When "USB restricted mode" appears on iOS 11.4, if you leave the terminal for 7 days, data communication will be disabled and access by the investigative agency will be restricted

ByWilliam Hook

In iOS 11.4 which is supposed to be released during May 2018, it seems that major changes will be added in security related. Russian companies providing security softwareElcomsoftAs a result of the investigation, we report that "When the iOS terminal with iOS 11.4 installed is not unlocked for 7 days, the Lightning terminal becomes dedicated for charging and data communication is impossible".

iOS 11.4 to Disable USB Port After 7 Days: What It Means for Mobile Forensics | ElcomSoft blog
https://blog.elcomsoft.com/2018/05/ios-11-4-to-disable-usb-port-after-7-days-what-it-means-for-mobile-forensics/

iOS 11.4 Disables Lightning Connector After 7 Days, Limiting Law Enforcement Access - Mac Rumors
https://www.macrumors.com/2018/05/08/ios-11-4-usb-restricted-mode/

According to contents published by Elcomsoft on the blog, "USB Restricted Mode"The function called literally is implemented as a mode that restricts USB function. Once this mode is enabled, no data communication via the Lightning cable is available and the Lightning connector is dedicated for charging.

The condition to activate this mode is "The iPhone or iPad on which iOS 11.4 was installed is locked for 7 days without being unlocked", but according to Elcomsoft, this condition is "continuous 7 Over the daysUnlock using passcode is not doneOr "Is it continuous for 7 daysUnlocking by biometric authentication such as passcode and Touch ID or Face ID is not doneOr "Or for 7 consecutive daysThe Lightning cable is not connected to an authenticated USB device or PC / MacIt is still unclear as to whether or not it is. According to the results tested by Elcomsoft, it has been confirmed that the Lightning terminal became dedicated for charging when the unlocked situation continues for seven days.

ByKārlis Dambrāns

Even for terminals that once entered the USB limit mode, they will return to their original state if the owner unlocks by entering passcode etc. According to Elcomsoft, this feature was implemented once at the stage of iOS 11.3 Beta version, but it seems that it was deleted at the time the genuine version was released.

In addition to the merit of lowering the risk of data leakage at the time of terminal loss or the like, this function is also considered to aim at restricting access to data stored by iPhone by government and investigation institutions . In the United States, there is continuing intercourse between the protection of data between Apple and the investigation agency, and to the Apple that gives top priority to the user's data protection, the US government and FBI issue an unlocking system "GrayKeyIntroduction of Japanese subsidiary company Sun electronic "Cellebrite"We are taking countermeasures such as unlocking the terminal with the cooperation of.


"USB restricted mode" is also seen as a function to block a system such as GrayKey from accessing the inside of the terminal via the Lightning cable, which makes Apple's stance on user data protection clearer It seems to be said. It is still unknown whether or not iOS 11.4 will actually appear on the regular version, but some users who saw this news said, "The period of seven days is too long, even for a day, or for several hours for me Some people gave a comment saying "It's enough."