Redaction Failure Shows Grayshift Is Swearing Cops To Secrecy About Its Phone-Cracking Tech

from the paying-for-the-privilege-of-being-told-to-shut-up dept

Law enforcement loves its new tech advances. It also hates to talk about them, operating under the assumption that the business of serving the public isn't the public's business. When pressed, officials will say something about staying one step ahead of criminals. But more often the opacity is nothing more than antagonism directed at people who expect transparency from those cashing publicly funded paychecks.

In some cases, this antagonism extends to the courtroom. The desire to keep secret methods secret upends the evidentiary process. When evidence can't be laundered through parallel construction, prosecutors may drop cases if it means discussing cop tech in court. This includes devices like cell tower simulators, which have been publicly discussed for years.

Added to the mix are non-disclosure agreements foisted on agencies by government contractors. Some of these NDAs go so far as to demand agencies route public records requests through them. The FBI has occasionally pitched in, telling prosecutors to drop cases rather than discuss "sensitive" tech.

This opacity isn't just for Stingray devices. It also applies to cellphone-cracking tech sold by a handful of companies. Public records obtained by Motherboard show Grayshift -- the maker of GrayKey -- is trying to keep information about its products out of the public's hands. In a case of apparent redaction failure, the documents provide a few more details about GrayKey… as well as Grayshift's demands that this information remain secret.

"Without limiting and foregoing, you acknowledge and agree that you will not disclose the existence of any GrayKey features and solutions designed to circumvent USB Restricted Mode released in iOS 11.4.1 and updated throughout future iOS versions made available to you on or about the date hereof," one section reads.

The original document redlines the part about the Restricted Mode, suggesting this was supposed to be redacted before releasing the confidentiality agreement to the public. Unfortunately for the Illinois State Police, this slipped out.

So did some other stuff from other law enforcement agencies. Motherboard's quest for Grayshift documents also turned up a request to create an exception in public transparency laws for this specific law enforcement tech.

"I am requesting a public records exemption to disclosure for the purchase of the GrayKey system for the Digital Forensics Lab," a City of Orlando law enforcement official wrote to the chief of police in 2018, according to a copy of the letter obtained by Motherboard. "This will prohibit Purchasing from posting notice of the purchase and disclosing acquisition of this system. This will assist in protecting our forensic examination techniques, and capabilities."

This isn't the way to handle this. Agencies can attempt to withhold documents by citing exceptions, but it's up to the state Attorney General (and the courts if a lawsuit ensues) to make the final call. Law enforcement officials shouldn't be asking for new exceptions or blanket application of existing exceptions. They also shouldn't be asking to undermine part of the public procurement process by seeking to withhold even more information from the public.

As for Grayshift, it says there's nothing wrong with these confidentiality agreements. It says they only apply to "intellectual property," not the mere existence or use of the devices. So, there's no reason to redline information about tech advancements, since it's not technically intellectual property, but rather just an undetailed discussion about one application of its tech. Grayshift also says the NDAs are not meant to be read as affirming the withholding of evidence (or the source of evidence) in prosecutions. But there's no telling how its customers are interpreting the agreement and -- given the history of other tech utilized by law enforcement -- it's safe to say someone's going to believe this means cases should be dropped or evidence laundered if it involves tech they haven't discussed publicly.

Filed Under: accountability, foia, graykey, nda, police tech, secrecy, surveillance, transparency
Companies: grayshift

'Press X To Apply Fourth Amendment:' Documents Show How GrayKey Brute Forces IOS Passwords

from the device-helpfully-backlit-to-combat-going-darkness dept

Consecutive FBI directors (James Comey, and Chris Wray) have declared a small scale war on encryption. Both of these directors relied on inflated numbers to make their case -- an error chalked up to software rather than rhetorical convenience. (The FBI has refused to hand over a correct count of encrypted devices in its possession for more than three years at this point.)

The FBI's narrative keeps getting interrupted by inconvenient facts. Proclamations that the criminal world is "going dark" are often followed by the announcement of new exploits that give law enforcement the ability to decrypt phones and access their contents.

Grayshift is one of the vendors selling phone-cracking tech to law enforcement agencies. The company has an ex-Apple security engineer on staff and has been duking it out with the device manufacturer for the past few years. It seems to be able to find exploits faster than Apple can patch them, leading to a tech arms race that law enforcement appears to be able to win from time to time.

