A manufacturer of phone-cracking tools used by law enforcement has developed technology to bypass an Apple security feature that automatically reboots idle iPhones, according to a report from 404Media.
404Media reports that Magnet Forensics, the company behind GrayKey, a popular tool sold to law enforcement that allows them to unlock and access data stored in iPhones and Android smartphones, has developed a new device called GrayKey Preserve and a feature for its regular GrayKey devices called Evidence Preservation Mode.
The technology is designed to get around Apple's inactivity reboot feature, which automatically puts an iPhone into a more secure state after it has not been used for 72 hours. It is also intended to defeat another iPhone feature that automatically deletes certain data, such as cached locations, recently deleted photos and iMessages, after a set number of days.
"This is an absolute game changer for iOS forensics and a function that I wish we had years ago," a Magnet employee says in a leaked video cited by 404Media, specifically mentioning that the solution targets the iPhone's inactivity reboot feature and the data it makes unavailable. "We're gonna be able to preserve that data for an infinite amount of time."
Writing on his security blog, Bruce Schneier notes that now that Apple engineers know the flaw exists, they can find and fix it. He also observes that AI turns out to be really good at this sort of thing.
Analysis
Why This Matters
- The inactivity reboot is one of the key protections that keeps data off-limits even to forensic tools. A working bypass could expose messages, photos and location data that users believed were secure.
- The technique comes from a commercial vendor selling to law enforcement, which raises questions about how widely the capability could spread and whether it will be patched.
- Apple engineers are now aware of the technique, so the question is how quickly a fix arrives and whether the tool still works after iOS updates.
Background
Apple's automatic reboot feature is designed to move an idle iPhone into a more secure state, one that requires a passcode rather than biometric authentication, after a period without use. The same design also deletes certain data, such as recently deleted photos and messages, after time passes. GrayKey has been sold to law enforcement for years as a way to unlock phones and extract data during investigations. The new GrayKey Preserve device and Evidence Preservation Mode appear designed to prevent those protections from destroying evidence.
Key Perspectives
Magnet Forensics and law enforcement customers: The company describes the feature as a major advance for iOS forensics, letting investigators hold on to data that Apple's security features would otherwise wipe from devices.
Apple and privacy advocates: The reported capability cuts against the security guarantees Apple makes about its devices. Privacy advocates may see it as further evidence that commercial surveillance tools are eroding phone security.
Critics and security researchers: The skeptical take is that the technique may be short-lived. Schneier argues the disclosure gives Apple the information it needs to find and fix the underlying flaw, and he notes that AI appears to be effective at this kind of work, which could speed up both exploitation and patching.
What to Watch
- Whether Apple confirms the vulnerability and ships a patch in an iOS update
- Any public response from Magnet Forensics or Apple about GrayKey Preserve
- Whether the technique or similar methods surface in other forensic tools or in security research