Researchers find loophole that extends USB Restricted Mode's hour-long timer

Grayshift's GrayKey iPhone cracking tool. | Source: MalwareBytes

In testing for months, and released earlier today, USB Restricted Mode is Apple's answer to iPhone intrusion techniques that use third-party software to crack device passcodes.

When enabled, the feature deactivates USB data processes, conducted through an iPhone's Lightning port, when the device remains locked for over an hour. After hitting the predetermined time limit, Lightning is only able to pass power through to iPhone for device charging.

The mechanism disrupts hacking techniques used by criminals, as well as tools like those marketed by digital forensics firm Grayshift, whose GrayKey iPhone unlocking box requires access to an operational USB port.

According to security researchers at ElcomSoft, however, USB Restricted Mode's countdown timer resets when a Lightning accessory like Apple's Lightning to USB 3 Camera adapter is connected to a target iPhone, effectively defeating the security protocol. Even untrusted accessories, or those that have not previously interfaced with an iPhone, can be used to reset the counter.

ElcomSoft is experimenting with unofficial Lightning to USB adapters to see if they, too, can extend the one hour time limit.

The USB accessory procedure is not viable once USB Restricted Mode activates. Through testing, ElcomSoft confirmed a successful lockout is "maintained through reboots, and persists software restores via Recovery mode. In other words, we have found no obvious way to break USB Restricted Mode once it is already engaged."

However, as the firm notes, iPhone owners are constantly picking up, unlocking and using their devices throughout the day, thereby increasing the odds that target hardware can be intercepted within the one hour time limit.

"In other words, once the police officer seizes an iPhone, he or she would need to immediately connect that iPhone to a compatible USB accessory to prevent USB Restricted Mode lock after one hour," ElcomSoft's Oleg Afonin explains in a blog post.

An ideal accessory should include means of transferring power to iPhone, as proper forensics techniques call for a device to be transported in a Faraday bag or similar to prevent communication with cellular networks. This results in extreme battery drain as iPhone ramps up power to its communications stack as it searches for an adequate signal.

Afonin guesses the USB Restricted Mode loophole is the result of an oversight on Apple's part. Defeating (or more accurately postponing the activation of) an otherwise well-thought-out security protocol with readily available consumer products is likely not what Apple had in mind when it created the feature. Still, the workaround exists in both iOS 11.4.1 and the latest iOS 12 beta.

Apple might rectify the issue in a future release, but for now USB Restricted Mode is vulnerable until its preset one hour window closes.