Please create an account to participate in the Slashdot moderation system


Forgot your password?
Security Iphone Privacy

Documents Prove Local Cops Have Bought Cheap iPhone Cracking Tech ( 101

GrayShift is a new company that promises to unlock even iPhones running the latest version of iOS for a relatively cheap price. From a report: In a sign of how hacking technology often trickles down from more well-funded federal agencies to local bodies, at least one regional police department has already signed up for GrayShift's services, according to documents and emails obtained by Motherboard. As Forbes reported on Monday, GrayShift is an American company which appears to be run by an ex-Apple security engineer and others who have long held contracts with intelligence agencies. In its marketing materials, GrayShift offers a tool called GrayKey, an offline version of which costs $30,000 and comes with an unlimited number of uses. For $15,000, customers can instead buy the online version, which grants 300 iPhones unlocks.

This is what the Indiana State Police bought, judging by a purchase order obtained by Motherboard. The document, dated February 21, is for one GrayKey unit costing $500, and a "GrayKey annual license -- online -- 300 uses," for $14,500. The order, and an accompanying request for quotation, indicate the unlocking service was intended for Indiana State Police's cybercrime department. A quotation document emblazoned with GrayShift's logo shows the company gave Indiana State Police a $500 dollar discount for their first year of the service. Importantly, according to the marketing material cited by Forbes, GrayKey can unlock iPhones running modern versions of Apple's mobile operating system, such as iOS 10 and 11, as well as the most up to date Apple hardware, like the iPhone 8 and X.

This discussion has been archived. No new comments can be posted.

Documents Prove Local Cops Have Bought Cheap iPhone Cracking Tech

Comments Filter:
  • by VeryFluffyBunny ( 5037285 ) on Friday March 09, 2018 @02:17PM (#56234465)
    So now that the cat's officially out of the bag, are all these calls for backdoors and special access by the FBI simply PR? I wonder how many years they've sat on this, without telling anyone, and without helping law enforcement solve crimes? It would seem that the FBI has lost sight of its primary objective, i.e. public safety.
    • by Anonymous Coward

      I guess FBI just wanted a free, 1st party cracking solution. That's what they were crying about. Law enforcement went ahead after payment of a non official solution.

      • by Anonymous Coward

        The FBI went through the proper procedures when it requested and received a search warrant so they could access the phone of a dead terrorist. The terrorist didn't even own the phone and the owners gave the FBI permission to unlock the phone in question. Apple refused the court order saying that it was an expensive insurmountable technical challenge requiring Apple to use to many resources. Apple's refusal was a marketing campaign aimed at making consumers think their iPhones were secure and that Apple woul

    • by plover ( 150551 ) on Friday March 09, 2018 @03:28PM (#56234917) Homepage Journal

      The FBI is mostly whining because they want on-line real-time undetectable wiretapping. Cracking open a locked phone is no different than gaining a warrant and taking the phone in the first place - the suspect is aware that his phone has been taken (or is dead), and it usually happens only after a serious crime has been committed and the suspect has been identified. I have no problem with police using tools to examine evidence after a crime has been committed.

      But demanding flawed cryptographic algorithms, on the other hand, permit drift-net trawling of everyone's phones. Did you text someone about the weapon or the assassination plot? These crimes can now be thwarted before the victims are injured -- look, our pre-crime unit saves lives! But the drift-nets don't discriminate, and gather information about misdemeanor or non-criminal activity, too: small drug sales, shoplifting, or in the case of the Cheetohead-in-charge, researching climate change, donating to Hillary, or badmouthing Putin.

      If anything, the current administration is so corrupt that the FBI themselves should be putting on the brakes, saying "no, we don't even want the tools to exist since you're just going to use them to ask us to further violate the Constitution for you."

    • by AHuxley ( 892839 )
      Yes they are. The tech exists for different generations down to the city and state funded federal task forces.
      The only trick is to keep the tech message out that its all NSA, GCHQ complex for every new generation of big brand product.
      The its safe for criminals and police under internal affairs investigations to keep testing their communications and GPS devices.
  • Thel hell? (Score:5, Funny)

    by DontBeAMoran ( 4843879 ) on Friday March 09, 2018 @02:21PM (#56234495)

    Documents prove local cops have bought cheap iPhone cracking technology.

