<story><title>Instructions show how cops use GrayKey to brute force iPhones</title><url>https://www.vice.com/en/article/k7835w/how-to-brute-force-iphones-graykey</url></story><parent_chain><item><author>TwoBit</author><text>I once had auto reset enabled on my phone after 10 attempts, and then somehow while it was in my gym bag it proceeded to accidentally get buttons pressed and reset itself. Better to set that number to 1000 instead of 10.</text></item><item><author>gjsman-1000</author><text>Quote from Apple Platform Security &amp;gt; Hardware Security &amp;gt; Secure Enclave:&lt;p&gt;&amp;quot;Devices first released in Fall 2020 or later are equipped with a 2nd-generation Secure Storage Component. The 2nd-generation Secure Storage Component adds counter lockboxes. Each counter lockbox stores a 128-bit salt, a 128-bit passcode verifier, an 8-bit counter, and an 8-bit maximum attempt value. Access to the counter lockboxes is through an encrypted and authenticated protocol.&lt;p&gt;Counter lockboxes hold the entropy needed to unlock passcode-protected user data. To access the user data, the paired Secure Enclave must derive the correct passcode entropy value from the userʼs passcode and the Secure Enclaveʼs UID. The user’s passcode can’t be learned using unlock attempts sent from a source other than the paired Secure Enclave. If the passcode attempt limit is exceeded (for example, 10 attempts on iPhone), the passcode-protected data is erased completely by the Secure Storage Component.&amp;quot;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;support.apple.com&amp;#x2F;guide&amp;#x2F;security&amp;#x2F;secure-enclave-sec59b0b31ff&amp;#x2F;1&amp;#x2F;web&amp;#x2F;1&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;support.apple.com&amp;#x2F;guide&amp;#x2F;security&amp;#x2F;secure-enclave-sec5...&lt;/a&gt;</text></item><item><author>gjsman-1000</author><text>Of notable curiosity not mentioned by VICE, but Apple actually modified their A12, A13, and A14 (I believe) CPUs &lt;i&gt;while still in production&lt;/i&gt; to have a new second-generation Secure Enclave embedded within them sometime around Fall 2020. We don&amp;#x27;t know the full extent of the changes, but it sounds like the 2nd-generation enclave comes with much stronger hardware-based rate limiting on PIN code guessing through a &amp;quot;mailbox&amp;quot; system.&lt;p&gt;For me, that means I have my eyes all on whether an iPhone 12, iPhone 12 Pro, or (new) iPhone SE 2nd Gen get hacked. Right now the highest confirmed GrayKey hack is an iPhone 11, which wouldn&amp;#x27;t have the change. We&amp;#x27;ll see whether Apple got them this time.</text></item></parent_chain><comment><author>gruez</author><text>How&amp;#x27;s that even possible? AFAIK after the first few attempts there&amp;#x27;s an exponentially increasing lockout time between passcode attempts, so the random button pressings would have to persist for a long time for it to reach 10 attempts.</text></comment>
<story><title>Instructions show how cops use GrayKey to brute force iPhones</title><url>https://www.vice.com/en/article/k7835w/how-to-brute-force-iphones-graykey</url></story><parent_chain><item><author>TwoBit</author><text>I once had auto reset enabled on my phone after 10 attempts, and then somehow while it was in my gym bag it proceeded to accidentally get buttons pressed and reset itself. Better to set that number to 1000 instead of 10.</text></item><item><author>gjsman-1000</author><text>Quote from Apple Platform Security &amp;gt; Hardware Security &amp;gt; Secure Enclave:&lt;p&gt;&amp;quot;Devices first released in Fall 2020 or later are equipped with a 2nd-generation Secure Storage Component. The 2nd-generation Secure Storage Component adds counter lockboxes. Each counter lockbox stores a 128-bit salt, a 128-bit passcode verifier, an 8-bit counter, and an 8-bit maximum attempt value. Access to the counter lockboxes is through an encrypted and authenticated protocol.&lt;p&gt;Counter lockboxes hold the entropy needed to unlock passcode-protected user data. To access the user data, the paired Secure Enclave must derive the correct passcode entropy value from the userʼs passcode and the Secure Enclaveʼs UID. The user’s passcode can’t be learned using unlock attempts sent from a source other than the paired Secure Enclave. If the passcode attempt limit is exceeded (for example, 10 attempts on iPhone), the passcode-protected data is erased completely by the Secure Storage Component.&amp;quot;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;support.apple.com&amp;#x2F;guide&amp;#x2F;security&amp;#x2F;secure-enclave-sec59b0b31ff&amp;#x2F;1&amp;#x2F;web&amp;#x2F;1&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;support.apple.com&amp;#x2F;guide&amp;#x2F;security&amp;#x2F;secure-enclave-sec5...&lt;/a&gt;</text></item><item><author>gjsman-1000</author><text>Of notable curiosity not mentioned by VICE, but Apple actually modified their A12, A13, and A14 (I believe) CPUs &lt;i&gt;while still in production&lt;/i&gt; to have a new second-generation Secure Enclave embedded within them sometime around Fall 2020. We don&amp;#x27;t know the full extent of the changes, but it sounds like the 2nd-generation enclave comes with much stronger hardware-based rate limiting on PIN code guessing through a &amp;quot;mailbox&amp;quot; system.&lt;p&gt;For me, that means I have my eyes all on whether an iPhone 12, iPhone 12 Pro, or (new) iPhone SE 2nd Gen get hacked. Right now the highest confirmed GrayKey hack is an iPhone 11, which wouldn&amp;#x27;t have the change. We&amp;#x27;ll see whether Apple got them this time.</text></item></parent_chain><comment><author>pueblito</author><text>Or someone tried to access your phone while you were away</text></comment>