Quote from The New York Times:

The Justice Department said Monday that it had found a way to unlock an iPhone without help from Apple, allowing the agency to withdraw its legal effort to compel the company to assist in a mass-shooting investigation.

How was it done? Is this some undisclosed 0-day, or bruteforce, or was done through a direct hardware access?

  • 18
    There are plenty of articles on different ways they could do it. It was very obvious that they could unlock the device from the beginning and that this was very politically motivated for potential mass surveillance: aclu.org/blog/free-future/…
    – d0nut
    Commented Mar 28, 2016 at 23:11
  • 5
    @iismathwizard: That's speculation, bordering on conspiracy theory. Hardly "very obvious". Commented Mar 29, 2016 at 12:57

1 Answer 1


[Update #2]

According to the Washington Post, sources familiar with the matter, have stated that the initially suspected collaboration with Cellebrite is not how the data from the encrypted iPhone was recovered. Instead an unknown security vulnerability was used (purchased) from "professional hackers" to prevent the phone from erasing its data and slowing down the passcode check. This would mean that the FBI probably brute-forced the passcode once those iPhone security measures had been deactivated.


@Gandalf brought to our attention that the DOJ has now confirmed they successfully accessed the iPhone 5C and can indeed access any iPhone 5C running iOS 9 this way: http://money.cnn.com/2016/03/28/news/companies/fbi-apple-iphone-case-cracked/index.html

There is a good article about the current known facts here: http://www.bloomberg.com/news/articles/2016-03-28/u-s-drops-apple-case-after-successfully-accessing-iphone-data-imcj88xu

The official declined to provide any details, such as what was on the phone, the identity of the third party or how the method worked. The official also declined to say whether the U.S. will give Apple details about the hacking method.

According to other news reports the FBI decided to go with a company that stated it could unlock the phone for them. Something that had been suggested to be possible for a while. They did not specify which company / third party is going to do this, but several articles suggest it's an Israeli Company, named "Cellebrite":

Original Report: http://www.ynetnews.com/articles/0,7340,L-4782246,00.html

http://www.theverge.com/2016/3/23/11290374/apple-iphone-fbi-encryption-crack-cellebrite http://www.reuters.com/article/us-apple-encryption-cellebrite-idUSKCN0WP17J

The speculation is suggesting NAND mirroring to be used to gain access to the device memory and copy everything to another device, but at this point the exact how-to is not publicly known.

This article also found a recent contract reference between that company and the FBI: http://www.macrumors.com/2016/03/23/fbi-israeli-firm-cellebrite-to-unlock-iphone/

They also speculate about a microchip attack and brute-forcing the passcode once the data has been extracted from the device, but the company is likely going to remain very quiet about the exact "how-to" and so will the FBI for obvious reasons.

[Update #1] The EFF has published a statement that suggests any used security vulnerability might be reported to Apple, if the FBI was to follow the guidelines that the EFF had previously acquired through a freedom-of-information lawsuit: https://www.eff.org/deeplinks/2016/03/fbi-breaks-iphone-and-we-have-some-questions

  • 1
    CNN is reporting ""The FBI has now successfully retrieved the data stored on the San Bernardino terrorist's iPhone..." -DOJ spokesperson Commented Mar 29, 2016 at 0:37
  • I updated the answer according to your suggestion, but they still didn't specify how they actually did it.
    – Chris
    Commented Mar 29, 2016 at 1:06
  • "probably reading out the passcode from there" This would seem to suggest the device stores the passcode itself, versus a hash or something, which seems unlikely. Is there anything to backup this speculation? Unless poorly designed, I would think it would still need brute-forcing. Commented Mar 29, 2016 at 4:50
  • 3
    @Jake The phone actually doesn't wipe all its data, it wipes the section holding the decryption key. If you can copy that section, you could put it back every 10 (incorrect) PIN attempts. Ofcourse, it'd be "easier" for the FBI if they could copy the necessary memory info to other devices and test PIN codes on those devices
    – BlueCacti
    Commented Mar 29, 2016 at 13:27
  • 2
    Given that it was a third party that unlocked the iPhone, and not the FBI themselves, I wonder if the FBI is actually capable of disclosing the vulnerability that was used...
    – Ajedi32
    Commented Mar 29, 2016 at 14:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .