cross-posted from: https://infosec.pub/post/54044619
Ok, so this is hilarious. A few years ago I forget the PIN to my iPad mini 1 and basically everything else about it. When I dredged the device out of its bin, I knew pretty much nothing about it! Like the PIN, iOS version, or even if it had any photos on it. (Well, apparently, I changed the PIN to 123456 to be smart)
Instead of just trying a basic PIN like this, I tried the PINs that I thought it was. Then I tried following some Reddit posts from AsyJAIZ in order to get the device into pwnDFU mode and then creating a ram disk manually… which was misguided. In hindsight, the post from AsyJAIZ just sucks. A lot of what they tell you to do could have been simplified far more than it was.
I waited a few years to pick this up again, and then a week-long journey that required an Arduino Uno R3, USB Host Shield, a fork of checkm8, hacktiv8, the Google Code iphone-dataprotection repository plus some code from AsyJAIZ (and myself), tuanemss/32bit-Bruteforce-Passcode, and developing on MacOSX Yosemite 10.10 with the iOS 8.1 SDK. I decided to eventually just ignore AsyJAIZ’s written instructions and instead look into their GitHub repository and apply those patches (which were actually helpful) to a different repository (by dinosec on GitHub), compile it using some SDKs, and then replace files used by tuanemss’ shell scripts which then bake a final Ramdisk for me! All I really did was write some C code to try PINs in a different order.
I unlocked the device and it went into iCloud activation lock (which I had to bypass with hacktiv8), then I transferred the three (3) photos off the device. In the end there wasn’t much reward for having done all this, besides a few pictures of my dog.
Anyway, it’s been an insane journey and I hate myself now. If anything I actually have a good reason now to hate anything Apple makes (at least it pisses off law enforcement). The last apple device I will ever own is my 4 year old SE.
You’re mad at Apple for making it hard to get into your device in spite of a weak password?
Not only that but the final iOS for iPad mini 1 was iOS 9.3.5. Which has 50+ known security vulnerabilities a decade ago.
I could probably give more justifiably angry reasons for why I hate Apple. I just don’t want to rant that out here. (I’m not mad at them making a secure device, just that the whole process to crack it was obviously a pain in the ass and a clear symptom of the rotting Apple ecosystem).
I can see how it being difficult to crack would be an indication of security, but I’m having a hard time figuring out why it would be an indicator of ecosystem rot.
What I was trying to articulate was the process of cracking the device. As in, stealing some code (exploits), modifying it a little bit, and compiling it. In order to do any of that, you need Apple hardware (or Apple’s secret flag) and then a specific version of MacOSX to even compile the thing, since downloading the SDK (which isn’t made easily public) requires a specific version of Xcode which only works on certain versions of MacOSX. If I did this on literally any other platform I could just pull out gcc/clang and wack some libraries together. There are too many signs from Apple that they have manufactured planned obsolescence in order to get you to buy a new device.
I wouldn’t say its rot, but id say its lack of user control.
Trying to make everything ‘one quick pretty button’, they really destroyed the modern understanding of computers.
Even using pins, which they spearheaded for mobile phones, is essentially useless today because its inherit limited entropy (as proven by OP cracking it in 12 min on a microcontroller).
Even using pins, which they spearheaded for mobile phones, is essentially useless today because its inherit limited entropy (as proven by OP cracking it in 12 min on a microcontroller).
Is it really the lack of entropy that enables that, or the 12 years of exploits and research into the OS that went on since it was released? I’d be surprised if a pincode on iOS 27 took 12 minutes to crack, since that would be a significant blow to the market for exploits.
I wouldn’t say its rot, but id say its lack of user control.
Definitely in favour of more user control, but might be good to limit the user control to the owner of the device.
Easy money!
