iOS 11.4 to Disable USB Port After 7 Days: What It Means for Mobile Forensics

Re:iOS 11.4 to Disable USB Port After 7 Days: What It Means ... by r00fus on Tuesday May 08, 2018 @01:15PM (#17022639)

Graybox should have anyone security conscious ensure that they and all people they care about are using custom alphanumeric passwords for their iOS devices.

Even "999999!" would be hard to guess if the domain space is unbounded.

[ Parent | on HN ]

Re:iOS 11.4 to Disable USB Port After 7 Days: What It Means ... by blueseaadmin on Tuesday May 08, 2018 @02:04PM (#17023111)

I recently switched to a 15-character alpha-numeric/special characters passcode after reading an article by a security researcher.

A snippet from that article:

iOS estimated passcode cracking times (assumes random decimal passcode + an exploit that breaks SEP throttling):

4 digits: ~13min worst (~6.5avg) 6 digits: ~22.2hrs worst (~11.1avg) 8 digits: ~92.5days worst (~46avg) 10 digits: ~9259days worst (~4629avg)

[ Parent | on HN ]

Re:iOS 11.4 to Disable USB Port After 7 Days: What It Means ... by DavideNL on Tuesday May 08, 2018 @02:53PM (#17023643)

source: https://twitter.com/matthew_d_green/status/98588500154278297...

[ Parent | on HN ]

Re:iOS 11.4 to Disable USB Port After 7 Days: What It Means ... by thisacctforreal on Wednesday May 09, 2018 @02:24AM (#17027769)

These are easy to calculate, the iOS whitepaper[0] specifies that it uses a PBKDF2 iteration count tuned for 80ms.

The passcode is 'entangled' with a per-device 'UID' that only exists in silicon, not accessible by any firmware.

It seems that the current GrayKey attacks are closer to ~1s/guess.

My last post on the topic: https://news.ycombinator.com/item?id=16833802

[0] Page 15 https://www.apple.com/business/docs/iOS_Security_Guide.pdf

[ Parent | on HN ]

Re:iOS 11.4 to Disable USB Port After 7 Days: What It Means ... by bogomipz on Wednesday May 09, 2018 @06:22AM (#17028732)

What is SEP throttling?

[ Parent | on HN ]

Re:iOS 11.4 to Disable USB Port After 7 Days: What It Means ... by r00fus on Wednesday May 09, 2018 @02:15PM (#17032324)

I believe SEP = Secure Enclave Processor - iOS has it throttle passcode input requests. Visibly this results messages like "iPad is Disabled. Try again in 5 minutes".

I'm not sure how GrayKey bypasses this...

[ Parent | on HN ]

Re:iOS 11.4 to Disable USB Port After 7 Days: What It Means ... by bogomipz on Thursday May 10, 2018 @09:29AM (#17038621)

Ah OK sure. Interesting that the rate limiting is done at the hardware layers and not the the OS.

[ Parent | on HN ]