Think your multi-digit iPhone passcode is safe? Think again. New research from a Cambridge computer scientist has shown that, with just a few cheap components, an iPhone passcode can be hacked with relative ease.
Dr Sergei Skorobogatov from the University of Cambridge has built a bypass rig that can unlock iPhones by cloning the smartphone's memory.
Removing the Nand chip in an iPhone 5C, the device's main memory storage element, Skorobogatov figured out how the component communicated with the rest of the phone. With this piece of the puzzle, Skorobogatov was able to build an external chip board on which he could clone the Nand chip - effectively resetting pin access attempts every time a cloned Nand replaced the last one used.
You can see the hack in action in the video below:
San Bernardino connection
Skorobogatov focussed on the iPhone 5C specifically as it had been at the heart of a terrorism investigation from the FBI.
Syed Rizwan Farook and his wife Tashfeen Malik shot and killed 14 people in December of 2015 in San Bernardino, California. They too were shot and killed by law enforcement officers on the scene. The FBI believed that the shooters' iPhone 5C held information relating to other terrorist cells, but Apple refused to unlock the phone.
This led the FBI to spend $1m on security contractors to break the code. Skorobogatov believed this, worryingly, could have been done far cheaper - and proved his point with the £75 / $100 kit he built, disproving FBI director James Comey's belief that such a system couldn't work.
It was a relatively fast process for Skorobogatov. Cracking a four digit code took around 40 hours of work, while a six digit code could conceivably take hundreds of hours. But given the resources of the FBI, a large scale application of the hack technique could feasibly unlock another phone far more quickly.
Though Skorobogatov has directed his attentions on the iPhone 5C, he's suggested that newer iPhones, like the iPhone 6, could be equally vulnerable. He couldn't however speak for the latest iPhones, such as the iPhone 7 and iPhone 7 Plus, which may have been developed with different security systems in place.
