>We threat modelled that this feature could be a notable target for exploits to prevent reboots & keeping data safe when introduced in
GrapheneOS. Compared to iOS, you can configure a shorter reboot time & USB-C port hardware controls prevent USB as a mode of exploit delivery.
> In my adversarial opinion, blocking auto-reboot matters more than an AFU Locked extraction capability. Extraction only opens up phones seized around/after the capability exists, while the automatic reboot blocker keeps phones seized in the past more exploitable.
> Magnet Forensics, the company in the article, have already discussed about the impacts the addition of automatic reboots across flagship smartphones in mobile forensics including this recent webinar. We even get a mention.
https://t.co/2wAtfq3qnb
> Protecting GrapheneOS against malicious use of forensic tools / 0days for unauthorised access is two parts: preventing known tools from working, and designing the OS that the window of exploitability if a capability ever emerged is as short as possible. Nothing is unhackable.
> There will always be an eventual risk of an exploit day where stolen devices will be peeled open from being vulnerable after several years with no updates. This is why you use a strong entropy alphanumeric password to resist any capability of brute forcing the credentials in BFU.
quoting“The new technology to get around inactivity reboot was developed by Magnet Forensics, the company behind GrayKey, a popular tool sold to law enforcement agencies that allows them to unlock and access data stored in iPhones and Android smartphones. Magnet has developed a new device called GrayKey Preserve and a feature for its regular GrayKey devices called Evidence Preservation Mode, according to the video.
nevent1q…pyvl
“This is an absolute game changer for iOS forensics and a function that I wish we had years ago,” a Magnet employee says in the leaked video, specifically mentioning that the solution is targeted at the iPhone’s inactivity reboot feature and the data it makes unavailable. GrayKey Preserve and Evidence Preservation Mode are also designed to combat another iPhone feature that automatically deletes certain data — such as cached locations, and recently deleted photos and iMessages — after a certain number of days. “We're gonna be able to preserve that data for an infinite amount of time.””
https://www.404media.co/cops-can-bypass-iphone-automatic-inactivity-reboot-graykey/
#CyberSecurity #GrayKey #DigitalForensics #Apple #iPhone