> Let's suppose I have done the most I can to secure my phone on a software level (e.g. encrypted storage, restricted app permissions ... whatever you consider "maximally secure"). Is physical access still game over? ## The Game Is Not Over It is very trendy to say "everything can be hacked", but in your case **the game is not over**. Mobile OS enables much more security hardenings than PC: 1. Secure OS (see [ARM TrustZone][2]) which runs concurrently to Android. 2. Specialized security chips (see [Secure Enclave][3]). 3. SELinux. 4. No root. 5. Containerization. 6. Disk encryption. 7. ASLR, KASLR. 8. eSE chip. 9. dm-verity. 10. and much more... *And this is a baseline for iOS and Android in 2020.* ***And you don't have this everything enabled on your personal PC!*** Let's consider a basic way how data is protected in a modern mobile OS: 1. You set a password 2. Password -> symmetric key 3. Key -> encrypted storage Considering *you have done the most you can to secure your phone*, there are 2 options to access your phone: 1. **brute-force your password** (a guessed password means an access to your data) 2. **do a factory reset** (you loose data, but data remains confidential) --- ## Offline attack Let's say, if operating system doesn't store your password on disk as a plain text, and your mobile device has been rebooted (so keys don't stay in memory): your data is safe. It means that **offline attack** on your data is almost impossible. (I said "almost" but it also means the game is not over yet). Therefore to be sure about **data confidentiality**, be sure you do your best: 1. Choose a difficult password/PIN 2. Don't forget to lock your device with any kind of credentials --- ## Real world positive cases **ATTENTION** to ***"flashing bootloader, skipping decryption"*** guys: the following happens when you "flash bootloader" and "skip decryption". ### Case #1 There are "magic tools" like dr.fone which claims to unlock any phone [without a data loss][4]. Now take a look at their [guide with an iPhone 7 case][5]: > Please note this unlocking process will also **wipe the data on your** iPhone/iPad. Honestly there is no solution to bypass iPhone/iPad lock screen without data loss for the moment in the market. Why this happens: because device cannot "skip" decryption of encrypted data - device doesn't have the key until you enter a valid credentials which ARE the key. Until that happens any data is a trash which just can be **wiped**. ### Case #2 Another case is that **Android** cannot decrypt files before you unlock it after reboot, because Android doesn't have a key physically: https://source.android.com/security/encryption#full-disk ### Case #3 Not a "magic" phone with self destruction like in movies but an ordinary Samsung Galaxy S9 can be used for U.S. military: https://www.samsung.com/us/business/solutions/industries/government/tactical-edition/. "Tactical edition" has just slightly modified firmware with "military" features having the same basic Know and other security hardenings. --- ## Runtime attack with physical access Here adversary have some options to win the game. 1. If you forgot to lock you phone, having a short physical access adversary can jailbreak (root) your phone, install a back door, and later get everything he needs remotely. 2. If operating system didn't shut down yet, then having theoretically unlimited resources, attacker can try to find encryption keys in memory, and it would be OS vulnerability. A chain of vulnerabilities is needed depending on OS version and a state of security hardening. To be sure you did everything to mitigate such types of attacks: 1. Lock your phone. 2. Update your OS (particularly do security updates). --- And yes, theoretically there is no absolute security: OS may just not encrypt files, or OS may leak encryption keys; even cryptography is based on a relative difficulty to solve a particular mathematical problem, or on difficulty to attack a particular cipher... But the game is not over. --- **SPECIAL UPDATE** for people saying **"zero days, FBI, dark market, everything can be hacked"** and for people who upvotes them. You cannot just throw these words here and there. It means nothing out of concrete attack chain. TLS 1.3 is not easy to "hack" (that's why you use https), it's not easy to find a collision for SHA-256, it's not easy to exploit the collision, and **"not easy"** means an enormous time, from a several years to infinity, where CSI will "hack" you physically rather than hacking your phone. It's not easy to exploit a vulnerability on a system where this vulnerability was patched. Questioner makes a **precondition**: a concrete case, hardened mobile phone, where he did everything he was able to do. It could be [this phone][1], for example. Having this particular precondition I would propose to try to discuss very specific cases. But "it depends on" would be a pretty comfortable and universal answer, of course. **SPECIAL UPDATE 2** for **"flashing bootloader, skipping decryption, hacking in the lab"** guys. Just see the "Real world positive cases" above. And shortly: you just need to know that many cases when you hear "unlock the phone" are narrowing down to a data wiping case (factory reset). *No key = no data*. Easy. --- Set up credentials, lock your phone, update OS, and cybersecurity professionals will try to do the rest. [1]: https://www.samsung.com/us/business/solutions/industries/government/ [2]: https://developer.arm.com/ip-products/security-ip/trustzone [3]: https://support.apple.com/guide/security/secure-enclave-overview-sec59b0b31ff/web [4]: https://drfone.wondershare.com/iphone-unlock.html [5]: https://drfone.wondershare.com/guide/ios-unlock.html