A company that makes phone hacking devices claims to have developed a solution that freezes iPhones in a state that lets cops more easily access sensitive data inside them, according to a video obtained by 404 Media.
uncertain
cops → make → Media
This is the latest salvo in the never-ending battle between Apple and companies that help cops — sometimes those in authoritarian countries — break into iPhones.
asserted
cops → end → iPhones
In November 2024, 404 Media revealed Apple quietly introduced a new feature in iOS that automatically reboots an iPhone that has not been unlocked for 72 hours.
asserted
that → reveal → hours
The idea behind this so-called “inactivity reboot” is to revert the phone to a state that makes it harder for police to break into the device, and thus extract sensitive data from it with forensics technology.
asserted
police → call → technology
At the time of Apple’s change, law enforcement agents expressed concern about this new feature, given that oftentimes they can’t immediately try to break into iPhones that have been seized.
asserted
that → express → iPhones
That could be because police are still waiting for a court authorization to do so, or there is simply a backlog of devices to unlock, for example.
uncertain
police → wait → example
The new technology to get around inactivity reboot was developed by Magnet Forensics, the company behind GrayKey, a popular tool sold to law enforcement agencies that allows them to unlock and access data stored in iPhones and Android smartphones.
asserted
them → get → iPhones
Magnet has developed a new device called GrayKey Preserve and a feature for its regular GrayKey devices called Evidence Preservation Mode, according to the video.
“This is an absolute game changer for iOS forensics and a function that I wish we had years ago,” a Magnet employee says in the leaked video, specifically mentioning that the solution is targeted at the iPhone’s inactivity reboot feature and the data it makes unavailable.
uncertain
it → develop → feature
GrayKey Preserve and Evidence Preservation Mode are also designed to combat another iPhone feature that automatically deletes certain data — such as cached locations, and recently deleted photos and iMessages — after a certain number of days.
asserted
that → design → days
“We're gonna be able to preserve that data for an infinite amount of time.”
asserted
We → go → time
The educational and tutorial video, which was made exclusively for law enforcement agents and appears to be dated early 2025, does not explain the technical details behind this new product and feature, but gives some strong hints as to how it works.
asserted
it → make → hints
404 Media granted the person who provided it anonymity because they were not authorized to share it with third parties.
asserted
they → grant → parties
“Now, one of the many things that the GrayKey Preserve is going to do, as part of all of this, inside of our initial access, is it's going to enable Airplane Mode, or more specifically, it's gonna disable our radio transmissions like Bluetooth, Wi-Fi and cellular.
asserted
it → go → Bluetooth
In doing this, that's not only going to allow you to preserve the data in the field, but also isolate the data in the field,” the employee explains.
asserted
employee → do → field
“Even if that device doesn't have the ability to turn on Airplane Mode or to turn off the transmitters through the Control Center of iOS.
asserted
device → have → iOS
Once initial access is gained and the device is in a preserved state, we also disable all of those radios to make sure that that data cannot reach that device.”
asserted
data → gain → device
The idea behind GrayKey Preserve and Evidence Preservation Mode is to keep the iPhone in a state known as After First Unlock, or AFU.
asserted
idea → keep → Unlock
Having an iPhone in that state essentially allows cops to access data that would otherwise be much harder to obtain if the phone was in a Before First Unlock, or BFU state.
asserted
phone → have → state
If the iPhone is in BFU, certain sensitive data is encrypted, and it can be significantly harder — sometimes even virtually impossible — to brute-force the device’s passcode and unlock it.
asserted
it → encrypt → it
404 Media previously obtained lists of iPhones that GrayKey and competitor Cellebrite could access, with variations between phones in an AFU and BFU state.
uncertain
GrayKey → obtain → state
“That AFU state is captured,” by GrayKey Preserve and Evidence Preservation Mode, the employee says.
asserted
employee → capture → Preserve
“Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost.
asserted
state → reboot → reasons
When using this new solution, law enforcement agents only see the iPhone’s software version and device model, rather than any data within, according to the employee and a screenshot of GrayKey’s customer interface included in the video.
uncertain
agents → use → video
That allows the cops to preserve the data they care about without actually seeing it before they are authorized to do so.
asserted
they → allow → it
Apple and Magnet did not respond to a request for comment.
asserted
Apple → respond → comment
404 Media shared a transcript of the video with Jiska Classen, a researcher at the Hasso Plattner Institute who studies iPhone security.
asserted
who → share → security
While Classen said that it’s impossible to know for sure how Magnet’s new feature works based on the video, she posited some theories and agreed that it is “quite a game changer” or “at least puts things back to where they were before inactivity reboot.”
asserted
they → say → reboot
She thinks Magnet has found a way to manipulate the iPhone’s clock, effectively “slowing down time” or even “stopping the clock from ticking, even after a reboot.”
asserted
Magnet → think → reboot
Most likely, according to her, the GrayKey may disable the iPhone tasks that set data to expire.
uncertain
data → accord → tasks
What is certain is that the ball is now in Apple’s court to figure out how Magnet got around inactivity reboot, and find a way to prevent the company and its technology from freezing iPhones — and the sensitive data stored in them — in time.
asserted
Magnet → figure → time
The Aporia
