Leaked Video Shows That Police Can Bypass iPhones' Automatic Reboot Feature

According to 404 Media, a company that makes devices to hack phones claims they can bypass iOS's automatic reboot feature and allow police to more easily access data on iPhones.

Companies like the infamous Cellebrite, marketed as "digital forensics" firms, make tools that exploit people's personal devices in order to extract data from them. They sell these devices to law enforcement agencies, who often abuse these devices to collect personal data on protesters.

The devices support extraction of data when a suspect provides the password to unlock their device, but also when they don't. These companies play a cat-and-mouse game with tech companies like Apple, who fix vulnerabilities in their devices once they know about them.

In order to keep Apple and other vendors from reducing the effectiveness of their product by fixing the exploits they use, they tend to keep the capabilities of their technology secret. Occasionally, though, these secrets leak.

This appears to be the case here, this time with Magnet Forensics, the company behind GrayKey.

Typically, these devices rely on devices having been unlocked since their last boot, in a state called After First Unlock (AFU). Devices tend to be more secure when they haven't been unlocked after a reboot, called Before First Unlock (BFU).

GrapheneOS implemented a security feature called Auto Reboot that reboots your phone into the BFU state automatically after a certain period of time, giving attackers a time limit to attack the AFU mode before they have to contend with the more secure BFU.

Later, iOS added a similar feature called Automatic Restart that's meant to do the same thing, albeit with a hardcoded 72-hour timer. This feature caused law enforcement to panic as iPhones that were in their custody started to reboot themselves without warning.

Now GrayKey say their new "Evidence Preservation Mode" will allow cops to "capture" the iPhone in AFU mode, so even if it does restart, the AFU state is not lost.

It also prevents the iPhone from purging temporarily cached data such as photos and location data, which are normally deleted after a certain number of days.

Reportedly, no technical details about how the feature works are provided in the video, but it does act as proof of their capabilities. 404 Media says they contacted both Apple and Magnet, but neither responded.