Apple debuts iOS 11.4.1 with USB Restricted Mode to stop Lightning data transfer after an hour of device being locked, shutting out cracking tools like GrayKey
Chris Welch / The Verge :
Context & Ripple Effects
This ships the feature Apple previewed two months ago: after reporting that GrayKey appeared to work by brute-forcing passcodes against iPhones police had seized, Apple moved from a week-long Lightning lockdown in the iOS 11.4 beta to the one-hour data cutoff it announced in June, now landing in iOS 11.4.1.
The timing is awkward by design of the news cycle — the same day, researchers demonstrated that plugging in a compatible USB accessory can keep the port alive past the hour mark. That gap is the whole story: the defense is real, and so is the first known route around it.
First-order effects
- Law enforcement agencies that bought GrayKey lose their window on any iPhone running iOS 11.4.1 or later — extraction now depends on getting to a device within the first locked hour or finding a bypass.
- Everyday iPhone users get passcode brute-force protection as a default rather than an opt-in, with no configuration required.
Second-order effects
- Forensic vendors and their agency customers pivot to the documented weaknesses: the USB accessory workaround researchers published the same day becomes the immediate target for keeping GrayKey-class tools alive.
- Agencies face a new trade-off between evidence access and device security — advising seizure workflows around old iOS versions conflicts with patching vulnerabilities, pressuring them toward vendor relationships like GrayKey's rather than OS exploits.
Third-order effects
- If the pattern holds through what Forbes later reported — GrayKey failing outright on iOS 12 and above — phone unlocking shifts from cheap hardware boxes to bespoke zero-day research, raising the price of access for police and pushing the legal fights over compelled decryption into courts instead of toolkits.
- Apple's escalation path here runs straight into Lockdown Mode in iOS 16, suggesting device-side anti-forensics hardening became a standing product category rather than a one-off response.
The trend: Phone makers are converting forensic-cracking countermeasures into default OS behavior, forcing law-enforcement access onto an escalating exploit arms race they no longer control.