14 DAY TRIAL // Apple’s security nightmare continues with new figures showing how easy it’s become to crack the password blocking access to an iPhone.
GrayKey, the device manufactured by Grayshift and which is currently being purchased by police departments in the United States en-masse, can hack an iPhone no matter how long and complex the password, though it goes without saying that the more characters being used, the more it takes for the process to complete.
And according to Matthew Green, assistant professor and cryptographer at John Hopkins Information Security Institute, it’s possible to bypass a 4-digit passcode on the iPhone in a little over 6 minutes, while in the worst case scenario, it could take up to 13 minutes.
Needless to say, the cracking times increase as the passcodes become more complex, and for a 10-digit code, GrayKey could need some 4629 days to break into the iPhone.
Alphanumeric passcodes, the obvious choice
This is the most obvious sign that iPhone owners should turn to alphanumeric passcodes to protect their devices, and experts recommend to use at least 7 characters. According to Green’s estimates, this means an iPhone could be cracked in approximately one day or even more depending on the complexity.
Of course, using more complex passcodes isn’t exactly the most convenient solution for iPhone users, especially because they have to enter the code manually regularly according to iOS requirements.
On the other hand, this appears to be the only way to protect devices and make data more secure, though it goes without saying that Apple itself is playing a critical role here.
The company has remained completely tight-lipped since the GrayKey hacking box started making the headlines, and while it appears that the device uses vulnerabilities in iOS to bypass protections, Apple itself can’t seem to find the flaws to fix them in new updates.
Users can enable more complex passcodes on their iPhones by going to Settings > Face ID/Touch ID & Passcodes > Change Passcode > Custom Alphanumeric Code.
Guide to iOS estimated passcode cracking times (assumes random decimal passcode + an exploit that breaks SEP throttling):4 digits: ~13min worst (~6.5avg) 6 digits: ~22.2hrs worst (~11.1avg) 8 digits: ~92.5days worst (~46avg) 10 digits: ~9259days worst (~4629avg) — Matthew Green (@matthew_d_green) April 16, 2018