Joseph Cox at Motherboard has obtained more documents about Grayshift's phone-cracking device, GrayKey. Apple prides itself on providing secure devices. But it appears GrayKey is still capable of bypassing iOS security features, enabling investigators to brute force device passwords. And it can still do this even if the targeted device is on the verge of battery death.

The instructions describe the various conditions it claims allow a GrayKey connection: the device being turned off (known as Before First Unlock, or BFU); the phone is turned on (After First Unlock, or AFU); the device having a damaged display, and when the phone has low battery.

"GrayKey known to install agent with 2 to 3% battery life," the document reads, referring to the "brute force agent" GrayKey installs on the phone in order to unlock the device.

This suggests the agent doesn't demand too much from the processor when installing. It also suggests GrayKey's devices are portable, allowing cops to attempt to access phone contents while away from the office with limited options for charging seized devices.

The device includes a 1.5-billion word dictionary that can be utilized during brute force attacks to guess alphanumeric passwords. The instructions obtained by Motherboard also indicate the device has the power to extract metadata from "inaccessible" files -- something it can apparently do even if the device is still in a locked state.

And Grayshift truly cares about your rights, Joe and Judy Criminal Suspect.

"Prior to connecting any Apple mobile device to GrayKey, determine if proper search authority has been established for the requested Apple mobile device," the document reads.

Yeaaaaaahhhhh... that should do it. Grayshift has no way of enforcing this so cops are on the honor system. And we've all seen how great cops are at keeping themselves honest. This little nod towards Supreme Court precedent and Fourth Amendment doesn't even ask for something like a supervisor's passcode prior to operation to help ensure all the proper paperwork is in order. Left to their own devices, cops are bound to illegally access suspects' devices.

And if brute forcing doesn't work, there's another built-in option -- one covered here previously. GrayKey can surreptitiously install a very targeted keylogger that records the passcode when it's entered by the phone's owner. Cops can get their largesse on and give suspects back their devices so they can copy down phone numbers or let people know where they're at. And when suspects unlock their devices to this, cops are CC'ed by Grayshift's malware.

The battle between government contractors and device makers continues. And as long as it remains a battle in which neither party has proven to be able to hold a lead, it's disingenuous to claim -- as Chris Wray and James Comey have -- that encryption is a barrier impossible to overcome.

Filed Under: 4th amendment, cracking, doj, encryption, fbi, going dark, graykey, hacking, ios
Companies: apple, grayshift

On The Same Day The FBI Claimed No Vendor Could Crack IPhones, Another Way To Crack IPhones Made The News

from the way-to-stay-ahead-of-the-news-cycle,-Chris dept

At the same time the FBI director was claiming the private sector (other than Apple) couldn't help agents break into encrypted iPhones, the private sector was once again demonstrating it could do exactly that. Chris Wray's remarks to the press centered less on the underwhelming news that the FBI had conclusively linked the Pensacola Air Base shooter to al Qaeda than on Apple's supposed unhelpfulness.

The FBI claimed it had found a way to access data on the shooter's phones, but provided no details on its method. Maybe agents brute forced a passcode. Maybe they just found a side door that allowed them to exfiltrate the data they were looking for. Whatever it was, it wasn't something provided by a vendor. In fact, Chris Wray went so far as to claim the media was misleading the public about the availability of encryption-breaking/bypassing tech.

We canvassed every partner, and every company, that might have had a solution to access these phones. None did, despite what some claimed in the media.

Within a few hours of this assertion by Wray, the media was again reporting on another tech solution for encrypted iPhones. Here's Olivia Solon for NBC News:

[A]nother tool, previously unknown to the public, doesn't have to crack the code that people use to unlock their phones. It just has to log the code as the user types it in.

Software called Hide UI, created by Grayshift, a company that makes iPhone-cracking devices for law enforcement, can track a suspect's passcode when it's entered into a phone, according to two people in law enforcement, who asked not to be named out of fear of violating non-disclosure agreements.

The software is deployed by existing GrayKey devices -- the same ones Grayshift claims can crack iPhone passcodes by installing a user agent to bypass Apple's lockout countdown. This would be the same software/hardware Chris Wray claims can't do any of these things, despite extensive reporting on claims the manufacturer itself makes.

