Incident: iPhone Lock Screen Bypass Vulnerability in iOS 8.1

Published Date: 2015-03-31

Postmortem Analysis
Timeline 1. The software failure incident of bypassing the iPhone lock screen using a DIY hacking kit happened when iOS 8.1 was still vulnerable to the flaw exploited by the device [34211]. 2. The article was published on 2015-03-31. 3. Estimation: The incident likely occurred before the publication date of the article, so the software failure incident of bypassing the iPhone lock screen using the DIY hacking kit likely happened in March 2015.
System 1. iOS 8.1 [34211]
Responsible Organization 1. Experts from London-based MDSec were responsible for causing the software failure incident by devising a hack and creating a DIY hacking kit to bypass the iPhone lock screen [34211].
Impacted Organization 1. iPhone users were impacted by the software failure incident as their devices were vulnerable to being unlocked using a DIY hacking kit due to a flaw in iOS 8.1 [34211].
Software Causes 1. The software cause of the failure incident was a flaw in iOS 8.1 that created a tiny delay between the PIN code being entered and the phone unlocking, allowing for the bypass of the iPhone lock screen [34211].
Non-software Causes 1. The use of a DIY hacking kit made from parts bought online to bypass the iPhone lock screen [34211].
Impacts 1. The software failure incident allowed hackers to bypass the iPhone lock screen using a DIY hacking kit, potentially compromising the security of the device [34211].
Preventions 1. Implementing stronger security measures such as multi-factor authentication to prevent unauthorized access even if the passcode is bypassed [34211]. 2. Regularly updating the software to patch known vulnerabilities and bugs, as Apple did by fixing the flaw in iOS 8.1.1 [34211].
Fixes 1. Updating the iOS software to version 8.1.1 or newer, as Apple reportedly fixed the bug in iOS 8.1 that allowed the bypass of the iPhone lock screen [34211].
References 1. Experts from London-based MDSec [34211]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization a) The software failure incident related to bypassing the iPhone lock screen using a DIY hacking kit was reported to have happened again within the same organization, Apple. The incident took advantage of a flaw in iOS 8.1, and Apple reportedly fixed the bug in version 8.1.1 to address the security vulnerability [34211]. b) The incident of bypassing the iPhone lock screen using a DIY hacking kit was not specifically mentioned to have occurred at multiple organizations or with their products and services. Therefore, there is no information available regarding similar incidents happening at other organizations in the articles provided.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be attributed to a flaw in iOS 8.1 that created a tiny delay between the PIN code being entered and the phone unlocking. This flaw allowed the hacking device developed by MDSec to simulate PIN entry over the USB connection and sequentially bruteforce every possible PIN combination, ultimately bypassing the iPhone lock screen security feature [34211]. (b) The software failure incident related to the operation phase is linked to the misuse of the hacking device by criminals who have stolen or found the phone. The device, when connected to the phone's power source, overrides the 'Erase data after 10 attempts' setting, allowing for multiple incorrect PIN entries without data erasure. This misuse of the hacking device in the operation phase poses a security threat to iPhone users running iOS 8.1 or older versions of the software [34211].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident of bypassing the iPhone lock screen using a DIY hacking kit was due to a flaw in iOS 8.1 that created a tiny delay between the PIN code being entered and the phone unlocking. This flaw allowed the hacking device to simulate PIN entry over USB and bruteforce every possible combination until finding the correct one. The incident was a result of an internal system vulnerability within iOS 8.1 [34211]. (b) outside_system: The incident involved the use of a DIY hacking kit made from parts bought online, which was used to bypass the iPhone lock screen security feature. The device used in the hack, known as an IP Box, was originally used by phone repairmen in the market. This external tool was leveraged to exploit the flaw within the iOS system, indicating an external factor contributing to the software failure incident [34211].
Nature (Human/Non-human) non-human_actions (a) The software failure incident in this case is primarily due to non-human actions. The incident involves a flaw in iOS 8.1 that creates a delay between the PIN code entry and the phone unlocking, which is exploited by a DIY hacking kit to bypass the iPhone lock screen [34211]. The device used in the hack simulates PIN entry over USB and bruteforces every possible combination until the correct one is found, taking advantage of the software flaw without direct human intervention.
Dimension (Hardware/Software) hardware, software (a) The software failure incident in the article is related to hardware. The incident involved a DIY hacking kit that plugs into the iPhone and simulates the PIN entry over USB, taking advantage of a flaw in iOS 8.1 that creates a delay between the PIN code entry and the phone unlocking. The device cuts the power source immediately after each failed attempt, bypassing the security feature of erasing data after 10 attempts [34211]. (b) The software failure incident is also related to software. The flaw in iOS 8.1 that allowed the bypassing of the iPhone lock screen was a software vulnerability exploited by the hacking device. The delay in the PIN code entry process that the device took advantage of was a software issue within the iOS operating system [34211].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the article is malicious in nature. The team of experts from MDSec devised a way to bypass the iPhone lock screen using a DIY hacking kit, which involved exploiting a flaw in iOS 8.1 to bruteforce every possible combination until finding the correct one. This method was designed to override the security feature of erasing data after 10 incorrect attempts, indicating a deliberate attempt to gain unauthorized access to the phone [34211].
