{"id":52732,"date":"2016-09-22T09:18:38","date_gmt":"2016-09-22T16:18:38","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=52732"},"modified":"2025-06-02T00:53:27","modified_gmt":"2025-06-02T07:53:27","slug":"hardware-hack-bypasses-iphone-pin-security-counter","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/hardware-hack-bypasses-iphone-pin-security-counter\/","title":{"rendered":"Hardware Hack Bypasses iPhone PIN Security Counter"},"content":{"rendered":"

\"unlocked-phone\"<\/a><\/p>\n

A security researcher from the University of Cambridge has found a way to hack the iPhone NAND memory hardware to sufficiently bypass an important security feature, allowing a brute-force attack against the passcode lock of an iPhone 5C. This is the same lock that\u00a0stymied the FBI as part of the highly publicized privacy case in which\u00a0they demanded Apple create a workaround to access the phone of the San Bernardino, Calif., shooter. Apple refused on ethical grounds and a media frenzy ensued. Ultimately, the FBI dropped the legal case against Apple and reportedly paid $1 million to an unknown security company to unlock the phone.<\/p>\n

Recently a security researcher wrote a paper<\/a> and then built a hacking rig to do the same, for about $100. The iPhone 5C security control in question is one that\u00a0limits the number of attempts to enter an unlocking PIN. After a certain number of attempts, the phone will wait for a long period before allowing another attempt. After 10 attempts the device permanently deletes the encryption keys, making all the data on the phone irretrievable. This check is controlled in the firmware and hardware of the device to prevent a brute-force attack, which is designed to try all combinations. A four-digit pin has 10,000 possible combinations, from 0000 to 9999. Attempts to try even a small number of them will result in the phone quickly being locked and ultimately the data rendered unrecoverable.<\/p>\n