Hacker News Reader

Comment by _kbh_ | Hacker News Reader

LEO already have access to locked phones via stuff like GrayKey.

https://www.grayshift.com/graykey/

I am always skeptical of these "lawtech" companies that sell magic unlocking devices. Are we really to believe that there are unpatched security holes in all major devices (both Android and iOS) that allow this kind of backdoor access?

I find it rather convenient that the "detailed support matrix" is only available for current customers only, seems to me like the actual amount of supported devices/operating systems would be limited to things such as outdated Samsung Galaxy phones and similar.

It's complicated, but yes there are a lot of ways to unlock devices some of which include straight up exploiting the device. Keep in mind btw that a lot of the sorts of criminals local LE is going after with these devices are not usually running fully patched iphones or pixels.

>Are we really to believe that there are unpatched security holes in all major devices (both Android and iOS) that allow this kind of backdoor access?

If you are at all familiar with the histories of jailbreaking, previous exploits, and the gray unlock market, it’s unreasonable you would not consider this this to be the default case.

It works. It's basically a software brute force that works great for 4 digit pins, takes longer for longer passcodes. Other offerings are a keylogger for the pin/passwords after they "return" the device to the suspect.

How would you install a keylogger on an encrypted device without rooting it or deleting user data?

I guess you could replace the screen with one that logs taps.

maybe you could sniff the data coming from the touchscreen with something you physically install into the phone.

> It's basically a software brute force that works great for 4 digit pins, takes longer for longer passcodes

Since the pin/password isn't actually the encryption key and is instead just the code that is provided to the security module/TPM on the device, I fail to see how this can be bruteforced. Unless there is also a magic hardware backdoor in Android phones, but in that case why would there need to be private companies and how would they even have access to this.

Confiscated phones often have been confiscated for months and are therefore on a relatively old patch level. If at any point old vulnerabilities come out these can be used. Keeping the phones on and connected to a charger in the evidence lockers doesn't seem like too much work.

> Keeping the phones on and connected to a charger in the evidence lockers doesn't seem like too much work.

There's no way that's a standard procedure.

Why? Seems pretty intuitive to me in a time where everything is encrypted.

If the phone is setup for automatic updates it'll restart within a month (most of the phones I've had do monthly security patches) and you'll be in a fresh boot state. You can't turn off the updates without first unlocking the phone giving you a rather limited window to attempt to exploit the device.

Will it reboot if it's not on network?

Updates need network access. If the phone isn't on a network, then it won't reboot.

Police can't really pop out e-sims, that means the police needs to keep the phone in an RF proof bag/work in an RF proof room.

Which, again, wouldn't be too much work. Also, my Android phone does not update and reboot automatically.

Android disabling USB data by default has been a thorn.

I think it has problems in some cases, pin codes longer than 6 digits.

Why don't Google and Apple buy this product then proceed to analyze and close all holes?

If I had to guess: not everyone can buy this software and A/G are not wanted by the sellers. Even the usual customers (law enforcement) are not very likely to pass exploits to them, because their work would become more difficult.

Reply on news.ycombinator.com