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident described in Article 34211 can be attributed to poor_decisions. The incident involved a team of experts from MDSec who found a way to bypass the iPhone lock screen using a DIY hacking kit. They exploited a flaw in iOS 8.1 that created a delay between the PIN code entry and the phone unlocking, allowing them to bruteforce every possible combination until finding the correct one. This security vulnerability was a result of a poor decision in the software design that allowed for such exploitation [34211].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the article as a team of experts from London-based MDSec found a way to bypass the iPhone lock screen using a DIY hacking kit. They exploited a flaw in iOS 8.1 that created a tiny delay between the PIN code being entered and the phone unlocking, allowing them to develop a gadget that could bruteforce every possible combination until finding the correct one. This indicates a level of professional competence in understanding and exploiting the software flaw [34211]. (b) The accidental aspect of the software failure incident is seen in the unintended consequence of the flaw in iOS 8.1 that allowed for the bypassing of the iPhone lock screen. The delay between the PIN code entry and the phone unlocking was not intentionally designed to be exploitable in this manner, leading to the accidental vulnerability that was leveraged by the experts to develop the hacking kit [34211].
Duration temporary (a) The software failure incident described in the article is more of a temporary nature rather than permanent. The incident involves a specific flaw in iOS 8.1 that creates a delay between the PIN code entry and the phone unlocking, which allows for a bypass using a DIY hacking kit. This flaw is specific to iOS 8.1 and older versions, and Apple reportedly fixed the bug in version 8.1.1. Therefore, the failure is temporary and specific to certain circumstances (Article 34211).
Behaviour value (a) crash: The software failure incident described in the article does not involve a crash where the system loses state and does not perform any of its intended functions. The incident is related to a security flaw in iOS 8.1 that allows for bypassing the iPhone lock screen using a DIY hacking kit [34211]. (b) omission: The incident does not involve the system omitting to perform its intended functions at an instance(s). Instead, it is about exploiting a flaw in the system's security mechanism to bypass the lock screen [34211]. (c) timing: The failure is not related to the system performing its intended functions correctly but too late or too early. It is about taking advantage of a tiny delay in the system that allows for brute-forcing the PIN code on the iPhone lock screen [34211]. (d) value: The software failure incident is related to the system performing its intended functions incorrectly. In this case, the flaw in iOS 8.1 allows for bypassing the iPhone lock screen security feature, which is a critical security vulnerability [34211]. (e) byzantine: The incident does not involve the system behaving erroneously with inconsistent responses and interactions. It is more about exploiting a specific flaw in the system's security design to achieve unauthorized access to the device [34211]. (f) other: The behavior of the software failure incident can be categorized as a security vulnerability exploit. It involves using a DIY hacking kit to bypass the iPhone lock screen by exploiting a flaw in iOS 8.1, allowing for brute-forcing the PIN code and gaining unauthorized access to the device [34211].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence unknown (a) death: There is no mention of any deaths resulting from the software failure incident in the provided article [34211]. (b) harm: The article does not mention any physical harm caused to individuals due to the software failure incident [34211]. (c) basic: The incident did not impact people's access to food or shelter [34211]. (d) property: The software failure incident did not result in any direct impact on people's material goods, money, or data [34211]. (e) delay: The software failure incident did not cause any delays in activities [34211]. (f) non-human: The software failure incident primarily focused on the vulnerability of iPhone lock screens to hacking attempts, so there is no mention of non-human entities being impacted [34211]. (g) no_consequence: The article does not mention any observed consequences resulting from the software failure incident [34211]. (h) theoretical_consequence: The potential consequence discussed in the article is the security implications of the bypass method for iPhone lock screens, but there is no mention of this theoretical consequence actually occurring [34211]. (i) other: There are no other consequences mentioned in the article related to the software failure incident [34211].
Domain information (a) The software failure incident reported in Article 34211 is related to the information industry. The incident involves a team of experts finding a way to bypass the iPhone lock screen using a DIY hacking kit, which exploits a flaw in iOS 8.1 to gain unauthorized access to information stored on the phone [34211].

Sources

Back to List