FBI reportedly accessed locked iPhone 11 Pro Max with GrayKey third party tool

AppleInsider

The FBI recently cracked the encryption of Apple's latest and greatest iPhone 11 Pro Max, a report said Wednesday, prompting questions as to why the agency is demanding the company assist in accessing two older iPhone models as part of a high-profile case.

GrayKey device. | Source: MalwareBytes

In 2019, FBI investigators working on a case in Ohio were tasked with executing a search warrant on property owned by Baris Ali Koch, reports Forbes. Among the items seized was a locked iPhone 11 Pro Max that, according to the report, investigators subsequently accessed without Apple's help.

Koch stands accused of misprision of a felony for helping his convicted brother flee the U.S. by providing a duplicate driver's license and lying to federal agents. He is currently awaiting sentencing.

As part of the investigation into Koch, FBI personnel on Oct. 11, 2019, acquired the suspect's iPhone 11 Pro Max which, according to Koch's lawyer, Ameer Mabjish, was locked and protected by a passcode. Mabjish confirmed to Forbes that no passcode was furnished to authorities, nor was Koch forced to unlock the iPhone via Face ID authentication.

Interestingly, a search warrant filed on Oct. 30 reveals the FBI has in its possession a USB drive containing "GrayKey derived forensic analysis" of the iPhone in question. Produced by startup Grayshift, GrayKey is a data forensics tool that enables law enforcement agencies to thwart iPhone security protocols for purposes of data extraction.

While not specified in the Oct. 30 search warrant, the report suggests the FBI successfully deployed GrayKey to gain access to Koch's iPhone 11 Pro Max.

If officials were indeed able to crack Apple's latest iPhone security safeguards, it is possible that the FBI and other agencies have a means to access the much older iPhone 5 and iPhone 7 Plus handsets involved in more recent case.

Last week, the FBI asked Apple for assistance in "unlocking" two iPhones owned by Mohammed Saeed Alshamrani, a Saudi Air Force cadet accused of killing three sailors and injuring eight others in an attack at the Naval Air Station in Pensacola, Fla., in December. The situation escalated quickly, with Attorney General Bill Barr putting out a public plea for Apple's compliance on Monday, while President Donald Trump slammed the company for its stance on strong device encryption a day later.

The Department of Justice claims it has exhausted all internal and external options, meaning Apple's expertise is the only path forward. Officials refuse to enumerate exactly what methods were attempted.

While Apple has cooperated with FBI requests by handing over user data like iCloud backups and account information, it has declined to extract data from Alshamrani's iPhone as doing so would necessitate the creation of a backdoor. The tech giant is staunchly opposed to such action as it would purportedly threaten the security of all iPhone users.

Pundits speculate Trump, Barr and the DOJ are using the Pensacola case to rope Apple into a precedent-setting legal fight over encryption. Apple faced a similar court battle in 2016 when it refused to unlock an iPhone 5c used by the San Bernardino shooter. In that case the DOJ threatened a showdown but pulled out at the eleventh hour after finding a third party contractor capable of extracting data from the device.

That said, the DOJ might be telling the truth. Apple could have identified and patched the vulnerabilities GrayKey leveraged to break iPhone 11 Pro Max encryption in the intervening months since Koch's iPhone was seized. Alternatively, GrayKey could be in possession of an exploit that applies only to newer model handsets, though such a scenario is unlikely given Apple's encryption architecture.

In any case, Apple is reportedly preparing for a legal scrum as it simultaneously works to keep the issue out of court.

lkrupp

You know what? I don't believe in "reports" anymore. It's all anonymous, uncorroborated speculation. Then "journalists" take it and run with it as if it's the gospel truth, and build a fantasy truth around it. Bottom line, it's complete bullshit. Maybe the FBI cracked the "latest and greatest" iPhone and maybe they didn't. Maybe this is all propaganda by god knows who to make a point. We don't know. And now the Asshole in Chief is trashing Apple once again. And Apple tech blogs take the bait every damn time.

wood1208

Probably conspiracy theory to bring AAPL stock down. No Problem. I will buy some.

MplsP

"Pundits speculate Trump, Barr and the DOJ are using the Pensacola case to rope Apple into a precedent-setting legal fight over encryption"

If the above reports are true then this could well be the case and would be my guess.

bageljoey

AI has been fine, but the regular media has been reporting this like Apple has all his data hidden in their care. Rarely is it explained that what they want Apple to do is create a broken operating system and load it onto the phone. 

I don’t see why any reasonable person would agree to that. 

You know, people can have conversations in their own houses and law enforcement has no way to access the information shared in those conversations after the fact. Maybe they should compel Google to record and store every conversation their devices pick up in case those conversations are needed later...

anantksundaram

Assuming this is true — which is not necessarily a good assumption — it is a bit troublesome that Apple’s vaunted privacy/security protocols are regularly getting violated by third-party nothings. 

rob53

I went to the graykey.grayshift.com website and all that's there is a logon and request for account, nothing more. I'm sure Grayshift isn't going to give Apple access to their equipment but I also have to wonder if Apple would be able to talk someone in the US, or foreign, government to request an account and give Apple the opportunity to check it out (reverse engineer it). Grayshift can go ahead and try to sue Apple over this but Apple should be able to sue Grayshift over it's hacking of Apple devices.

