Update: Apple has provided me with the following statement, which should close the door on speculation surrounding this purported exploit:
Yesterday, a security researcher reported on a possible brute-force passcode attack that affected iPhone and iPad. The researcher seems to have disclosed the discovery to Apple, though it's unclear whether he waited for Apple to confirm and fix it — or refute it — before going public.
ZDNet summed it up this way:
When stories come out about "hackers" and Apple getting "black eyes", it should give us all pause. Security is seldom simple and sensationalism is ultimately a attention-exploit, even and especially when it's used to report on vulnerabilities.
In this specific case, it looks like the pause was well warranted. Turns out, the "hack" might not have been what it first seemed.
The original reseacher, on Twitter:
It seems @i0n1c maybe right, the pins don't always goto the SEP in some instances (due to pocket dialing / overly fast inputs) so although it "looks" like pins are being tested they aren't always sent and so they don't count, the devices register less counts than visible @AppleIt seems @i0n1c maybe right, the pins don't always goto the SEP in some instances (due to pocket dialing / overly fast inputs) so although it "looks" like pins are being tested they aren't always sent and so they don't count, the devices register less counts than visible @Apple— Hacker Fantastic (@hackerfantastic) June 23, 2018June 23, 2018
In other words, iOS might have been treating the no-space strings as single attempts rather than serial attempts, and thus not counting them towards the usual brute force mitigations (including forced delays and device deletion, if enabled.)
And because they're being treated that way, they may not have any advantage over single string attempts anyway.
Long story slightly less long: It's still being looked into by the original researcher, others in the information security space, and no doubt Apple as well.
Right now, as far as I can tell, no one has been able to reproduce it, internally or externally, but we'll have to wait and see what the actual facts are when everything has been tested and all the infosec dust has settled.
In the meantime, stay informed but don't let anyone make you afraid.
Master your iPhone in minutes
iMore offers spot-on advice and guidance from our team of experts, with decades of Apple device experience to lean on. Learn more with iMore!
Rene Ritchie is one of the most respected Apple analysts in the business, reaching a combined audience of over 40 million readers a month. His YouTube channel, Vector, has over 90 thousand subscribers and 14 million views and his podcasts, including Debug, have been downloaded over 20 million times. He also regularly co-hosts MacBreak Weekly for the TWiT network and co-hosted CES Live! and Talk Mobile. Based in Montreal, Rene is a former director of product marketing, web developer, and graphic designer. He's authored several books and appeared on numerous television and radio segments to discuss Apple and the technology industry. When not working, he likes to cook, grapple, and spend time with his friends and family.