A company that makes phone hacking devices claims to have developed a solution that freezes iPhones in a state that lets cops more easily access sensitive data inside them, according to a video obtained by 404 Media.
This is the latest salvo in the never-ending battle between Apple and companies that help cops — sometimes those in authoritarian countries — break into iPhones.
In November 2024, 404 Media revealed Apple quietly introduced a new feature in iOS that automatically reboots an iPhone that has not been unlocked for 72 hours. The idea behind this so-called “inactivity reboot” is to revert the phone to a state that makes it harder for police to break into the device, and thus extract sensitive data from it with forensics technology.
At the time of Apple’s change, law enforcement agents expressed concern about this new feature, given that oftentimes they can’t immediately try to break into iPhones that have been seized. That could be because police are still waiting for a court authorization to do so, or there is simply a backlog of devices to unlock, for example.
The companies who sell these bypass devices spend time on graphene too, don’t worry.
The price of iOS exploits would suggest Apple’s doing a pretty good job in this area.
I’m sure they do spend time on Graphene OS, but that’s not the same as being successful in cracking it.
Most of these exploits involve side channel attacks which are much closer to the hardware. Graphene definitely does a lot more to make that difficult, but typically devices are getting pwned within a few months even with graphene.
Having graphene on relatively new hardware is a really good practice, but it obviously isn’t a complete security posture on its own. Not having sensitive, compromising or incriminating stuff on your daily carry phone is much more important.
I remember one cybersec company got hit with an internal communications leak that suggested they could get into any GrapheneOS device before the Pixel 9, AFU or BFU. They were still having trouble with BFU Pixel 9. But this was a year or two ago.
Device wipe before capture/seizure seems to be the highest guarantee.
As someone with a Pixel 8 running Graphene OS, I’d love for you to cite the source so I could read it.
https://www.androidauthority.com/cellebrite-leak-google-pixel-grapheneos-security-3611794/
Appears I was partially misremembering, they were able to get into older phones on older security patches.
I wonder if they spend time on Linux mobile devices, considering how niche they are.
But then again, security through obscurity is not real security, and I’m not aware of any reasonable way to run something like QubesOS on a phone in any way that would be usable.
Smartphones had been vulnerable for pretty much it’s entire existence, and most of time, while true software do play a role, it’s been more about stuff such as bootloader exploits.
Sadly Linux phones on it’s state are insecure by design.
They don’t have to stay insecure by design. It just requires purpose-built hardware.
I’m sure they spend time on Linux in general, since it is the most common operating system (and includes Android, so even bigger). I doubt they spend much, if any, effort on the specific subset of systems that make a Linux phone different from another Linux device.