The British security company IT-Governance, through Neil Ford, reports that a new device is circulating on the market (IP Box) that claims it can crack the PIN code of an iPhone in less than 17 hours. The video presented on the website even shows how anyone can easily, with a brute-force attack, breach the iOS lockscreen.
The video was made by another security company called MDSec, which tested the device in its labs. It confirmed that the device can indeed crack an iPhone's four-digit PIN. The tiny device can be purchased online for less than $250. It will take a little over half a day to crack a password, according to MDSec, which believes the device exploits a known security vulnerability in iOS 8.1 (CVE-2014-4451).
“Further research indicates that it could be the issue described in detail in vulnerability CVE-2014-4451, but this has not yet been confirmed,” says Neil Ford in the detailed article about the IP Box device, which is apparently used by many phone repair shops.
“We plan to test the same attack on a device with 8.2 and will keep you updated on our progress. In the meantime, our advice to everyone is to make sure they use a sufficiently complex password on their device and not a PIN.”
We know that the iPhone will shut down after 10 failed PIN “cracking” attempts, but the IP Box bypasses this by shutting down the iPhone after each failed PIN attempt. iPhones running iOS 8.1.1 or later are not affected by the vulnerability at the time of writing.
The IP Box works on iPads. Therefore we recommend you upgrade immediately to the latest operating system version.
More details, with images and videos can be found in the MDSec.