After dropping the surreptitious tracker on the targeted phone, the phone is returned to the suspect in hopes that they'll input their passcode.

For example, a law enforcement official could tell the suspect they can call their lawyer or take some phone numbers off the device. Once the suspect has done this, even if they lock their phone again, Hide UI will have stored the passcode in a text file that can be extracted the next time the phone is plugged into the GrayKey device. Law enforcement can then use the passcode to unlock the phone and extract all the data stored on it.

The software also disables airplane mode and disables wiping of the device. A snapshot of the system is taken to track any attempted deletion of phone contents.

This seems to do all the things the FBI claims no one can actually do. Sure, it won't scale -- especially since it requires a fair bit of subterfuge on the part of investigators and relies on the trust of criminal suspects who might find it suspicious their seized phone has suddenly been returned to them. But no technique for bypassing encryption ever will. And none of them should.

Asking a suspect for the combination to a safe will only unlock that safe, not every safe seized during searches. Phones are as unique as the individuals carrying them. So are the circumstances surrounding the attempted searches. One size should not fit all and the encryption backdoors Chris Wray wants only ensure everyone -- criminal or not -- will be negatively affected by law enforcement's newly-greased wheel.

Then there's the secrecy surrounding this tech. The NDAs Grayshift force on law enforcement customers means judges, defendants, and defense lawyers aren't being told what's being used to open up phones and search their contents. We've spent years detailing the opacity shrouding the deployment of Stingray devices -- something that has allowed law enforcement to avoid having warrant requirements imposed on them. The same thing is happening here. There's a legal way to do this. But the secrecy imposed by the tech provider tends to provide the cover officers need to operate these unlawfully. Here's the best case scenario, followed immediately by the most likely scenario.

“Law enforcement use of this ‘agent’ keylogger feature can be legal, so long as the warrant the government gets to search and seize the device spells out that the investigators are permitted to use it,” said Riana Pfefferkorn, associate director of surveillance and cybersecurity at Stanford Law School’s Center for Internet and Society. “In general, I don't think that magistrate judges authorizing search warrants would expect that the government plans to implant malware on a device it has seized.”

There are solutions out there. And they're not legislative mandates compelling assistance breaking encryption or backdoors for law enforcement. There are ways to bypass or crack what Bill Barr and Chris Wray have decided to call "warrant-proof encryption." Pretending there isn't while using an investigation press conference as a grandstand for Apple bashing isn't moving the conversation forward. It's just giving everyone one more reason not to trust Bill Barr or Chris Wray.

Filed Under: chris wray, cracks, encryption, fbi, hide ui, iphone
Companies: apple, grayshift

ICE Tops Its Old Record, Spends Another $820,000 On Cellphone-Cracking Tools

from the putting-Grayshift-execs'-kids-through-college dept

As consecutive heads of the FBI have whined about the general public's increasing ability to keep their devices and personal data secure with encryption, a number of companies have offered tools that make this a moot point. Grayshift -- the manufacturer of phone-cracking tool GrayKey -- has been selling hundreds of thousands of dollars-worth of devices to other federal agencies not so insistent the only solution is backdoored encryption.

ICE is one of these agencies. It led all federal agencies in phone-cracking expenditures in 2018. It spent $384,000 on these tools last year. It wasn't just ICE. Other agencies like the DEA and [checks notes] the Food and Drug Administration have also purchased these devices. But ICE led the pack, most likely because ICE -- along with DHS counterpart CBP -- are engaging in more suspicionless, warrantless device searches than ever.

When you don't have a warrant or consent, a third-party tool that can undermine device encryption is the next best thing. ICE must have a lot of phones to search -- or plans on amping up its search count -- because it's more than doubled its spending on GrayKey devices alone. Thomas Brewster of Forbes has more details.

The U.S. Immigration and Customs Enforcement (ICE) splurged $820,000 on tech made by Grayshift. The Atlanta-based company makes the GrayKey, previously described as the world's best iPhone hacking tech for police and intelligence agents, allowing them to break passcodes and retrieve information from inside Apple devices.

