Cops Can Break into Locked iPhones Now

Summary

The video discusses a reported GrayKey feature that may undermine Apple’s iPhone inactivity reboot security measure.

Inactivity reboot

Reportedly introduced in iOS 18.1, the feature silently restarts an iPhone after 72 hours without interaction. A phone that has been unlocked since its last restart is in After First Unlock (AFU) state. After rebooting, it returns to Before First Unlock (BFU), where access is substantially harder.

Why it matters

Police may leave seized phones in evidence storage for days before examining them. If a phone reboots first, forensic access can become much more difficult or, in some cases, impossible. The feature may also frustrate phone thieves, who might use phishing or other tactics to access stolen devices before they reboot.

GrayKey’s reported capability

A leaked training video for law-enforcement customers reportedly shows a Magnet Forensics employee describing GrayKey’s “Preserve,” or “evidence preservation,” mode. The employee claims it can keep an iPhone in AFU indefinitely, preventing the 72-hour reboot and preserving the opportunity to extract data or attempt passcode guesses.

GrayKey is described as a forensic tool for accessing locked iPhones and Android devices, comparable to Cellebrite.

Potential security impact

The hosts say this capability could substantially weaken the protection provided by Apple’s reboot feature. They also discuss USB Restricted Mode, which requires a user to unlock the phone and trust a USB accessory before it can communicate with the device. Keeping a device in AFU may make it easier for forensic tools that connect over USB to work.

How it works remains unknown

GrayKey’s developers reportedly did not explain the technical method. A researcher speculated that the tool might manipulate the iPhone’s clock so it does not register that 72 hours have passed.

The video also mentions that the tool may be able to alter settings such as airplane mode or Bluetooth while the phone is locked, but offers no confirmed explanation.

Sponsored segment

The video includes an advertisement for Notion, promoting its AI workspace for bringing documents, meetings, projects, and team knowledge together.

No review, guide, or tutorial is presented.

Main speakers and sources

• 404 Media hosts, including Joe, discussing the report and its technical implications.
• Lorenzo Franceschi-Bicchierai, the reporter whose article and investigation prompted the discussion.
• A Magnet Forensics employee, quoted from the leaked GrayKey training video.
• An unnamed researcher, whose clock-manipulation idea is presented as speculation.