Anyone want to give this a try?

Soli

1) Hopefully I can get my query answered before this thread gets shutdown, but I'm confused by this article. Did they use GrayKey to go through the possible passcode options to UNLOCK the phone through brute force, or did the FBI actually CRACK the iPhone's ENCRYPTION.

2) Why were the other article banned from having open forums but this one is allowed?

SpamSandwich

anantksundaram said:

Assuming this is true — which is not necessarily a good assumption — it is a bit troublesome that Apple’s vaunted privacy/security protocols are regularly getting violated by third-party nothings. 

I’m not sure the story is true. It is Forbes after all.

Soli

anantksundaram said:

Assuming this is true — which is not necessarily a good assumption — it is a bit troublesome that Apple’s vaunted privacy/security protocols are regularly getting violated by third-party nothings. 

If this MalewareBytes blog is correct it's not actually cracking encryption, but doing a brute force attack. This is one reason one should use the alphanumeric passcode option using both special characters and very special characters which brings the complexity to about 220 possible options per character typed.

• https://blog.malwarebytes.com/security-world/2018/03/graykey-iphone-unlocker-poses-serious-security-concerns/

photography guy

The FBI and DOJ have no grounds for harassing Apple to build backdoors or cripple their security strategies if they (FBI/DOJ) can use third party entities to break into someone's iPhone. This is actually a good thing, in that it motivates Apple's security and privacy team to build iteratively more robust security into their devices.

wonkothesane

Maybe the owner of the iPhone 11 max used a simple passcode,like 1-2-3-4: https://www.thewhizcells.com/common-phone-passwords-passwords-not-use/

Arszy

Trumpski has to remember that if he trashes Apple, then that drags down the stock market, if the stock market drops, then he looks bad and that adversely affects his chances of getting re-elected.

seanismorris

Apple needs to take this to the Supreme Court and stop beeping around.  The feds are going to try this blessyou again and again until they’ve established legal precedence.  What they’re demanding is unconstitutional.  Apple is already fulfilling their obligations.

citpeks

photography guy said:

The FBI and DOJ have no grounds for harassing Apple to build backdoors or cripple their security strategies if they (FBI/DOJ) can use third party entities to break into someone's iPhone. This is actually a good thing, in that it motivates Apple's security and privacy team to build iteratively more robust security into their devices.

Like the case in Southern California, this isn't about the facts behind the investigation.  This is a dog and pony show put on for the stupid and gullible (including members of Congress), with the hope that it will somehow lead to a legal precedent or some sort of legislation.

arlor

Malwarebytes further notes that the device appears to combine a jailbreak with the brute force attack, since the brute force attack runs on the iPhone itself. It says it takes up to three days to get a six-character password. It's not clear whether it's testing the full character set from the blog or not. So most likely Koch simply had a relatively short password, as the time for the brute force attack would increase with length and the FBI has no way of knowing exactly how long Alshamrani's password is.

svanstrom

photography guy said:

The FBI and DOJ have no grounds for harassing Apple to build backdoors or cripple their security strategies if they (FBI/DOJ) can use third party entities to break into someone's iPhone. This is actually a good thing, in that it motivates Apple's security and privacy team to build iteratively more robust security into their devices.

It’s a good thing in the same sense that me setting your house on fire is good as it encourages you to build a more fireproof house next.

(At that point you’d probably celebrate the “good” less, and wish your existing fireproofing had actually worked as intended.)

svanstrom

anantksundaram said:

Assuming this is true — which is not necessarily a good assumption — it is a bit troublesome that Apple’s vaunted privacy/security protocols are regularly getting violated by third-party nothings. 

Sadly, at this level bugs are to be expected.

Even though we hear “third party” as if it was any startup, these are often quite serious researchers backed by a lot of monies. And all it takes is one person with one new idea to partially start tearing down walls that used to be secure; then that inspires their whole team to get new ideas.

The collective(s) fighting against Apple makes up quite a challenge for Apple. 

uroshnor

So for a Greykey (or Cellebrite UFED) to extract data;

- the users passcode needs to be short
- if the device is A12 or later, USB restricted mode needs to be disabled previously

Basically, if you have a long passcode, these device won’t get to your data.

So it’s totally possible that the FBI can unlock one device, because it had a short passcode, and not be able to unlock another, because it does.

sjworld

wood1208 said:

Probably conspiracy theory to bring AAPL stock down. No Problem. I will buy some.

You sound so paranoid.

GeorgeBMac

So what would Trump and the minions in His Justice Dept be saying if this happened in China?   O U T R A G E !    And FauxNews would have a field day with it.