The contract, signed just last week, takes the immigration department's spend with the company to over $1.2 million, following a $384,000 Grayshift deal last year. That's the most spent on the superpowered iPhone hacking service by any government department, local or federal, looking across public records. The deal also marks Grayshift's biggest publicly known contract to date, according to a federal procurement database and state-level records. Its previous biggest, of $484,000, was with the U.S. Secret Service.

Maybe ICE just didn't want the Secret Service to top the list of encryption-breaking expenditures for this fiscal year. Or, more likely, it's seizing devices at a record pace and can't keep up with the rising tide of locked phones it's created.

The problem with this isn't that the government has access to devices like this. It's that ICE (and CBP) are operating in a super-gray area, legally-speaking. While courts have tended to allow warrantless searches under the border exception, the agencies themselves have only made this worse by refusing to enact meaningful guidelines that would curb abuses and careless handling of peoples' devices and data. They've created a "wild west" atmosphere every place someone could cross a border, which includes a number of inland international airports.

Tools that make it easier for the government to access peoples' papers and communications without a warrant isn't good news for anyone. It's a safe bet that if the judicial and political climate doesn't change, 2020 will bring another record ICE expenditure next year.

Filed Under: cellphone cracking, encryption, ice, phone cracking
Companies: grayshift

Apple Finally Shuts Down Security Flaw Used By Phone-Cracking Vendor

from the indiscriminate-protection dept

In a move that will anger law enforcement (but really isn't about law enforcement), Apple has succeeded in killing an exploit that allowed a third-party vendor to crack iPhones for investigators. A few months ago, Apple announced it was fixing the flaw that allowed products like GrayKey to bypass built-in security features to engage in brute force password guessing. Thomas Brewster of Forbes confirms the fix is finally in.

Multiple sources familiar with the GrayKey tech tell Forbes the device can no longer break the passcodes of any iPhone running iOS 12 or above. On those devices, GrayKey can only do what’s called a “partial extraction,” sources from the forensic community said. That means police using the tool can only draw out unencrypted files and some metadata, such as file sizes and folder structures.

Some in law enforcement may view this as confirmation of their "going dark" complaints and claim that Apple cares more about its customers than it does about fighting crime. As if that was bad thing. Apple should care more about what its customers want and need than government access to locked devices. A security hole is a hole that can be used by everyone who can exploit it. There's no way to prevent a flaw from being exploited by criminals even if law enforcement agencies find the exploit super-useful.

Grayshift's products are still somewhat useful, but it's going to be hard to justify a premium price for a stunted service. This new development might be Grayshift's fault. Soon after Apple announced one fix for an exploit used by Grayshift, the company bragged it could still crack phones just as easily. This appears to have prompted closer examination of the problem Apple thought it fixed with the first round of patching. The second pass has blunted the exploit's usefulness, even if it hasn't made it completely impossible to access some data contained in locked devices.

Even with the fix in play, law enforcement complaints about "darkness" are overblown. There are other technical solutions available, along with a wealth on information stored by third parties and cloud services. The more technical solutions won't scale, but that's not really something law enforcement should complain about. Security protections for phone owners shouldn't be viewed as weapons deployed against law enforcement. Phone manufacturers have an obligation to their customers to protect their personal data, and encryption is just one of the tools deployed to keep customers' information out of the hands of others. That some of the "others" are cops and investigators is just a side effect of providing solid products and service.

This won't make government critics of Apple any happier, though. And its closing of security holes is just going to lead to more demands for anti-encryption laws. Very few legislators seem interested in mandating backdoors, so these complaints aren't gaining any traction. But government agencies like the FBI have endless time and infinite resources, so the calls for backdoors will never completely cease -- not as long as there's a chance a major tragedy might prompt reckless Congressional action.

Apple's protection of its users is great, but its sincerity should be questioned when it's willing to put Chinese users' data where the Chinese government can easily access it. If it wants to be a champion for its customers, it needs to protect all of them, not just the ones it's currently convenient to protect. When you've got to explain why you're "locking out" US law enforcement but letting a foreign government walk in the front door, you're doing customer service wrong.

Filed Under: backdoors, cracks, encryption, graykey, iphone, law enforcement
Companies: apple, grayshift

There Is No Going Dark: Another Vendor Selling Tool That Cracks All iPhones

from the FBI's-dystopian-fiction-develops-another-plot-hole dept

The FBI continues to push its "going dark" theory. It's not interested in the truth. It would rather have a legislative mandate or a string of favorable court decisions than utilize options vendors have made available. These are the candles the FBI will forgo to publicly curse the darkness. A recent Inspector General's report made it crystal clear: those charged with finding a way to crack open the San Bernardino shooter's cell phone slow-walked their search in hopes of ending up with a judicial mandate forcing Apple to crack its own encryption.

