This palm-sized box can break your iPhone’s password, giving police full access to a device’s file system — messages, photos, call logs, browsing history, keychain and user passwords, and more.
A little-known Atlanta, Ga.-based tech outfit appeared seemingly out of nowhere this month with a bold claim — that it can crack the passcodes on even the most recent iPhones, a feat managed by only a select few.
Grayshift wasn’t widely known until Forbes blew the lid on the company earlier this month — likely because the company’s main clientele are police departments and local law enforcement divisions.
The company is founded by Justin Fisher (whose LinkedIn profile currently only shows he works at a “private company”) and Braden Thomas, a former Apple security engineer, who spent six years at the technology giant from 2006.
But little is publicly known about the company, including its flagship product, GrayKey, a $15,000 unlock tool that promises in marketing materials to be able to obtain the passwords on iPhone 5s devices and newer. The box is said to be able to tap into even the latest iPhone 8 and iPhone X handsets, running the latest iOS 11 software.
That has to hurt the iPhone’s security reputation. Apple has long been seen as a champion of strong device security, including rolling out zero-knowledge device encryption so that even the company can’t be forced to unlock a person’s phone.
The box, small enough to fit in your hand, uses an unknown exploit to guess the device’s password again and again — known as brute-forcing — and to gain access to the iPhone’s encrypted contents.
Apple’s Secure Enclave makes it difficult to brute-force the password on an iPhone by limiting how many times a user can attempt a password unlock. Bypassing that rate limit can vastly speed up the unlocking process.
Security firm Malwarebytes also obtained information on the device and wrote-up a technical post on the technology. Once the box has determined the password, it displays the code on the iPhone screen. Four-digit passcodes can take minutes to a few hours, but six-digit passcodes — now the default on iPhones — can take three days or longer to crack. But that’s still a significantly shorter amount of time than other known phone-cracking techniques.
That password gives the GrayKey operator full access to the device’s file system (messages, photos, call logs, browsing history, keychain and user passwords — everything).
It’s a similar technique that rival firm Cellebrite, an Israeli phone-cracking company, uses to gain access to devices, when hired by law enforcement.
But the price of the box, which is significantly cheaper than Cellebrite’s technology, has police departments around the US scrambling to buy the technology.
According to marketing materials posted by Forbes, police can buy one of two devices. The $15,000-a-year license unlocks 300 devices and requires an internet connection to enforce that limit. That internet connection also locks the device to the network, preventing anyone from using the device on any other network.
