The “IP Box,” a black box device that manages to gain access to an iPhone running iOS 8.1 by brute-forcing the passcode over a USB connection has been tested by security company MDSec. The device tries every possible 4-digit PIN combination, and is able to bypass the normal 10 attempt lockout.
MDSec, via 9to5Mac:
The IP Box is able to bypass this restriction by connecting directly to the iPhone’s power source and aggressively cutting the power after each failed PIN attempt, but before the attempt has been synchronized to flash memory.
After each attempt, the IP Box measures light levels on the iPhone’s screen to detect whether or not it has gained access to the Home screen. If it hasn’t, it restarts the iPhone quickly enough to avoid updating the PIN entry attempt counter.
An attack of this sort would require physical access to an iPhone, and since it restarts the iPhone after every attempt, 9to5Mac notes that testing every possible PIN combination would take around 111 hours, with an average of around 55 hours to actually gain access.
While this might be feasible with a stolen iPhone, the attacker would also need to be able to prevent the iPhone from gaining any kind of network access, as the owner of the device could use Find My iPhone to remotely wipe it.
9to5Mac notes that Apple was apparently aware of this vulnerability, as the attack does not work as of iOS 8.1.1. (Another good reason to keep current on iOS updates.)
While an attack such as described above is likely not a threat to the average iPhone user, users may want to consider using a complex passcode in the place of the usual 4 digit code. To enable a longer passcode, go to: “Settings” -> “Touch ID & Passcode” and turn off “Simple Passcode.” You’ll be prompted to enter your four digit PIN, and then will be prompted to enter an alpha-numeric password to secure your device.
