Leaked documents: Graykey, a phone unlocking tool used by police, can access “partial” data from the iPhone 12 up to the iPhone 16 running iOS 18 or iOS 18.0.1
The Graykey, a phone unlocking and forensics tool that is used by law enforcement around the world …
404 MediaJoseph Cox
Context & Ripple Effects
Graykey’s iPhone-access claims have swung with iOS defenses: it was reported able to unlock current iPhones in 2018, then reportedly unable to break devices on iOS 12 or later. The new documents indicate that the contest has again produced a measurable, if limited, opening.
Law-enforcement users of Graykey may be able to retrieve some data from affected iPhones running the specified early iOS 18 releases, rather than treating those devices as wholly inaccessible.
Apple’s device-security posture faces a newly documented partial-access gap across multiple recent iPhone generations.
Second-order effects
Graykey gains a comparative advantage where competing forensic tooling has reported limits on newer iOS versions, potentially shaping which tool agencies prioritize for iPhone examinations.
The distinction between “partial” access and a full unlock becomes operationally important: investigators must adapt collection and evidentiary workflows to the data Graykey can actually retrieve.
Third-order effects
The episode reinforces a recurring capability race in which iOS updates can close one forensic path while vendors develop or regain narrower forms of access; durable security claims increasingly hinge on the exact device and software version.
If partial extraction becomes the normal frontier, the market may shift from binary “unlock” claims toward granular, version-specific data-access capabilities and their associated oversight.
The trend: Mobile forensics is moving toward an ongoing, version-by-version contest between platform hardening and law-enforcement extraction tools, with partial access increasingly consequential.
New: One of the first leaks ever about Graykey, the iPhone hacking tool used by cops to break into people's phones. Granular detail about what info it can get and from what phones and which operating systems. A reminder to always always update your OS immediately: — https://w…
@josephfcox April 2024 is when Google shipped the firmware reset attack mitigation feature we proposed to fix a vulnerability we reported which was being exploited in the wild by MSAB for their XRY tool: https://x.com/... It looks a lot like Graykey used the same vulnerability.
Then this is modern Google-made Pixel devices. The Android sheet itself is much more varied, given the differences between Android's ecosystem of phones. AFU means only partial data if user has unlocked device since booting https://www.404media.co/... [image]
Got an Android? An iPhone? Want to know if your phone can be cracked by some secretive forensics software? Links at the bottom of this article point directly to the full spreadsheets.
New from 404 Media: we've obtained and published the list of iPhone and Android devices secretive phone unlocking tech Graykey was able, or unable, to get data from recently. Unprecedented leak, we've never seen this granularity from Graykey before https://www.404media.co/... [im…
New: One of the first leaks ever about Graykey, the iPhone hacking tool used by cops to break into people's phones. Granular detail about what info it can get and from what phones and which operating systems. A reminder to always update iOS immediately: https://www.404media.co/..…
This section shows Graykey's capabilities against iPhones running iOS 18 and 18.0.1. Can only obtain partial data on modern phones running that operating system https://www.404media.co/... [image]