New feature in iOS 11.4 designed to prevent law enforcement from unlocking an iPhone

We recently told you about the GrayKey device, which unlocks Apple iPhone models and can even bypass encryption. With two Lightning cables sticking out of the box, this device can crack an iPhone in as quickly as three hours to as long as three days depending on the complexity of the passcode employed. This is obviously a tool that law enforcement agencies love; priced at $15,000 to $30,000, a purchase shouldn't bust the budget of the FBI, CIA and big city police forces like the NYPD. But Apple has come up with a way to possibly thwart the machines made by companies like GrayShift and Cellebrite.

In the latest iOS 11.4 beta, if an iPhone hasn't been unlocked for more than a week using the passcode, the Lightning port will support charging the phone only. No data can be transferred through the port. This feature, called USB Restricted Mode, was originally seen in iOS 11.3 beta, but removed from the final version. Now, it is back, just like some other features that have gone the same route such as AirPlay 2 and Messages in iCloud. And this time, it looks like the feature will make it to the final version of the new iOS build.

USB Restricted Mode works like this. Once an iPhone or iPad is updated to the latest version of iOS that supports the feature, the USB data connection over the Lightning port is disabled one week after the phone was last unlocked. So those two Lighting cables that stick out of the GrayKey would be useless on a iPhone in USB Restricted Mode.

Law enforcement does have a way around this. If it uses a GrayKey in an attempt to unlock the device within the seven days from the last passcode unlocking, it will disable USB Restricted Mode even if it has yet to unlock the phone.


source: ElcomSoft