XRY's two-minute iPhone passcode exploit debunked
Late last month we reported Swedish security firm Micro Systemation claimed its XRY application was capable of cracking an iOS device's passcode, logging keystrokes, and accessing data like GPS, call logs, contacts, and messages.
Context & Ripple Effects
Swedish forensics firm Micro Systemation drew wide pickup late last month when it claimed its XRY application could crack an iPhone passcode in two minutes while logging keystrokes and pulling GPS traces, call logs, contacts, and messages. Follow-up reporting has now debunked the two-minute claim, and the correction traveled almost as far as the original — The Verge and iClarified both carried it. That matters because XRY is sold into law enforcement, where a vendor's cracking claims are procurement currency.
The episode fits a longer arc of iOS security claims outrunning verification: back in November 2008, a developer-level exploit was shown undermining App Store security by letting apps run arbitrary code, setting the pattern of dramatic iPhone vulnerabilities announced before being fully vetted.
First-order effects
- Micro Systemation's credibility takes a direct hit with its law-enforcement customer base, which buys XRY precisely on the strength of its claimed extraction capabilities against locked iPhones.
Second-order effects
- Rival mobile-forensics vendors now have an opening to position their own tools against XRY's overstated claim, pushing competition toward demonstrable rather than advertised capability.
Third-order effects
- If forensic-tool marketing continues to be debunked publicly, buyers will demand independent verification of cracking claims before purchase, and Apple's lock hardening becomes the benchmark every vendor's pitch is measured against.
The trend: Mobile-forensics vendors' device-cracking claims are increasingly stress-tested in public before law enforcement spends on them.