The complaints about the darkness continue, even as vendors like Cellebrite have shown they can crack any iPhone given enough money and time. There are solutions out there, but the FBI doesn't want them. Cellebrite isn't the only company with an iPhone crack for sale. As Joseph Cox reports for Motherboard, another device has surfaced that can brute force its way past iPhone lock screens. The FBI may continue its disingenuous push for weakened encryption, but law enforcement agencies around the nation are more than willing to pay for a solution that doesn't involve Congressional reps or federal judges.

Grayshift has been shopping its iPhone cracking technology to police forces. The firm, which includes an ex-Apple security engineer on its staff, provided demonstrations to potential customers, according to one email.

"I attended your demo presentation recently held at the Montgomery County Police Headquarters and was pleased by your product's potential," an Assistant Commander from the Technical Investigations Section at the Maryland State Police wrote in an email to Grayshift in March.

The GrayKey itself is a small, 4x4 inches box with two lightning cables for connecting iPhones, according to photographs published by cybersecurity firm Malwarebytes. The device comes in two versions: a $15,000 one which requires online connectivity and allows 300 unlocks (or $50 per phone), and and an offline, $30,000 version which can crack as many iPhones as the customer wants. Marketing material seen byForbes says GrayKey can unlock devices running iterations of Apple's latest mobile operating system iOS 11, including on the iPhone X, Apple's most recent phone.

According to documents obtained by Motherboard, multiple state and local law enforcement agencies have purchased Grayshift's device. The documents also show many agencies expressing an interest in picking up a GrayKey, including some at the federal level, like the DEA and, oddly enough, the FBI. The FBI doesn't appear to have acquired one yet, but if that's the case, it's lagging behind local PDs with less funding and tech expertise. It's also trailing the State Department, which has already acquired at least one of the devices.

The device comes in two flavors: an online version with a fixed number of unlocks or an offline version that retails for twice as much ($30,000) but can be used as often as the purchaser wants (or until Apple fixes the vulnerability, whichever comes first). The brute force method deployed takes anywhere from 2 hours to several days, depending on passcode complexity.

"Going dark" is a convenient lie. The FBI has been deliberately misconstruing reality for a couple of years now, beginning with then-director James Comey's coining of the phrase. Even while Comey was peddling his "going dark" theory to security researchers, Congressional reps, and federal judges, the FBI was rarely having trouble accessing device contents. In 2016, the FBI admitted it could access the contents of passcode-protected devices 87% of the time. Somehow, despite only incremental changes in encryption offerings, the small number of locked devices has grown from ~880 to over 7,000 in two years. This suggests FBI officials are more interested in generating a "going dark" narrative than actually deploying available tech to access contents of seized devices.

The existence of another device capable of cracking iPhone encryption should be good news for the FBI. Other law enforcement agencies apparently view this as a plus. The downside for those not employed by the government is that there's a vulnerability in iPhones Apple hasn't fixed yet. And, given the intense secrecy surrounding vendors of exploits, we have no idea how many governments have purchased iPhone-cracking devices. It's unlikely Hacking Team is the only exploit vendor selling to authoritarian governments and UN-blacklisted countries. It's just the only one to have been caught doing it. An exploit is an exploit and it will be used by the good and the bad.

Not that relegating it to "good" law enforcement agencies is necessarily a huge improvement. Authoritarian regimes may use tools like this to go after critics and stifle dissent, but let's not forget the FBI has a long history of doing exactly the same thing under the guise of protecting public safety. And, at this point, the FBI isn't being honest about its weapons stockpiles during this Crypto Cold War. Sure, it needs to retain some sort of tactical advantage -- whether it's pursuing bad guys or legislation -- but it should never be granted full credibility when it talks about thousands of unlocked phones, the coming darkness, and how much security we should be forced to give up in the name of public safety.

Filed Under: doj, encryption, fbi, going dark, hacking, iphones, smartphones
Companies: apple, cellebrite, grayshift