Going Dark

As you might be aware, for a couple of years now Spies of all sorts, but particularly Cops, have been able to use a $15,000 tool called a “GrayKey” from a company called “GrayShift” to access the data on your iPhone by using a brute force technique that exploits flaws in Apple’s USB/Lightning Port.

Apple is not very happy about that because security is one important thing that makes an iPhone worth $500 more than a real cell phone. They’ve been telegraphing a fix for about as long as the existence of this technology became public.

Well, it seems they found one and it’s now available in iOS 12.

Earlier pieces on the subject from Gizmodo–

• FBI Used Fake Statistics to Sell Its Need for Encryption Backdoors
• iPhone Hackers May Already Have a Workaround for Cops to Crack Apple’s Newest Security Feature
• The State Department Has Reportedly Purchased a $15,000 iPhone Encryption Cracking Device
• Investigators Told Not to Look at iPhones With Face ID to Avoid Lock-Out: Report
• Cops Are Predictably Pissed About Apple’s Plan to Turn Off USB Data Access on iPhones
• Apple’s Cop-Blocking iOS Update Is Here

Apple Reportedly Blocked Police iPhone Hacking Tool and Nobody Knows How
by Rhett Jones, Gizmodo
10/24/18

Apple’s latest iteration of iOS has reportedly turned the GrayKey hacking device into an expensive doorstop. Law enforcement around the world has taken to using GrayKey to break into locked iPhones but it appears Apple has finally gotten ahead of the device’s crafty manufacturers. For now.

Forbes’ Thomas Brewster has been on top of the GrayKey saga from the beginning. On Wednesday, he cited sources from the forensic community who’ve told him that Apple’s efforts to keep bad actors and law enforcement from cracking into its users’ phones have paid off. According to the report, the $15,000 tool made by a shadowy company called Grayshift is now only capable of performing a “partial extraction” of data. It can pull a few unencrypted files and some metadata that’s virtually worthless.

One source that went on the record for Forbes, Captain John Sherwin of the Rochester Police Department in Minnesota, confirmed that the release of iOS 12 has hobbled GrayKey’s ability to unlock a phone. “That’s a fairly accurate assessment as to what we have experienced,” he told Forbes.

It’s still unclear what exact change could have been made to shut GrayKey out. Previous reporting has told us that the tool uses a workaround to brute force its way in by guessing a users’ password until it gets it right. Apple has protections in place to stop that kind of tactic and GrayShift’s methods are a closely held secret.
…
With iOS 12, Apple implemented a highly-anticipated change called “USB Restricted Mode.” This shuts off lightning port access on the iPhone if it hasn’t been unlocked by a user in the last hour. This was widely believed to be Apple’s solution to foil companies like GrayShift and Cellebrite but we don’t know for certain if that did the trick. Apple did not return our request for comment.

Whether it’s the solution or not, you might want to double-check that your phone is set up for USB Restricted Mode. You’ll need to be updated to iOS 12 and go to Settings > FaceID and Passcode.

Unfortunately I can’t duplicate the screen shot. You’ll have to go to Gizmodo to see that.