iPhone and iPad devices are noteworthy for having various security measures that protect them from abuse. Since iOS 8 they have been protected with an advanced encryption algorithm that protects them from being unlocked by hackers. However a security researcher discovered a weakness in the way iPhone and iPad devices handle these operations and was able to create a bypass that overrides the protective measures.
Security Weakness Identified in iPhone and iPad Devices
The user-set encryption of iPhone and iPad devices has been available as a standard feature since version iOS 8 of Apple’s mobile operating system. It has helped protect the iPhone and iPad owners from abuse by setting up a passcode that upon input decrypts the user’s contents and allows use of the devices. Apple’s measures also include a passcode entry limit, if the user enters a wrong code more than 10 times the device’s data is instantly wiped.
Newer devices use a hardware-based component (chip) that is physically isolated from the main processor. This step has been made in order to provide an extra layer of security as access to it is available via another set of commands and services. This component also keeps count of the number of passcode entry attempts. Its algorithm is configured to slow down the password’s entry with each unsuccessful attempt. This system is devised to block automated intrusion attempts.
iPhone and iPad Devices Bypass Revealed
A security override for the encryption engine has been devised by the security researcher Matthew Hickey, co-founder of Hacker House. His technique works even on the latest version of the iOS (11.3). The expert discovered that when an iPhone or iPad device is plugged in every input made from a keyboard is managed with higher priority over other processes. This enables attackers to devise a hardware-based brute force attack by creating a long string of input. The device has been found to enumerate all strings and process them. Effectively this allows the hackers to use a ready-made list of possible inputs or use passcode generators to create custom lists.
While this is a slow approach it is effective when the attackers want to access the devices. It is expected that Apple will patch the issue in the upcoming iOS versions. We expect that similar bypasses will be made in the future as well, as the QA engineers will need to have a way in order to access made devices using such connections.
Martin Beltov
Martin graduated with a degree in Publishing from Sofia University. As a cyber security enthusiast he enjoys writing about the latest threats and mechanisms of intrusion.
Follow Me: