1

Grayshift claims that USB restricted mode does not make a difference, so how do people protect against Grayshift?

Improve this question
1
  • 1
    Just use a long complex alphanumeric password, so even if grayshift doesn’t get throttled it won’t be able to bruteforce the encryption key.
    – Matteo
    Aug 6, 2018 at 11:50

1 Answer 1

Reset to default
4

The problem with Apple's USB Restricted implementation (currently) is that it is triggered by the plugging/unplugging of something into the Lightning port. So, for example, if you catch a device within the 1 hour window before the mode enables (and locks you out), you can unplug the cable and plug it back in before the end of the countdown happens and you now have a whole other hour to work with. Repeat this for unlimited attempts, just like before the feature was added. So, the viable workaround would be to just add a function to perform an unplug/plug action every 59 minutes or so, to gain another hour of brute-force attempts.

That is POSSIBLY how Grayshift worked around the problem as it is very easy to implement.

Apple's already aware of this issue and are probably working on changing the behavior to make the timer only reset if the device is unlocked again rather than by unplugging the cable before the countdown has finished.

Improve this answer
1
  • 2
    You're welcome. As the other person stated, the only way to really prevent it from being a concern is to use a long alphanumeric password/passphrase rather than just a PIN.
    – Jesse P.
    Aug 6, 2018 at 13:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .