Update: Apple has provided me with the following statement, which should close the door on speculation surrounding this purported exploit:
"The recent report about a passcode bypass on iPhone was in error, and a result of incorrect testing"
Yesterday, a security researcher reported on a possible brute-force passcode attack that affected iPhone and iPad. The researcher seems to have disclosed the discovery to Apple, though it's unclear whether he waited for Apple to confirm and fix it — or refute it — before going public.
ZDNet summed it up this way:
An attacker can send all the passcodes in one go by enumerating each code from 0000 to 9999 in one string with no spaces. Because this doesn't give the software any breaks, the keyboard input routine takes priority over the device's data-erasing feature, he explained. That means the attack works only after the device is booted up, said Hickey, because there are more routines running.
When stories come out about "hackers" and Apple getting "black eyes", it should give us all pause. Security is seldom simple and sensationalism is ultimately a attention-exploit, even and especially when it's used to report on vulnerabilities.
In this specific case, it looks like the pause was well warranted. Turns out, the "hack" might not have been what it first seemed.
The original reseacher, on Twitter:
In other words, iOS might have been treating the no-space strings as single attempts rather than serial attempts, and thus not counting them towards the usual brute force mitigations (including forced delays and device deletion, if enabled.)
And because they're being treated that way, they may not have any advantage over single string attempts anyway.
Long story slightly less long: It's still being looked into by the original researcher, others in the information security space, and no doubt Apple as well.
Right now, as far as I can tell, no one has been able to reproduce it, internally or externally, but we'll have to wait and see what the actual facts are when everything has been tested and all the infosec dust has settled.
In the meantime, stay informed but don't let anyone make you afraid.
We may earn a commission for purchases using our links. Learn more.
A big iPad Pro display upgrade is on the way
Ming-Chi Kuo has reiterated previous predictions that Apple will introduce mini-LED display technology into its products as soon as this year, and that the first product to debut the tech will likely be Apple's next iPad Pro.
Apple's 'High Desert' will star Patricia Arquette, directed by Ben Stiller
The new comedy series follows the story of Peggy, a former addict who decides to become a private investigator after her mother dies.
CEO of UK smartphone carrier EE tells employees a 5G iPhone is 'days away'
Marc Allera, CEO of EE, says that a 5G iPhone is "just days away" in a new video shared with the carrier's employees.
Got a new iPad? Deck it out with the best iPad accessories
The best iPad accessories will make your iPad look and work even better. If you've got an 8th-generation iPad (2020), you'll want to scoop up some of the items on this list.