Hacker News Reader

Comment by ec109685 | Hacker News Reader

GrayKey can’t unlock long passcodes: https://appleinsider.com/articles/18/04/16/researcher-estima...

Also - besides its name and the company name - there is nothing AFAIK connecting it to "black/gray market", at least initially those were offered only to LEO and only in US and Canada.

And the "long been used" is IMHO a tad bit exaggerated, it came out in the first months of 2018, and - set aside the FBI and whatever other US three or four letter government agencies, it is not likely that US$ 15,000 or US$ 30,000 is something that any police department has in a drawer and can spend instantly, more probably it has taken at least a few months for everyone to get the expense authorized:

https://www.forbes.com/sites/thomasbrewster/2018/03/05/apple...

No idea on volumes of sale or how many departments got one, in either the "online" or "offline" version, but by now - if it was "widely" used - I presume we would have a lot of evidence based on unlocked iPhones in trials.

That may not be a safe presumption. Organisations like the FBI keep their investigative techniques secret as long as they can, to preserve their effectiveness in ongoing and future investigations. Trials are the exception; most cases end without one, and the decline of local reporting means the public is less informed about the daily business of the courts.

Yep. it is actually largely dubitative.

I don't know, I simply have no idea of the number of device units of the Gray thingy sold, and how much they could have been used, and as well I have no idea on how many crimes involve the access to a (password protected) iPhone, but unless (yet another piece of data I have no idea about) all suspects either use an Android (or however non-iPhone) or give to the police access to the device without need to "crack" the access code, they should be non-trivial amounts.

I mean, I understand that it is a fraction (going to trial) of a fraction (criminal cases involving a phone) of a fraction (suspects not providing access to the device) of a fraction (suspects using specifically an iPhone), still the ubiquity of iPhones and the large number of criminal cases should anyway result in tens or hundreds, while we have AFAICT none or maybe a few actually documented/published about.

The declining of local reporting may be indeed another factor, but there would certainly be lawyers making a fuss (right or wrong) about this or that right violated through the use of this or similar tool.

The contract with ICE:

https://www.forbes.com/sites/thomasbrewster/2019/05/08/immig...

is likely to produce no public court records, just like many national agencies, still the sheer fact that not a single actual court record of its use can be found (at least by me) could mean that the device is not used that much by local police, a few cases should have been brought to the attention of the public.

>it is not likely that US$ 15,000 or US$ 30,000 is something that any police department has in a drawer

I wish that were true. Police in any small town in America could start at lunchtime and have that amount by nightfall. Let me introduce you to "civil asset forfeiture" ( https://www.heritage.org/research/reports/2014/03/civil-asse... )

There are state and federal version of this, and a "sharing" program to share the loot. It's pure corruption in blatant violation of the US Constitution, but it's good for government/police business (e.g. buys a lot of helicopters, tactical/swat equipment, training, etc.) so it persists.

As a non-American, it's almost unbelievable that the police can basically rob you in the so-called land of the free and home of the brave.

Worldwide problem.

"The idea that the State originated to serve any kind of social purpose is completely unhistorical. It originated in conquest and confiscation - that is to say, in crime. It originated for the purpose of maintaining the division of society into an owning-and-exploiting class and a propertyless dependent class - that is, for a criminal purpose." -- Albert J. Nock

I would assume 90% of iPhone users if not more use 6 digit codes. So this is still a big win for the creators of GrayKey

90% of iPhone users with a passcode probably use the (default) 6 digit passcode option, but I would be surprised if that many people set that up.

The default is to create a passcode - you have to specifically opt out if you don't want one.

https://support.apple.com/en-gb/HT202033

A huge percentage of people use stupid passcodes, because convenience is more important than security for them.

Six ones, or up and down the middle column, that sort of thing.

Guilty. Convenience is much more important than security for me.

Back in 2016, it was estimated between 85-89% used a passcode [0]; I expect it's probably even higher today.

[0]: https://techpinions.com/apples-penchant-for-consumer-securit...

So what's the deal with this? Isn't it just brute force? I would've expected the NSA to have something like that since iPhones first hit the market.

> I would've expected the NSA to have something like this since iPhones first hit the market.

If they do, why would they reveal it for something as 'basic' as a single attacker? Or they may have broken it, and simply 'reverse engineered' the path to evidence with public means:

* https://en.wikipedia.org/wiki/Parallel_construction

Agencies don't want to reveal means and methods if they don't have to.

The main trick is bypassing the increasing timeouts for multiple incorrect guesses.

Shouldn't you always be able to completely bypass that by taking out the chip or something and just probing it directly? I guess that might be a bit much for normal police work, but in terms of "can the government (read: NSA) get into this" this doesn't really seem to change anything.

Possibly, but that still defaults back to brute forcing a long passphrase with a salt. If guessing the passphrase goes above a certain entropy and Apple derives the password with a key stretching algorithm, then the timeouts won't matter.

That's exactly what I mean - the usual key complexity rules apply, and have always applied.

But they shouldn't. The key you enter as a user is actually only half of the key needed to decrypt the data. The other half of the key is generated by the secure enclave when the device was first powered on. This part of the key alone should be impossible to brute force and is stored in tamper resistant flash memory on the secure enclave co-processor.

So you would need to break open the co-processor without destroying its contents and read the secure enclave key before any brute forcing could happen directly on the encrypted data.

And no you can't just try to brute force it by sending decryption requests to the secure enclave. The secure enclave itself implements a exponentially increasing lockout time and won't respond to decryption requests during it. [0]

[0] https://www.apple.com/in/business-docs/iOS_Security_Guide.pd...

If the secure enclave implements the time lockout (well, supposedly I guess considering it seems broken) then the device is indeed a game changer, thanks for that information!

The external interface of the chip does not let you just read its contents - that's the whole point of a secure enclave device. You'd have to decap it and make some extremely fine connections to the memory parts of the chip.

The lockout delay is implemented in the chip itself in newer iphones (I think starting with iphone 5S). So no, taking the chip out buys you nothing.

> To further discourage brute-force passcode attacks, there are escalating time delays after the entry of an invalid passcode at the Lock screen. ...On devices with Secure Enclave, the delays are enforced by the Secure Enclave coprocessor. If the device is restarted during a timed delay, the delay is still enforced, with the timer starting over for the current period.

https://www.apple.com/in/business-docs/iOS_Security_Guide.pd...

Reply on news.ycombinator.com