Skip to main content

Researcher claims to bypass iPhone security limits, but may have spoken too soon

iphone x notch
Julian Chokkattu/Digital Trends

For a brief moment, it seemed as though a security researcher had found a way to get past the security limits on iPhones and iPads by entering an infinite number of passcodes in order to hack into a device. The purported vulnerability was apparently even present in the latest version of iOS, 11.3, but Apple has now pushed back on these claims, and the researcher also appears to be backtracking on his initial findings.

When attempting to access a locked iPhone or iPad, users generally have a set number of passcode attempts to make before being locked out. You can even set your Apple device to automatically erase its contents if a hacker continuously attempts to guess your passcode. But according to Hacker House cybersecurity firm co-founder Matthew Hickey, if an iDevice is plugged in and a hacker tries to send keyboard inputs, it sets off an interrupt request that supersedes all other commands on the device. This, Hickey said, would allows hackers to send every single possible passcode combination in a single string, and because it wouldn’t give Apple’s software any respite, the inputs would take priority over any data-erasing security feature.

“Instead of sending passcode one at a time and waiting, send them all in one go,” Hickey explained. “If you send your brute-force attack in one long string of inputs, it’ll process all of them and bypass the erase data feature.”

However, Apple’s spokesperson countered these claims, noting simply, “The recent report about a passcode bypass on iPhone was in error, and a result of incorrect testing.”

And a bit later, Hickey seemed to concede that his method may not have been entirely accurate. In a tweet, the security researcher explained that not all of the tested passcodes are ultimately sent to an iPhone or iPad’s secure enclave, which is responsible for guarding against these sorts of attacks.

“The [passcodes] don’t always go to the [secure enclave processor] in some instances — due to pocket dialing [or] overly fast inputs — so although it ‘looks’ like pins are being tested, they aren’t always sent and so they don’t count, the devices register less counts than visible,” he noted.

Hickey said that when he attempted to verify his methods, he found where he may have gone wrong: “I went back to double check all code and testing. When I sent codes to the phone, it appears that 20 or more are entered but in reality it’s only ever sending four or five pins to be checked.”

In any case, Apple will soon be debuting another security feature called USB Restricted Mode, which should make it much more difficult for folks to access an iPhone or iPad.

Editors' Recommendations

Lulu Chang
Former Digital Trends Contributor
Fascinated by the effects of technology on human interaction, Lulu believes that if her parents can use your new app…
The iPhone 16 Pro Max may get a very important battery upgrade
An iPhone 15 Pro Max laying face-down outside, showing the Natural Titanium color.

iPhone 16 dummy models Sonny Dickson / X

The iPhone 16 still has many months to go before its anticipated announcement in the fall, but we’ve already gotten a slew of rumors, leaks, and speculation about its specs and capabilities. One of the latest rumors about the iPhone 16 Pro Max comes from analyst Ming-Chi Kuo and it regards a new battery Apple is putting into the device.

Read more
The iPhone 16 Pro Max could set a new record for the iPhone
iPhone 16 Pro Max dummy unit next to a iPhone 15 Pro Max.

The iPhone 16 Pro Max (left) and iPhone 15 Pro Max ZONEofTech

We have good news if you're hoping for a larger iPhone this fall. The iPhone 16 Pro Max will have a significantly bigger display than the iPhone 15 Pro Max — at least according to the latest leak.

Read more
You’ll soon be able to control your iPhone and iPad with your eyes
The iPad Air 4 in hand.

Apple has announced a bunch of new accessibility features that will arrive later this year for iPhone and iPad owners. Notable among them is the ability to interact with iOS and iPadOS interfaces using eye movement, which is something that's seen in a similar system on Mac hardware.

The company calls it Eye Tracking, and it's a system built on the Dwell Control foundations. So far, Dwell Control has been available as part of the Accessibility Keyboard on macOS, allowing users to execute mouse actions using eye and head gestures.

Read more