Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

6/25/2018
12:50 PM
50%
50%

iOS Hack Lets Attackers Brute Force iPhone, iPad Passcodes

A vulnerability in Apple's iOS lets anyone with a Lightning cable bypass the passcode entry restriction designed to protect the company's devices.

Any hacker equipped with the right knowledge and a Lightning cable can bypass iOS's passcode entry restriction and break into an iPhone or iPad, researcher Matthew Hickey has discovered.

Hickey, co-founder of Hacker House, found a means of bypassing systemwide encryption and secure enclaves that Apple introduced to block brute-force attacks. Secure enclaves, a hardware security measure built for cryptographic processes and biometric data protection, work with the newest iOS software to delay incorrect passcode attempts. The more times someone enters an incorrect passcode, the longer the iOS blocks future attempts to enter the device.

In a report on ZDNet, Hickey explains how an attacker can bypass this security restriction by connecting the device to a Lightning cable and entering one long string of passcodes via keyboard input. He later reported this works because not all tested passcodes are sent to the secure enclave. Even when 20 or more passcodes are entered, only four or five might be sent to the enclave for testing.

This type of attack may not be usable in iOS 12 when Apple rolls out USB Restricted Mode, a new security measure designed to prevent break-ins by turning the Lightning cable into a charge-only port if the device hasn't recently been unlocked. The update is a source of frustration for digital forensics firms like Grayshift, which claims to have defeated it.

Read more details here.

Why Cybercriminals Attack: A DARK READING VIRTUAL EVENT Wednesday, June 27. Industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Go here for more information on this free event.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
BradleyRoss
50%
50%
BradleyRoss,
User Rank: Moderator
6/28/2018 | 8:11:23 PM
Re: Patch Release...stat
It appears that the specific approach mentioned in this article doesn't work at unlocking the device, although Cellebrite, GrayShift (GrayKey) and a few others have developed hacks that apparently test a passcode and then interrupt the process before the counter of consecutive failed passcodes is incremented.  It would seem to me that the problem could be resolved by incrementing the counter before testing the passcode.  I have doubts about blocking the USB data because I don't think that would really close the vulnerabilities.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/25/2018 | 1:28:12 PM
Patch Release...stat
This needs to be mitigated as soon as possible. This essentially means that if an iDevice is to be stolen a malicious actor can easily pass tons of data without any kind of hindrance to try and get in.
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Deliver a Deadly Counterpunch to Ransomware Attacks: 4 Steps
Mathew Newfield, Chief Information Security Officer at Unisys,  12/10/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19604
PUBLISHED: 2019-12-11
Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.
CVE-2019-14861
PUBLISHED: 2019-12-10
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permiss...
CVE-2019-14870
PUBLISHED: 2019-12-10
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authent...
CVE-2019-14889
PUBLISHED: 2019-12-10
A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence...
CVE-2019-1484
PUBLISHED: 2019-12-10
A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerability'.