    That's a totally irresponsible waste of the taxpayers money! I cracked mine THREE TIMES already without even trying! Just drop it on a concrete floor!

  • Sue their arse (Score:5, Interesting)

    by mysidia ( 191772 ) on Friday March 09, 2018 @02:25PM (#56234515)

    GrayShift is an American company which appears to be run by an ex-Apple security engineer and others who have long held contracts with intelligence agencies.

    Seriously? That ex-security-engineer must be violating like 20 different agreements that Apple makes their employees that build their products sign, and here's hoping to see Apple press the charges for industrial espionage, get that ex-engineer in jail for 25 years and sue him for every $$ he and his company's worth.

    Taking innate knowledge and all the trade secrets you learned about your employer's product AND then using that to go to work creating or working for a company whose purpose is to subvert that product is almost as severe a breach of IP a product engineer can commit....

    • Re:Sue their arse (Score:5, Insightful)

      by Anonymous Coward on Friday March 09, 2018 @02:30PM (#56234539)

      Unless it's Apple's way of circumventing the public outcry they'd be suffering under if it was found out they don't actually believe in security for their users the way they've been saying. Seriously, my very first thought reading that sentence is, "Ah, Apple found a way to give the government what they wanted without getting blamed for it directly."

    • by Anonymous Coward

      >Taking innate knowledge

      That word doesn't mean what you think it means.

    • Re: (Score:1, Flamebait)

      That ex-security-engineer must be violating like 20 different agreements that Apple makes their employees that build their products sign

      Many of those agreements are very difficult to enforce under California law.

      almost as severe a breach of IP a product engineer can commit....

      He is using knowledge that Apple willingly gave him to create a product that does not compete with any Apple product. It is questionable if he is breaking any law, much less one that can be enforced.

  • by Anonymous Coward on Friday March 09, 2018 @02:25PM (#56234521)

    if the DMCA doesn't outlaw this, it should be revamped to cover this


  • by Anonymous Coward on Friday March 09, 2018 @02:31PM (#56234555)

    If people keep their own copyrighted photos on their phones, then you're definitely circumventing access controls to copyrighted works when you crack a phone. Therefore, DMCA [] is an extremely relevant law with regard to Greykey.

    DMCA has exceptions for law enforcement, so if you're a cop then you're allowed to crack the DRM on peoples' photos. Here's that part:

    This section does not prohibit any lawfully authorized investigative, protective, information security, or intelligence activity of an officer, agent, or employee of the United States, a State, or a political subdivision of a State, or a person acting pursuant to a contract with the United States, a State, or a political subdivision of a State. For purposes of this subsection, the term âoeinformation securityâ means activities carried out in order to identify and address the vulnerabilities of a government computer, computer system, or computer network.

    This means that if Greykey is contracted by the cops, they're also allowed to circumvent the DRM. Ass is covered, similarly to what that Israeli service is rumored to do (where AFAIK they crack the DRM rather than provide a tool for the cops to do it themselves).

    The problem, though, is before the cracking: if they have a software product that they sell to cops, were they under contract when they developed it? If they weren't, then they defintely violated the law when they "manufacture[d] a technology, product, service, device, component, or part thereof" for circumvention.

    Furthermore, unless the cops contracted them to advertise their services, they might have been violating DMCA when they "import [or] offer to the public" that software product. I find it hard to believe that someone in government contracted them to sell the product to others in government. Maybe the FBI paid them to sell their software to local police, but we might as well make them show that in court, because I think the public would be fascinated to see that contract. Congress would like to see that contract too.

    But the manufacturing violation is less iffy. They'll almost certainly get busted by a judge, if you can get 'em to the judge.

    Someone (anyone who has an iPhone and has used the camera) should sue them, so that we can get a judge to decide this stuff.

    • Mostly good, but your mistake is with the word "for" in the construct, "for circumvention."

      Courts don't play word games, they're way stricter in how they use words than that. "For" in that case doesn't stick to any word you put next to it; it sticks to what they actually did. So it doesn't matter if you can describe their conduct as circumvention. You don't just then get to substitute the word circumvention instead of what they did.

