Apple's iOS password cracking defense can be bypassed with the help of a USB accessory

Apple released iOS 11.4.1 this morning, and with it came a new software mechanism that blocks secret code cracking tools favored by law enforcement. Called USB Restricted Mode, the tool makes the iPhone inaccessible to third-party software of any kind after its screen has been locked for one hour. In this way, malicious third parties or law enforcement agencies can not get into the phone using access code cracking tools like GrayKey.

However, researchers at cyber security company ElcomSoft have discovered a flaw that resets the hour-long counter as long as you plug a USB accessory into the Lightning port of the iPhone, as the phone has already been connected to this accessory.

This is ElcomSoft's Oleg Afonin Explaining the Situation:

We have performed several tests, and can now confirm that the restricted USB mode is maintained by reboots, and that it persists in restoring the software via the Recovery mode. In other words, we have not found any obvious way to break the restricted USB mode once it's already engaged.

What we discovered is that iOS will reset the USB Restrictive Mode countdown even if we connect the iPhone to an unapproved USB accessory, which has never been paired with the iPhone. # 39; iPhone before (well, the accessories do not need to pair at all). In other words, once the police officer grabs an iPhone, he or she will immediately need to connect that iPhone to a compatible USB accessory to prevent locking the USB restricted mode after one hour. Most importantly, this only helps if the iPhone has not yet entered USB restricted mode.

Afonin says that you can even use Apple's Lightning Adapter to Apple's USB 3, which costs $ 39 on the company's online store. (Afonin notes that the $ 3.5mm 3.5mm Lightning adapter does not work, though.) ElcomSoft is apparently testing other adapters, including the cheap ones, to see which one to reset. counter.

This seems less of a serious vulnerability than a simple mistake on the part of Apple. Afonin says so much, the caller "probably nothing more than an oversight." Yet, this means that the forces of order, if they choose and want to go through the effort, can design systems to get around this tool as it is implemented today. ; hui. using cracking tools like GrayKey.

"With the release of iOS 11.4.1, the procedure to correctly capture and transport iPhone devices can be modified to include a compatible Lightning accessory.Before iOS 11.4.1, isolate the iPhone in a Faraday bag and connect it to a battery would be enough to transport it safely to the laboratory, "concludes Afonin.