Update: Apple has provided me with the following statement, which should close the door on speculation surrounding this purported exploit:
"The recent report about a passcode bypass on iPhone was in error, and a result of incorrect testing"
Yesterday, a security researcher reported on a possible brute-force passcode attack that affected iPhone and iPad. The researcher seems to have disclosed the discovery to Apple, though it's unclear whether he waited for Apple to confirm and fix it — or refute it — before going public.
ZDNet summed it up this way:
An attacker can send all the passcodes in one go by enumerating each code from 0000 to 9999 in one string with no spaces. Because this doesn't give the software any breaks, the keyboard input routine takes priority over the device's data-erasing feature, he explained. That means the attack works only after the device is booted up, said Hickey, because there are more routines running.
When stories come out about "hackers" and Apple getting "black eyes", it should give us all pause. Security is seldom simple and sensationalism is ultimately a attention-exploit, even and especially when it's used to report on vulnerabilities.
In this specific case, it looks like the pause was well warranted. Turns out, the "hack" might not have been what it first seemed.
The original reseacher, on Twitter:
In other words, iOS might have been treating the no-space strings as single attempts rather than serial attempts, and thus not counting them towards the usual brute force mitigations (including forced delays and device deletion, if enabled.)
And because they're being treated that way, they may not have any advantage over single string attempts anyway.
Long story slightly less long: It's still being looked into by the original researcher, others in the information security space, and no doubt Apple as well.
Right now, as far as I can tell, no one has been able to reproduce it, internally or externally, but we'll have to wait and see what the actual facts are when everything has been tested and all the infosec dust has settled.
In the meantime, stay informed but don't let anyone make you afraid.
Satechi's new magnetic charging cable latches onto iPhone 12 like MagSafe
Satechi is showing that Apple isn't the only one that can make a magnetic charger.
Review: Razer's Hammerhead Pro earbuds are AirPods Pro for gamers
Razer is best known as a gaming brand, but it's been moving into more regular lifestyle products lately. The Hammerhead True Wireless Pro earbuds are the brand's answer to AirPods Pro, so how does it hold up?
Review: DJI's Pocket 2 is my perfect external camera
With the Pocket 2, you can head for the hills and leave your SLR camera behind, while still capturing high-quality video and photos.
Keep your hands free and your eyes on the road with a magnetic car mount!
While texting and driving is dangerous, navigating your way around town is essential. Make sure you do it safely by getting a car mount and there's likely no easier car mount solution for your phone than a magnetic mount. These are the best of the best!