Law Enforcement Agencies Purchase GrayKey Device to Unlock iPhones

[Prorootect]

Content source

https://www.westernjournal.com/law-enforcement-agencies-purchase-device-to-unlock-iphones/

Law Enforcement Agencies Purchase GrayKey Device to Unlock iPhones
on westernjournal.com
By Becky Loggia

In what some might call a breach of security, law enforcement officials have been investing in a cost-effective device capable of unlocking any iPhone.
According to Digital Trends, the arduous task of getting into a locked iPhone may be a thing of the past for authorities, as a device called GrayKey has hit the markets.
A small grey box with only two lightning cables that look similar to antennae, GrayKey is used by two iPhones simultaneously as one device gathers information about the other in just over two minutes.
Though the locked device is not immediately unlocked upon connection, it is only a short while later that the phone will display a black screen with the passcode and other gleaned information.
The whole process takes roughly between two hours to a few days to complete — a stark contrast to past instances where authorities would have to use third-party vendors such as Cellebrite.
Though how it goes about unlocking devices is still largely unknown, Cellebrite requires the device to be sent to their facility as well as charging a minimum fee of $5,000 per device — a hefty, if not time-consuming process for authorities who are trying to solve crimes such as the San Bernadino shooter case.

During the investigation of the shooting that left 14 dead, many people decried Apple’s alleged “aiding and abetting a felony” by refusing to generate backdoor access to FBI agents.
The case was ultimately dropped as authorities turned to Cellebrite, an Israeli company that services law enforcement by unlocking iPhones and other devices.

GrayKey — developed by an Atlanta-based company called Grayshift — is thought to usher in a new era in iPhone unlocking technology and is specifically meant for law enforcement officials or other labs.
Unencrypted details about the iPhone once it is unlocked are also downloaded to the GrayKey device, where they can be further scrutinized by authorities either on a computer or another resource as a downloaded file.

The options for a limited $13,000 or $15,000 device and even a $30,000 device that requires no internet and is unlimited, are cheap alternatives to companies such as Cellebrite, who charged authorities $900,000 to unlock the San Bernadino shooter’s iPhone.
Some sites such as Malwarebytes Labs, warn of the implications it might set up for those with ill-intent.
“What happens if the GrayKey becomes commonplace in law enforcement?” wrote Thomas Reed for Malwarebytes. “The cheaper model isn’t much of a danger if stolen—unless it’s stolen prior to setup.”
Reed states that the unlimited model could be pocketed “fairly easy” and that, once it was off-site, could continue to work for whoever used it, leaving many opportunities for it to be sold on the black market.
“Most people probably won’t get too excited about a criminal’s phone or data,” he added. “However, let’s keep in mind one of the fundamental principles of the US judicial system: suspects are innocent until proven guilty.
“Should suspects be susceptible to these kinds of searches by law enforcement?”

 

[Deleted member 65228]

If you want to learn more about how it works, assuming you get the phone back after...

1. Find a new iOS kernel vulnerability which is applicable
2. Exploit the vulnerability to give you kernel code execution (e.g. shell-code)
3. Use the shell-code execution to setup a rootkit
4. Track as many APIs as possible (e.g. build a call stack history with parameter details)
5. Gain persistence

Now the tricky part here is you'd need to somehow get it binded to the boot process without it being obvious... With the persistence, and early on too. And hijacking the boot sector might be a bit too exposed and obvious. iBoot source was recently leaked and while it is an old version it is probably still beneficial one way or another.

Now send the phone to them to extract data and hope that it will cause the device to boot properly and that the rootkit will still function while their cracking device is used. At-least now if they were to be using the actual phone to execute commands then when you get the phone back and do forensics on the call stack and parameter details it might give you a lead on how their vulnerability works (if they even have one being exploited).

I mean it might be a really crap idea and might not work but it might. Who knows.