Motherboard:
Law enforcement agencies across the country are buying or have expressed interest in buying GrayKey, a device that can unlock up-to-date iPhones. But Grayshift, the company that makes the device, has attracted some other attention as well.
Last week, an unknown party quietly leaked portions of GrayKey code onto the internet, and demanded over $15,000 from Grayshift—ironically, the price of an entry-level GrayKey—in order to stop publishing the material. The code itself does not appear to be particularly sensitive, but Grayshift confirmed to Motherboard the brief data leak that led to the extortion attempt.
The mind reels. If some organization comes up with a golden key that unlocks all iPhones, that golden key will find its way into nefarious hands. This is living proof of that.
Imagine a budget-constrained law-enforcement agency that doesn’t have the best internal security, but that has bought this device.
It isn’t hard if you try.
It’s not as bad as you think, Dave. If the “golden key” code leaks, then Apple will have straightforward documentation of the exploits used, and will simply patch them in an upcoming OS.
(Roughly speaking, there are two exploits happening here—1. jailbreak so they can install without an unlock; 2. bypassing the secure enclave’s slowdown of unlock attempts. Both of these are likely not architectural flaws, but rather technical bugs, that allow GrayKey to work.)
GrayKey is likely only effective as long as its platform remains secret. As soon as it’s actually leaked (which it sounds like this is not), its utility rapidly goes down to zero, given the fact iOS has a good upgrade rate.
Well, this wasn’t inevitable at all.
Also, this section is very amusing to me.
“During this time, someone accessed the HTML/Javascript that makes up our UI. No sensitive IP or data was exposed, as the GrayKey was being validation tested at the time. We have since implemented changes to help our customers prevent unauthorized access,” the statement added.
I can’t imagine them not wanting someone to have “unauthorized access”.
I was going to write up a post about how I think the GreyKey works, but in short, I suspect that they’ve found a way to make an image of the phone onto another phone (hence the two lightning cables) and the device tries to brute force the copy until it’s locked down, then re-images the copy model and continues the brute-force attempt.
Once the passcode is found, then the police can use it on the original phone.
This makes a lot of sense. Copy it and beat the heck out of it, and just recopy when you can’t use the image any longer.