GrayKey, the tool law enforcement's been buying to unlock iPhones, appears to work by brute forcing passcodes, another reason to use a strong alphanumeric code
Lorenzo Franceschi-Bicchierai / Motherboard :
Context & Ripple Effects
The $15K GrayKey box surfaced in March as a black-box mystery marketed to police, and an investigation found the State Department and local departments already buying it, with the Secret Service and DEA circling. What it actually did inside was unknown — until now.
Naming the mechanism matters because it turns GrayKey from an unpatchable magic box into a math problem: if the attack is brute-forcing passcodes, then passcode length is the defense, and Apple's countermeasures — like USB Restricted Mode in iOS 11.4.1 — have a clear target to cut off.
First-order effects
- Agencies that paid $15K or more per unit now know their purchase has a ceiling: a four-digit numeric code falls fast, while a long alphanumeric code can push brute-force time beyond practical limits — meaning the tool's real-world yield depends on victims' passcode hygiene.
- iPhone owners with weak passcodes are directly exposed today, since the attack needs no zero-day exploit chain, only time and repeated guesses against the device.
Second-order effects
- Apple's mitigation playbook writes itself once the mechanism is known: USB Restricted Mode was the first move, and sources later reported GrayKey could no longer break passcodes on any iPhone running iOS 12 or above — each OS update resets the tool's capability.
- The economics of the gray market shift toward supply: hackers probing iPhone internals rely on prototype iPhones with security features disabled, and a brute-force-based tool raises the value of hardware and bugs that speed up guess attempts.
Third-order effects
- If the pattern holds, phone extraction becomes a recurring arms race rather than a one-time break: leaked documents show Graykey still pulling partial data from iPhones up to the iPhone 16 on iOS 18 years later, with each Apple hardening cycle followed by a new tool generation sold to police.
- Structurally, the burden of device security shifts partly onto users — passcode strength becomes a policy question for agencies and enterprises issuing iPhones, since the vendor cannot fully close a brute-force vector that starts at the lock screen.
The trend: Law-enforcement phone unlocking is settling into a cyclical arms race in which each Apple OS hardening knocks out tools like GrayKey until the next extraction technique — and next sale — arrives.