Oliver Haslam·

iOS 10.3.3 Bug Allows A $500 Box To Crack iPhone Passcode, Apple Says It’s Patched In iOS 11

Hacking iPhones is a complicated business, just ask the FBI about that. Apple famously refused to help law enforcement gain access to an iPhone in order to aid investigations into a shooting, leading to months of discussion as to whether Apple was in the wrong or not.

Since then, Apple has continued to take security of its iPhones very seriously, so it is particularly interesting to see that a relatively simple $500 box of tricks can gain access to certain iPhones while retaining all data that was previously on them.

The news comes via YouTuber EverythingApplePro who got his hands on the box not expecting it to work. As it turns out, not only does the device work but it actually works really well indeed while also being able to access not just one but three iPhones simultaneously. The magic happens, according to the YouTuber, thanks to the way iOS handles upgrades and downgrades, with the box able to brute-force a passcode during the phone’s data recovery state. As is claimed, due to a bug in certain newer firmwares like iOS 10.3.3, there is no limit on the number of passcode attempts that are allowed, meaning a brute force attack is viable. This wasn’t possible on older firmwares.

The hack only works with the iPhone 7, iPhone 7 Plus and certain iPhone 6 and 6s models. It requires a computer to upgrade or downgrade the device to iOS 10.3.3 and, of course, that box of tricks as well as some time – brute-forcing a passcode can take a matter of days or weeks depending on the complexity of the passcode being used.

TechCrunch has a different explanation of the exploit used here, with the bug involved claimed to be one that allows rapid, repeated passcode attempts on iOS 10.3.3 for a limited time after the passcode of the device has been changed. Once that time has passed, a significant delay is added between attempts.

Of course, the existence of such a hack could still potentially allow law enforcement to gain entry to a device in a way they may previously have been unable to, though Apple has confirmed that the flaw has been patched starting from iOS 11 beta 4 and onwards.

(Source: TechCrunch, EverythingApplePro [YouTube])

You may also like to check out:

You can follow us on Twitter, add us to your circle on Google+ or like our Facebook page to keep yourself updated on all the latest from Microsoft, Google, Apple and the Web.