GrayKey Defeats the iPhone's Inactivity Reboot

404Media reports that a cyber-weapons vendor has found a way to bypass an iOS security feature — the one that automatically shifts an iPhone into a more secure state if it hasn't been used for 72 hours. This inactivity reboot keeps some data out of reach until the owner enters the passcode again.

The new technique comes from Magnet Forensics, the company behind GrayKey, a popular tool sold to law enforcement that unlocks iPhones and Android phones and accesses the data stored on them. According to a leaked video, Magnet has rolled out a dedicated device called GrayKey Preserve and an Evidence Preservation Mode feature for its standard GrayKey hardware.

In the clip, a Magnet employee calls the solution "an absolute game changer for iOS forensics" and a capability he wishes he'd had years ago, noting explicitly that it targets the inactivity reboot and the data that reboot locks away.

GrayKey Preserve also takes aim at another iPhone behavior: the automatic deletion of certain data after a set number of days — cached locations, recently deleted photos, and iMessages among them. "We're gonna be able to preserve that data for an infinite amount of time," the representative promises.

Bruce Schneier observes that, now that Apple's engineers know the flaw exists, they can track it down and fix it. He adds, with a dry touch, that AI turns out to be remarkably good at exactly this kind of work.

Source: Schneier on Security