      If they were manufacturing it to sell to law enforcement, or to use on behal

  • by OzPeter ( 195038 ) on Friday March 09, 2018 @02:32PM (#56234559)

    I have previously heard cracking techniques described as "security vulnerabilities". Given the ludicrously cheap price of this GreyTool and the huge amount of cash in Apple's bank accounts if I was Apple I would be buying a copy (via assorted shell companies) and seeing how they work and then rolling the countermeasures back into their products. Doing so would be a great way to get cheap security research done for you.

    Alternatively Apple could show that the product doesn't work as advertised, or provide advice on how to mitigate its functionality by updating their "security best practices" document (that I am sure they have somewhere)


  • by Anonymous Coward on Friday March 09, 2018 @02:38PM (#56234603)

    So, I don't want to Godwin this entire thread, but quite honestly I view companies which do this as little better than Nazi Sympathizers.

    They don't care about the potential harm they do, they don't treat this on a case by case basis -- they're just providing a carte blanche tool to police.

    And, like all such people, I'm sure they're fairly indiscriminate about selling to the nastier countries with terrible track records on human rights.

    I bet there is little to no judicial oversight in how these tools are being used, because the police don't care for such things.

    Sorry, but making and selling tools like this should make you a target. You clearly don't give a damn about the finer details of when this is used and the impact to people's lives .. so why the fuck should we give a fuck about your life?

    There is no claim of "how was I to know" or "I was just following orders". This is straight up helping a totalitarian state for profit.

    Morally, I don't see the difference between these guys and the people who helped the Nazis.

    This is why there can never be backdoors for law enforcement. Fuck 'em all.

    • I'd say that Apple is closer to being 'the nazis' than these folks. Or at least as close.

      Not that some stupid godwin reference matters.

      And why should people who don't use an iPhone give a fuck about any of the details of your life, since you brought that tone to the discussion?

  • by Anonymous Coward

    For telling us it is secure.

    • For telling us it is secure.

      Unfortunately, words stated without modifiers are not presumed by the Courts to be impossible absolutes, but rather to be typical values of the word.

      So telling you it is secure, that means secure, as in the state something is in after an effort to secure it.

      Compare also, "my money is in a safe" to "my money is safe" and "your money is safe with us!" Safe means a lot of different things, there is no expectation that it always mean, "unblemished until the heat death of the Universe." If steps were taken to ma

  • by 8127972 ( 73495 ) on Friday March 09, 2018 @02:47PM (#56234653)

    How do we know that any of this stuff actually works? For all anyone knows, these companies are selling smoke and mirrors.

    • One of the most generic examples that Courts bandy about in false advertising cases, and some types of fraud cases, is: "What if you sell a bunch of guns to the government, and they don't shoot?" That's the default example of selling something that doesn't do what it says it does.

      So the answer is, we know it works because they didn't get in trouble after selling it to the government!

      If you sell it to a private party, there is a lot more gray area about arguing what the device was for, and what the appropria

    • by AHuxley ( 892839 )
      NSA ANT catalog []
      Greek wiretapping case 2004–05 []–05
      SISMI-Telecom scandal [] SISMI-Telecom scandal
      Operation Socialist [] Operation Socialist
      The past is full of security services getting the trapdoors and backdoors and keys into nations telco systems.
      Can US city and state police with federal task forces and that extra funding afford the same in 2018?
      The telcos an
  • by CaptainDork ( 3678879 ) on Friday March 09, 2018 @02:48PM (#56234661)

    The fucking NSA, via ShadowBrokers.

  • LOL! I have a Samsung that doesn't have a single lock on it. I wonder how long and much money it would cost them to crack it?
  • Buyer beware. I imagine using cheap 3rd party stuff on the iPhone will void the warranty. But, to be fair, the official "iCrack" software from Apple is *super* expensive - and you have to get a reservation at an Apple store Genius Bar, wait in line, drop the phone off, talk to a guy with a goatee, etc ...

  • Paid apps are next shit impossible to break as locked with quantum computers never unlocking ever, you bought what is coming with ignorance. Cops sucking the data from the phones of those they stopped like Chinese Communist caused this in the first place. Is there no part of American government not rock stupid?
  • So will Apple (or a suitable proxy/agent/front) for $30,000, buy this Greykey so it can plug the hole(s)?

  • I think it's just better to go low tech nowadays. I'd rather go back to a basic flip phone.

This process can check if this value is zero, and if it is, it does something child-like. -- Forbes Burkowski, CS 454, University of Washington