In recent years, security researchers and hackers have been at war with Apple as they try to develop new ways to bypass iPhone security. Earlier this year, a new challenge came to the company in the form of an iPhone unlocking device called GrayKey, which is used by law enforcement agencies.
The latest iOS security challenge, however, was posed by a security researcher, Matthew Hickey, who has found a method to bypass the 10 passcode attempt limit that an iPhone allows.
For those who don't know, the iPhones we use allow a limited number of unsuccessful login attempts before Apple's security app is activated, which scans the device and erases its data forever. This is the primary measure that prevents hackers and police from easily gaining access to a device.
The recent attack is able to bypass the limited attempts limit even on iPhones running the latest versions of iOS. "An attacker simply needs a powered-on, locked phone and a Lightning," Hickey told ZDNet.
Using a computer and a Lightning cable, he found a way to enter as many passwords as possible. Instead of trying to enter one password at a time, which triggers Apple's security app, he sends all the passwords at once. In other words, a hacker can generate all the possible combinations and pass them along in the form of a string without spaces.
It has also posted a demonstration video online of the attack in action. More precise details of the attack have been shared with Apple, and it is expected that there will be a patch for this issue in the upcoming iOS 12 release. It is also unknown whether GrayKey uses a similar technique to unlock an iPhone.
https://vimeo.com/213826444
