5

We all know that smartphones (i'll take iPhone as an example) rely on SNTP/NTP servers to update a device's time and date. So, by creating an SNTP server that mimics Apple's server, we can actually change a device's date and time over WIFI in order to bruteforce the passcode of the device without waiting the timeout period.

(By changing the device time over and over via WIFI)

Isn't that possible?

  • Also, I think the device gets its time from the cellular network, not NTP. – schroeder Apr 28 '16 at 18:21
  • 4
    The device does get it's time from NTP. – xorist Apr 28 '16 at 18:29
  • I wonder if someone could port OpenNTPD to iOS. It can double check the time against https://google.com – Neil McGuigan Apr 28 '16 at 22:04
  • 1
    You can brick an iPhone using NTP however. – SilverlightFox Apr 29 '16 at 7:58
  • That was before 9.3.1 – Med Abida Apr 29 '16 at 7:59
6

Answer: No, a bruteforce attack would most likely fail.

http://www.payetteforward.com/my-iphone-is-disabled-connect-to-itunes-fix/

According to this site, and anyone who has ever been a mean big brother, there are only 10 times you can attempt to unlock an iPhone before it is completely locked and needs to be restored.

1-5 failed attempts - The phone will not lock.

6 failed attempts - The phone will lock for one minute.

7 failed attempts - The phone will lock for 5 minutes.

8 failed attempts - The phone will lock for 15 minutes.

9 failed attempts - The phone will lock for 60 minutes.

10 failed attempts - The phone will be disabled and will need to be restored.

So, as previously stated, 10 attempts will be your maximum. Also, Apple has released several new ways to set a passcode on your phone without having the use the 4 digit numeric code, which has a maximum of 10,000 passcodes (0000 - 9999). Users can use a 6 digit passcode which has a maximum of 1,000,000 possible codes (000000 - 999999), or even a phrase, which has a much greater number of possibilities for passwords.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.