New Grayshift spyware lets police surreptitiously snatch iPhone passcodes

Mobile forensics firm Grayshift is marketing a software tool that can reveal a user's iPhone passcode without cracking the device, according to a new report.

Grayshift is known for its flagship GrayKey product, a digital forensics tool that can bypass the encryption on an iPhone. Though it's been tested against even the latest iPhone models, the process it uses can take days, if not weeks to complete.

Now, NBC News reports that Grayshift has developed a tracking software called Hide UI that can reveal an iPhone user's passcode to law enforcement much more quickly.

The Hide UI tool is a piece of spyware that can be installed on an iPhone via GrayKey. Once it's on a user's device, it "hides" itself, but continues to track user input. If a user types in their passcode while Hide UI is active, the software can log it and use it to bypass encryption later.

That, of course, requires the device to be put back in the hands of a user or suspect. Law enforcement officials told NBC that using Hide UI typically entails a bit of social engineering.

Some examples include telling a suspect they can call their lawyer or delete phone contacts. Once they tap their passcode in, Hide UI saves it in a text file the next time the iPhone is plugged into a GrayKey.

According to NBC, Hide UI has been a feature of GrayKey for about a year, but required non-disclosure agreements signed by law enforcement officials have kept its existence concealed until now.

The secrecy surrounding the tool has raised concerns among civil liberties activists and lawyers, specifically the potential for it to be used without a warrant.

Law enforcement officials who spoke with NBC maintained that they've never used Hide UI without a warrant. At least one source also added that the software was "buggy," and it was usually easier to just compel suspects to hand over their passcodes.

Grayshift doesn't publicly list Hide UI as a feature, but does refer to some "advanced features" in its GrayKey marketing materials. NBC reports that Hide UI and other intelligence-gathering tools aren't explained to police departments until they sign NDAs.

In at least one NDA, Grayshift even required law enforcement to notify them if technical details were likely to be revealed through judicial processes. The advanced notice would give Grayshift an opportunity to "obtain a protective order or otherwise oppose the disclosure."

Lance Northcutt, a Chicago-based attorney, called that "pretty shocking," and told NBC that it suggests the interests of Grayshift could be interfering with due process.

News of the Hide UI feature comes just hours after the FBI revealed that it was able to unlock two iPhones belonging to the gunman in the Pensacola mass shooting, even after Justice Department officials called on Apple to help with the process. Before that, U.S. law enforcement entities have long been able to crack iPhones without Apple's help.

Attorney General William Barr maintains that Apple's strong encryption is problematic, and that a "legislative solution" is required for police agencies to be able to do their job. Apple, for its part, has been steadfast in refusing to build a backdoor for law enforcement into its products.

Latest Exclusives

Latest comparisons

18 Comments

EsquireCats 1268 comments · 8 Years

About 4 years ago

It seems more and more likely that Apple will remove external ports on the iPhone thus further limiting such exploits. I’d be curious if they eventually make their own initial on-loading also entirely wireless.

Xed 2871 comments · 4 Years

EsquireCats said:

It seems more and more likely that Apple will remove external ports on the iPhone thus further limiting such exploits. I’d be curious if they eventually make their own initial on-loading also entirely wireless.

Is that feasible in the foreseeable future? Even the Apple Watch has an access port. That would seem to be more of an inconvenience for users than for law enforcement and other entities looking to subvert security.

I'd like to think Apple could offer options like a T-series chip that could evaluate how data is accessed so that such devices become unusable.

JFC_PA 947 comments · 7 Years

EsquireCats said:

It seems more and more likely that Apple will remove external ports on the iPhone thus further limiting such exploits. I’d be curious if they eventually make their own initial on-loading also entirely wireless.

I’d hope if they did that they would retain a “charging only” port as the inefficiency of wireless charging otherwise means every external power pack has to double in size and weight to get the same level of charge. At home that’s not an issue (though speed could be) but traveling would be much more burdensome.

rob53 3307 comments · 13 Years

I consider this spyware and malware, both are illegal to install on computer devices so why is it that our government isn't going after this company for admitting they're producing spyware? Oh, that's right, our government doesn't care about our constitutional freedom. Time for Apple to update their malware finding software along with other companies (Malwarebytes, etc.). It's also time for Apple to turn the tables on GrayShift and create a trojan horse that is sent back into the GrayKey system when it tries to load spyware on an iPhone. Once loaded it effectively destroys the GrayKey and everything GrayShift owns.