iOS 12 developer beta 4 requires device to be unlocked before connecting any USB accessori...
Your iPhone's Lightning port will be even more locked down come iOS 12, which has adding an additional layer of security in the fourth developer beta.
The change in the latest beta of iOS 12 is building on USB Restricted Mode which disables the Lightning port of an iOS device one hour after last being unlocked. The Lightning port could still be used for charging, but no accessories would be able to function until unlocked.
In the fourth developer beta of iOS 12, a passcode is required any time a computer or USB accessory is connected.
Before the change, authorities or criminals would have an hour since last unlock to connect a cracking device, like the GreyKey box. Now, they don't have that hour, making it that much more difficult to brute force a password attempt into a device.
Users could, in iOS 11.4.1, manually enable USB Restricted Mode by enabling SOS after pressing the side button five times, but now that may no longer be necessary.
USB Restricted Mode recently launched with iOS 11.4.1 as a way to more thoroughly protect the data within iOS devices. Apple has made it clear that they were not creating this security measure solely to make law enforcement live's more difficult but to prohibit anyone from gaining access to a phone that isn't theirs. Any security hole exploited by law enforcement can just as easily be used by a criminal.
The change in the latest beta of iOS 12 is building on USB Restricted Mode which disables the Lightning port of an iOS device one hour after last being unlocked. The Lightning port could still be used for charging, but no accessories would be able to function until unlocked.
In the fourth developer beta of iOS 12, a passcode is required any time a computer or USB accessory is connected.
Before the change, authorities or criminals would have an hour since last unlock to connect a cracking device, like the GreyKey box. Now, they don't have that hour, making it that much more difficult to brute force a password attempt into a device.
Users could, in iOS 11.4.1, manually enable USB Restricted Mode by enabling SOS after pressing the side button five times, but now that may no longer be necessary.
USB Restricted Mode recently launched with iOS 11.4.1 as a way to more thoroughly protect the data within iOS devices. Apple has made it clear that they were not creating this security measure solely to make law enforcement live's more difficult but to prohibit anyone from gaining access to a phone that isn't theirs. Any security hole exploited by law enforcement can just as easily be used by a criminal.
Comments
Interestingly, I didn't notice the change after I updated iOS. Instead, I noticed it after I updated Mac OS this most recent time, though that could just be a coincidence.
While we've all been slinging around the term "USB Restricted Mode" and mostly understand what it means, I fear that less technically savvy iPhone/IPad users are going to be completely oblivious to what the USB Accessories switch is really for. In fact, Apple's placement of a tiny text explanation for the USB Accessories setting beneath the Allow Access When Locked control group is what I'd call an "apology" for what they already know will be a source of confusion to some users. Of the seven (7) controls in the group only one warranted an on-screen apology. I guess we should be happy that none of the other controls required an apology because the UI would be more cluttered. Simplicity is a good thing in a UI model, but there are times when it paints you into a confusing little corner and you have to throw up you're hands and say "I'm sorry" and you have to bend or break the model. This is such a case.
Why not just fix the underlying problem instead; that USB input could circumvent the password entry limits and delays? If the security mechanism is completely embedded in the secure enclave (as it should be), then it shouldn't matter what the source of the password is.
There is something fishy going on here, which wouldn't really bother me if it didn't result in this confusing and hard to explain behavior. Try writing a (somewhat) complete test spec for this...
But it is an attack surface that has proven successful in the past, and fixing newly discovered vulnerabilities will be done, but prevention is a lot more secure as it protects from unknown vulnerabilities as well.