ElcomSoft blog:
In the iOS 11.4 Beta, Apple introduced a new called USB Restricted Mode. In fact, the feature made its first appearance in the iOS 11.3 Beta, but was later removed from the final release. This is how it works:
“To improve security, for a locked iOS device to communicate with USB accessories you must connect an accessory via lightning connector to the device while unlocked – or enter your device passcode while connected – at least once a week.”
And:
In other words, law enforcement will have at most 7 days from the time the device was last unlocked to perform the extraction using any known forensic techniques, be it logical acquisition or passcode recovery via GreyKey or other services.
It will be interesting to see if this mode survives through to the actual public release of 11.4. A chess move. Will the GreyKey folks have a follow-up? Or will all those $30K GreyKey devices become useless against updated phones?
I expect this would prompt law enforcement to even more aggressive behavior than we’ve seen.
I’d support power-only after 24 hours without login (outside of a continuing data connection already auth’d), or even auth-for-data on every connection, myself.
(At least, offhand, I can’t think of the use-case that makes that untenable, but there’s a lot of use-case out there.)
What if someone (I’m thinking 60yr old) legitimately forgets their passcode and waits greater than a week to bring it to an Apple Store. Typically it just gets restored in Recovery Mode. Will the USB port be locked for all purposes or will it be accessible in Recovery or DFU mode?