British security firm IT-Governance, through Neil Ford, reports that a new device is on the market (IP Box) that claims to be able to crack an iPhone's PIN in less than 17 hours. The video presented by the website shows how anyone can easily brute-force an iOS lockscreen.
The video was made by another security company called MDSec, which tested the device in its labs. It confirmed that the device can indeed crack an iPhone's four-digit PIN. The tiny device can be purchased online for less than $250. It will take a little over half a day to crack a password, according to MDSec, which believes the device exploits a known security vulnerability in iOS 8.1 (CVE-2014-4451).
"Further investigation suggests that it could be the issue detailed in vulnerability CVE-2014-4451, but this has not yet been confirmed," Neil Ford says in his detailed article about the IP Box device, which is apparently used by many phone repair shops.
"We plan to test the same attack on a device running 8.2 and will keep you updated on our progress. In the meantime, our advice to everyone is to make sure they are using a fairly complex password on their device and not a PIN."
We know that the iPhone will shut down after 10 failed PIN-cracking attempts, but the IP Box bypasses this by shutting down the iPhone after each failed PIN attempt. iPhones running iOS 8.1.1 or later are not affected by the vulnerability at the time of writing.
IP Box also works on iPads. Therefore, we recommend that you upgrade to the latest version of the operating system immediately.
More details, with images and videos can be found in the MDSec.
Source: secnews.gr
