Probably something like this:

https://en.wikipedia.org/wiki/Grayshift

https://en.wikipedia.org/wiki/Cellebrite

Typed in 4 zeros for the password or borrowed his finger.

Although this statement of course has been made with tongue in cheek, it's worth pointing out that with modern devices borrowing a finger only works if the finger is still warm (which usually translates to the owner of that finger being alive).

microwave?

I suppose that might ruin the fingerprint, but worth a try.

MacGyver would have used a hair dryer.

Is there any reason to suspect that Mr. Crooks had both a non-trivial password, and a model of phone with no physical_access => root weaknesses? My impression so far is that he was a very young, low-skill, and probably impulsive - all of which correlate with swiss cheese infosec.

Both Android and iOS are full of backdoors.

How do you think NGO make their living ?

NGO makes their living because neither of those have back doors. They come up with very complicated exploit chains because the easy attacks are no longer possible.

Android and iOS both have backdoors the US controls. The few capabilities they aren't willingly given by Apple or Google are furnished by third-parties, and the rest of the world has to contend with second-rate data access through persistent exploits. If the US didn't have superior SigInt, they'd be relying on Pegasus to do FIVE-EYES' dirty work. Google and Apple both admit that their information handling is overseen and controlled by the US federal government: https://www.reuters.com/technology/cybersecurity/governments...

> They come up with very complicated exploit chains because the easy attacks are no longer possible.

People say this about every age of computing, though. And then we get a zero-click exploit chain from Pakistan with persistent payload that infects 22,000 modern handsets for 3 months without anyone knowing. I don't think that complexity is the secure savior you make it out to be in this situation.

> Android and iOS both have backdoors the US controls.

Big citation needed for that claim.

> Google and Apple both admit that their information handling is overseen and controlled by the US federal government:

That’s not what that story says.

No reasonable person should trust the security of an iPhone or Android when it comes to state actors. These devices likely offer sufficient protection against common theft, but they are vulnerable to sophisticated attacks from government entities.