A security researcher has demonstrated in a video that it is very easy to hack into a device running on iOS by bypassing the 6-digit passcode. He found a way to dodge the bypass security limits set by Apple and the glitch allowed him to enter as many passcodes he wanted until he got the correct combination. On the revelation of the glitch, Apple has said that the result achieved by the researcher was due to incorrect testing.
In a video, Matthew Hickey, a security researcher and co-founder of cybersecurity firm Hacker House, used an iPhone running on the latest version of iOS 11.3 to demonstrate the method. For those who don’t know, Apple has set the passcode entering limit to 10 and beyond ten wrong passcodes, the device is set to erase its contents for security purpose. Hickey connected the device with a computer and sent keyboard inputs to trigger an interrupt request, which took priority over anything else on the device.
"Instead of sending passcode one at a time and waiting, send them all in one go. If you send your brute-force attack in one long string of inputs, it'll process all of them, and bypass the erase data feature," he explained.
Hickey claimed that he was able to send all combinations of a user's possible passcode in one go (by cataloging each possible code from 0000 to 9999) in one string with no spaces. He explained that since “no spaces” doesn't give the software any breaks, the keyboard input takes priority over the iPhone's data-erasing feature.
To this revelation, Apple spokesperson Michele Wyman said, "The recent report about a passcode bypass on iPhone was in error, and a result of incorrect testing." It was not detailed what was wrong with the method, but it is clearly seen in the video that a hacker can easily bypass the phone security if he or she wants to.
This is not the first time that someone has bypassed iPhone’s security.The Federal Bureau of Investigation (FBI) in 2016 successfully hacked into the encrypted Apple iPhone 5C of Syed Farook, one of the terrorists who had planned and executed the December 2, 2015 shooting killing 14 people in San Bernardino, California.
To restrict any methods which put iPhone users’ security in jeopardy, in its forthcoming general iOS release, Apple will introduce USB Restricted mode, a patch to shut the tool known as GrayKey, or any other method, that has empowered police and/or criminals to unlock the dormant iPhones by dodging the disk encryption.
In a statement to Reuters, Apple had said the roll out of the update is aimed at protecting all its customers, “especially in countries where phones are readily obtained by police or by criminals with extensive resources.” The company said it will change default settings in the iOS to cut off communication through the USB port when the phone has not been unlocked in an hour.
Apparently the USB port is the place where the forensic agencies and, in this case the security researcher, connected the iPhone to sidestep the security provisions that limit the number of password attempts that can be made to unlock the device before it freezes. With this update, the agencies will not be able to open iPhones one hour after the device has stayed locked.
So it is clear that users who will update to iOS 12 will be safe but the next big update releases in September. It is still not known if Apple will release a security patch for this vulnerability in next iOS 11.XX series.