The IP-Box can guess your iPhone's passcode in under 17 hours

The aforementioned IP-Box is at the center of a case in New York City, where Brooklyn federal judge Sterling Johnson forbade the use of evidence seized from an accused heroin smuggler’s iPhone. According to the judge, the agents that gathered evidence leading to Amadou Djibo’s arrest unlawfully used his password to gain entry into his iPhone, since they did not give him a Miranda warning, a requirement in New York, when he was stopped at John F. Kennedy Airport in February 2014.

In a possible effort to justify its actions, the government claimed that Djibo’s iPhone could still lawfully be hacked into after his arrest by an independent third party. More specifically, U.S. Department of Homeland Security special agent David Bauer, who testified in the case, revealed the existence of a “fairly new” device called the IP-Box.

According to Bauer, the IP-Box goes through every possible 4-digit passcode combination, from 0000 to 9999, and can theoretically find the correct passcode in less than 17 hours. However, in his 30-page decision, Johnson brought up a similar case brought before the magistrate in which federal prosecutors argued that the IP-Box was unreliable and brought with it a “non-trivial risk of data destruction.”

In other words, the IP-Box, alleged federal prosecutors in the previous case, could destroy data stored within an iPhone instead of carrying out its intended duties of finding the right passcode.

Those same federal prosecutors who argued that the IP-Box was unreliable also argued that it is extremely difficult to break into an iPhone, which was the opposite of what the prosecutors in Djibo’s case argued. Unsurprisingly, Apple’s lawyers also argued that it’s extremely difficult, to the point of impossibility, to break into the latest iPhones, the iPhone 6S and 6S Plus.

Even considering its alleged unreliability, it seems like iPhone owners can thwart the IP-Box if they utilize a longer passcode or elect to have their iPhones erased after 10 failed attempts. And remember: at least for now, you can just plead the Fifth if a representative of the government seeks your phone password.