GrayKey iPhone box reportedly no longer able to unlock iOS 12 devices, law enforcement believes

9to5 Staff | Oct 24 2018 - 1:00 pm PT

In 2017, a duo of security specialists: Braden Thomas, former Apple security engineer, and Justin Fisher, senior research scientist at Endgame, formed a highly secretive company known as Grayshift. They began selling a box which promised to unlock any password-protected iPhone.

At a cool $15,000 to $30,000 a pop, GrayKey boxes were generally exclusively marketed and sold to law enforcement agencies and police departments. These boxes assisted in gathering evidence previously left inaccessible behind the security pillars of Touch ID, Face ID and users’ passcodes. However, this failsafe is precisely where Grayshift found the iOS vulnerability it would capitalize on.

By unknown and obviously secretive means, the team was able to circumvent Apple’s traditional passcode limitations, meaning the standard “iPhone disabled. Please try again in [X amount of time]” was not an obstacle anymore.

Unfortunately for Grayshift, this is no longer true.

According to Forbes, corroborated by a police chief, iOS 12 almost totally patches the GreyKey box, effectively rendering them useless (for now).

When Minnesota Police Captain of Rochester, John Sherwin, was asked about if reports regarding iOS 12 patching the GreyKey box from working was true, he said:

That’s a fairly accurate assessment as to what we have experienced.

Those using GrayKey can reportedly still access limited amounts of information, but nothing like what was previously possible.

GrayKey can only do what’s called a “partial extraction,” sources from the forensic community said. That means police using the tool can only draw out unencrypted files and some metadata, such as file sizes and folder structures.

This comes in the midst of Apple doubling down on privacy, with Tim Cooking speaking publicly on the matter recently.

Will Grayshift discover a workaround to continue breaking into iPhones? Or will iOS finally reach a level of security even expert researchers can’t crack? Let’s have a discussion in the comments below…