Lords, which was also a House of Parliament, which was and remains the seat of legislative power. Procedural protections didn't always arise in the House of Lords, but the closer you get to 1776 the fewer instances there were of lower courts making such procedural rules. So similar to the Second Amendment, you can pick and choose a window of time that best support a claim to historical precedent.
Even 4 digits could be enough, given that iOS enforces (very long) delays after a few failed attempts.
This is, apparently, the thing that GrayKey is able to bypass.
That's just a guess though, it could be far more complex than that
in other words: the encryption/wipe code may be a function of the password screen, but the phone may accept a hashed key as a valid unlock attempt through a different interface that does not contribute to the failed attempts limit.