Mar 31, 2015 10:40:00

Threat device 'IP-BOX' that forcibly unlocks the lock screen passcode of iOS devices such as iPhone and iPad

Brute force attack is an attack method that uses a dictionary tool to brute force all combinations of characters even if you do not know the passcode. In the case of the latest electronic devices and services, this attack method is avoided by setting a limit on the number of password authentication failures, and such a mechanism is also incorporated in iOS installed in Apple's iPhone and iPad. However, a threatening device ' IP-BOX ' that circumvents this authentication failure limit and unlocks the iOS passcode by brute force attack has been discovered.

Apple iOS Hardware Assisted Screenlock Bruteforce --MDSec
https://www.mdsec.co.uk/2015/03/apple-ios-hardware-assisted-screenlock-bruteforce/

' IP-BOX ' is a tool used when repairing iOS devices such as iPhone and iPad to break through the lock screen passcode authentication with brute force attack. MDsec , a security-related company, is investigating, thinking that this IP-BOX 'may have a very big meaning in terms of security'.

MDsec seems to have purchased the IP-BOX for 200 pounds (about 36,000 yen), but on the following page it is sold for 250 dollars (about 30,000 yen).

IP-BOX iPhone Password Unlock Tool | Teel Technologies

According to MDsec, IP-BOX is a tool for brute force attacks where you simply enter a 4-digit passcode via USB and try any combination of passcodes. Although it is not unusual in itself, IP-BOX has a function to 'delete passcode input information' every 10 times in order to avoid the 'authentication failure limit' set in iOS. And this is working fine.

It is said that MDsec is still analyzing IP-BOX, but what is already known is that 'IP-BOX connects directly to the Lightning plug of the iOS terminal and intentionally turns off the power of the terminal. The passcode input information is deleted from the memory to avoid the limit on the number of authentication failures. ' Since the power is turned on and off every 10 inputs, it takes about 40 seconds to enter one passcode. It takes a total of 111 hours to brute force all 4-digit passcodes.

Experiments are being conducted to actually unlock the iPhone passcode using the IP-BOX. The IP-BOX is a small black box with the number '1234' displayed on the display.

The board inside the IP-BOX looks like this. Connect to iOS devices such as iPhone and iPad from the USB port on the upper left.

This is an iOS 8 adapter for connecting the board in the iOS device and the IP-BOX.

The iPhone side is being tested with the display removed.

You can see how to actually unlock the passcode of the lock screen of iPhone 5s with iOS 8.1 using IP-BOX in the following movie.

Bruteforcing the iOS Screenlock-YouTube


On the left side of the screen is the iPhone 5s with only the display part removed, and the small black box next to it is the IP-BOX.

For IP-BOX, enter the passcode to the iPhone via USB. In the picture below, '1233' is entered.

It seems that the passcode was wrong, and the iOS 8 adapter inserted in the back of the IP-BOX is shiny.

The iOS 8 adapter is connected to the board inside the iPhone 5s with a red cable.

The passcode seems to be wrong and the iPhone turns off ...

After a while, the restart is complete.

When the clock is displayed on the iPhone lock screen, try entering the passcode again.

Since we are attacking brute force in order, enter '1234' next.

Then the lock screen was released.

If the lock screen is successfully released, the IP-BOX will sound an alarm to let you know that the lock screen has been released successfully.