GrayKey's mysterious hardware is a valuable tool in the hands of police officers, as it offers them the ability to gain access to most iPhone models currently on the market, including the iPhone X.
The $30,000 device is known to be able to crack a four-digit passcode protecting an iPhone in a matter of hours and a six-digit passcode in 3 days, or – in an ideal scenario – in 11 hours. This is why security experts recommend that iOS users maintain an alphanumeric passcode instead of one made up entirely of numbers.
Regardless of what this black box is capable of, a recent series of events linked to it raises questions about the security of GrayKey itself.
Some unknown hackers managed to obtain the device's code, as the GrayKey source code was exposed for some time earlier this month. Last week, a small piece of code that does not appear to be particularly sensitive was leaked.
The leaked code is believed to be from GrayKey's user interface, where messages and notifications are displayed. GrayShift confirmed the data breach and said in a statement to Motherboard that it was caused by a "network misconfiguration at a customer site."
GrayShift also said that no IPs or data were exposed and has made the necessary changes to prevent unauthorized access to its devices.
In a message sent to GrayShift’s co-founder, the hackers attempted to extort money, demanding a ransom of 2 BTC (about $18,000) to prevent the release of the rest of the source code. However, it is believed that they do not have all of the code in their possession. Furthermore, no transactions have been made on the Bitcoin addresses provided by the attackers for the sale of the source code.
However, this is not the only incident. Motherboard, using the Shodan search engine, found another seemingly exposed GrayKey device leaking code online.
