New security issue discovered in Apple’s device

Jun 23, 2018 21:05 GMT  ·  By

The days when Apple’s iPhone was considered an unhackable device are long gone, as most of the security news that makes the rounds these days and concern this smartphone discuss new methods to bypass the passcode and access stored data.

This time, security researcher Matthew Hickey, who also co-founded cybersecurity firm Hacker House, has discovered a way to brute force passcodes on iPhones running any iOS version up to 11.3.

Basically, his hack involves tricking the iOS protection system and obtain the rights to try as many codes as he wants in an attempt to break into the iPhone. This means that anyone would be able to brute force iPhone passcodes without having to wait longer between attempts and without reaching the 10-time limit which would lead to the device being wiped.

Hickey explains that the method does not require any advanced techniques, but only an iPhone that’s already turned on and a Lightning cable.

Apple knows the bug is there

Instead of entering iPhone passcodes one by one, which would gradually increase the waiting time between attempts and eventually delete the data, the researcher says that attackers can simply send one string containing all code combinations with no spaces. This means that instead of handling passcode inputs one by one and increasing the waiting time, iPhone actually reads each combination without a break, so no waiting time is added.

A proof of concept shows how easy the method can be used by pretty much anyone, though the researcher explains that the process could take anywhere from a few seconds to weeks before the right passcode is discovered.

The method works with both 4-digit and 6-digit passcodes, though it goes without saying that the more complex the code, the more time it takes for the brute-force attack to complete.

As ZDNet reports, Apple has already been informed of the bug. iOS 12 could block it when it launches in September, and at this point, it’s not yet clear if the new security feature preventing USB connections after 1 hour without unlocking the device renders the hack obsolete.