#passcodes

Christopher Budd, Director of Sophos X-Ops  As we hit the middle of Cybersecurity Awareness Month, it’s important for Malaysians to stay vigilant about online security. Cybercrime is on the rise in Malaysia affecting businesses, individuals, and even critical infrastructure, which is underscores the need for stronger online security measures for businesses and individuals. It’s crucial to be…

The ongoing saga of data breaches means that criminals have access to at least bits and pieces of our digital footprint. When Yahoo was attacked, they recently disclosed in October that over 3 billion user accounts were compromised. I think we were all shocked when the Experian data breach hit the news. However, it’s up to us to take ownership of our personal information. First, as the continued…

TLDR ~ I had my iPhone disabled because I did too many attempts trying to figure out what was the passcode I’ve defined on it a couple of months ago. After messing up with iTunes I’ve figured a way to reset the pass code insertion and bruteforce until I’ve figured out it. The bruteforce took me about 20 minutes, and the hole process (without counting until it has been blocked) was about 40 minutes. FBI and NSA wouldn’t beat that.

I screwed up! I’ve changed the passcode of the iPhone I use for development only a couple of months ago, and didn’t remember it because my iPhone was off for a long time because I’ve lost the charger cable.

Today I needed it, so I had bought a new one on a Chinese store and put it on charge. Once it was charged I’ve tried to get my hands on it to upload something I needed to test, and guess what, didn’t remember the passcode.

After some attempts it has shown a message warning me that I have to wait a minute to give a new try, gosh, I’ve started to remember the FBI story about the thing, the high security behind a weak passcode, the holy reset. hahaha

I had it set as on, because there was some data that I didn’t want anybody to put their dirty hands on it. After the first attempt limit, a new try lead me to another wait time, but this time for 5 minutes.

I started to worry a little bit, after more two failed attempts I got the message “connect to iTunes”. Things weren’t going well.

I little research on it (Apple support, jailbreak sites and so on) told me that or I had a backup on my computer of the data or it was completely unrecoverable. Shit got serious, a couple of months ago I had to do a heavy cleaning of my computer because I was deploying large Docker images and the VM was eating all the space it had.

Just after I’ve lost all the hopes, I’ve tried every actions that iTunes was providing, the first one was to backup it without the apps, then I’ve tried anothers. My last attempt before doing a recovery reset was to backup with the apps, until I’ve realized it gave me more chances to try out more passwords.

It wasn’t making any sense, if it has deleted the keys, how could it was displaying the keypad again?

After some attempts it got blocked again, and a backup with apps got me, once again, more attempts. Shit, I got to grab this on video. And there it is:

I was seeing here three things, or the iPhone wasn’t deleting the keys as they say it does, or the system was malfunctioning and displaying a keypad to a non-existent keys, or the iTunes managed to replace the keys on the system. Hope lead me to the third.

I’ve pointed out the passwords that I’ve tried, figured out what numbers I have used on them and what numbers I would use. Did a js loop to give me a passcode bruteforce table and to exclude the ones I have already tried.

I’ve started to enter the passcodes the software was giving me. The whole process took me about 20 minutes, they were well spent:

I had my entire content I was expecting without having to factory reset the iPhone. My guess and instinct could be possibly right, and if it is, Apple is saving the keys on the synced computers or on the iCloud.

If you have an iPhone without important data laying arround, give it a try so we can check if my theory is right. Here are the steps for reproduction:

1. Sync the iPhone on your computer, remove the cable and delete all the backups on the iTunes. 2. Install any new app on the iPhone (don’t know if this step is necessary, because iTunes won’t have the backup) 3. Place up any passcode on it that you can remember 4. Enable Apple’s passcode data wipe protection 5. Lock it, unlock it and enter bad passcodes 6. Go through the whole process until it displays “connect to iTunes”, at this point you won’t be able to input any passcodes anymore 7. Do a backup, it will ask you if you want to backup also the new Apps it doesn’t have. 8. Check if you’re able to input passcodes.

There you go.

Remember the days when you set “password” as your password? Many still use such insanely insecure methods, but even the humble password has evolved. We now use passcodes or passphrases wherever we go. They unlock your online banking, games accounts, and devices.

But to some, even these have been rendered superfluous, replaced by supposedly-superior validation practices. Here’s why you should…

Here’s Why Passcodes Are Better Than Fingerprints

Here’s Why Passcodes Are Better Than Fingerprints Do you use your fingerprint to unlock your smartphone or laptop? Not all devices have this capability, but for those that do, it feels fun and futuristic to use it. But it’s not necessarily more secure than using a passcode to unlock the phone. Even though a fingerprint is theoretically unique, some theorize that it might be easier for a thief to…

$170 Device Unlocks iPhone In Hours, Took FBI 4 Months

It took almost four months for the FBI to break into the iPhone used by one of the San Bernardino terrorists. Turns out, they could have done so much faster and cheaper with a simple device sold in retail shops. Fone Fun Shop, a British retailer, stocks a device that can unlock an iPhone

Will Digital Data Ever Be Secure?

After 20 years working for technology companies, I recognize I sound like a Luddite when I warn people that using password keepers, and encrypted data solutions are not the best option for securing your data andsharing it with a loved one. There is a risk of a breach, and the security put into place can prevent a loved one from stepping in to help you when you need it. But the news stories just…