Following the revelations that law enforcement agencies have been gaining access to GrayKey tool, which allows them to gain unauthorised accessed into iPhones, it looks like Apple is putting in restrictions within iOS. With these restrictions Apple is closing the iOS vulnerability that allows such tools to use brute forcing techniques to unlock iPhones.
According to Elcomsoft, with iOS 11.4 software update, which is currently been beta tested Apple is adding a USB Restricted Mode to iPhones. With this mode the Lightning port’s USB connection mode will be disabled automatically if user has not unlocked the device in the last 7 days. Once USB Restricted Mode has been activated Lightning port will only be able to recharge the device, while the data connections will only be established after the device has been unlocked with a passcode.
Since brute forcing tools like GrayKey use the USB Lightning port to enter thousands of passcode combinations to find the right one, they will no longer be able to communicate with the device once this mode has activated. While this new mode will severely limit the use of brute force tools on iOS devices, tools like GrayKey box will still be able to brute force within first 7 days of device not being unlocked.
Elcomsoft is not sure about when exactly the USB Restricted Mode is activated.
At this point, it is still unclear whether the USB port is blocked if the device has not been unlocked with a passcode for 7 consecutive days; if the device has not been unlocked at all (password or biometrics); or if the device has not been unlocked or connected to a trusted USB device or computer.
In our test, we were able to confirm the USB lock after the device has been left idle for 7 days. During this period, we have not tried to unlock the device with Touch ID or connect it to a paired USB device. What we do know, however, is that after the 7 days the Lightning port is only good for charging.
It will be interesting to see if Apple keeps the Restricted Mode activation limited to 7 days or allows users to choose a shorter span of time based on their individual needs.
