I know of exhaustive offline dictionary and brute-force attacks against any given online account, but can the same method be applied against phones, either Android/iPhones? Or would any such attack be actually thwarted thanks to the default lock-out settings that are available on phones these days? Thank you

  • 3
    "off-line" brute-forcing does not mean to have the device disconnect from the network . It means to not interact with the device through the official interface at all but instead somehow extract relevant information from the device and then try to detect the PIN or similar only using these information. Thus, default lock-out settings don't matter for this kind of attack at all. It is more relevant if one can extract the necessary information from the locked device or some backup in the first place and then if a brute-force attack using these information is fast enough. – Steffen Ullrich Jan 25 '19 at 8:16
  • @SteffenUllrich If you could extra links for reference, your comment could make a nice answer. – bradbury9 Jan 25 '19 at 8:27
  • Talking about offline attacks, you should consider not only PIN bruteforce but also disk (internal storage) encryption. – bradbury9 Jan 25 '19 at 8:32
  • Thank you @SteffenUllrich so essentially you're saying that it CAN be done, and pretty easily, right? In other words, the automatic lockout (after, say, 10 unsuccessful guesses) doesn't really help if an attacker uses some sort of brute-forcing software against the phone and determines the right PIN/password to unlock the screen? – nnad Jan 25 '19 at 8:38
  • Not pretty easy, but undoubtly can be done. That security meassure is implemented in the OS, not in the SIM, so a modded android without that lock-out setting would deffinitevely make it. Do note that if it were in a chip in the phone, custom hardware could make it possible (harder, but possible). – bradbury9 Jan 25 '19 at 8:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.