https://wstraf.me/two-min-passcode-crack-bs

1<!doctype html>
2<html lang="en">
3<head>
4  <meta charset="utf-8">
5  <title>On the “two minute passcode cracking” claims</title>
6  

6<script>(function(d) {var config = {kitId: 'pzu4ocl',scriptTimeout: 1000,async: true},h=d.documentElement,t=setTimeout(function(){h.className=h.className.replace(/\bwf-loading\b/g,"")+" wf-inactive";},config.scriptTimeout),tk=d.createElement("script"),f=false,s=d.getElementsByTagName("script")[0],a;h.className+=" wf-loading";tk.src='https://use.typekit.net/'+config.kitId+'.js';tk.async=true;tk.onload=tk.onreadystatechange=function(){a=this.readyState;if(f||a&&a!="complete"&&a!="loaded")return;f=true;clearTimeout(t);try{Typekit.load(config)}catch(e){}};s.parentNode.insertBefore(tk,s)})(document);</script>

6
7  <meta name="viewport" content="width=device-width, initial-scale=1">
8  <link rel="shortcut icon" href="https://lightning.svbtle.com/cargo/favicon-3686f5990e669ad2a1684f0ac250c4d9ddc03e2ef6f3c980f17b7aae786833ef.ico">
9  <link rel="icon" sizes="196x196" href="https://lightning.svbtle.com/cargo/apple-touch-icon-8ed2bd858a30400ead0535543ffb8ad2ab3e036a2f0adb797dc641458d00a41a.png">
10  <link rel="mask-icon" href="https://lightning.svbtle.com/cargo/default-b7e7b5361ab4c50a9ceb6dc296e0f157e2ec9c2f2c6f30832d991dc361d69512.svg" color="black">
11  <meta name="generator" content="Svbtle.com" />
12  <meta name="description" content="The “iPhone passcode can be cracked in two minutes!” linkbait headlines going around has been bothering me (see here for an example of one, and here for a bad example of an article teaching you how to “thwart” the hack). It seems that people don’t... | will strafach | consultant. hacker. entrepreneur."/>
13  <link rel="canonical" href="https://wstraf.me/two-min-passcode-crack-bs" />
14  <meta property="og:url" content="https://wstraf.me/two-min-passcode-crack-bs" />
15  <meta property="twitter:site" content="@svbtle" />
16  <meta property="twitter:title" content="On the “two minute passcode cracking” claims" />
17  <meta property="twitter:description" content="The “iPhone passcode can be cracked in two minutes!” linkbait headlines going around has been bothering me (see here for an example of one, and here for a bad example of an article teaching you how to “thwart” the hack). It seems that people don’t..." />
18  <meta property="twitter:creator" content="@chronic" />
19  <meta name="twitter:card" content="summary" />
20  <meta name="twitter:image" content="https://svbtleusercontent.com/a13SN72ksz2v4vgHL35Br202310xsuap_large.png" />
21  <meta property="twitter:domain" content="https://wstraf.me" />
22  <meta property="og:title" content="On the "two minute passcode cracking" claims &bull; will strafach" />
23  <meta property="og:type" content="article" />
24  <meta property="og:description" content="The “iPhone passcode can be cracked in two minutes!” linkbait headlines going around has been bothering me (see here for an example of one, and here for a bad example of an article teaching you how to “thwart” the hack). It seems that people don’t... | will strafach | consultant. hacker. entrepreneur." />
25  <meta property="og:image" content="https://svbtleusercontent.com/a13SN72ksz2v4vgHL35Br202310xsuap_large.png" />
26  <meta property="og:site_name" content="will strafach on Svbtle" />
27  <meta property="fb:app_id" content="346346195413177" />
28  <link rel="alternate" type="application/rss+xml" href="https://wstraf.me/feed" />
29  <link rel="stylesheet" href="https://lightning.svbtle.com/cargo/legacy/build.blog-120c367e4cc2cdf2d031c71f795ecea0ef4033f8b24d12d8e147c86e08e2ed2a.css" media="all" data-turbolinks-track="reload" />
30  

30<script src="https://lightning.svbtle.com/cargo/build.blog-b198d2a5100fafb3283da7f26c83fd6304e8643e39535b2c46d930a9690fad48.js" data-turbolinks-track="reload"></script>

30
31  <script async src="https://www.googletagmanager.com/gtag/js?id=

31G-VGMRYDBB5R

31"></script>

32<script>
33  window.dataLayer = window.dataLayer || [];
34  function gtag(){dataLayer.push(arguments);}
35  gtag('js', new Date());
36  gtag('set', 'linker', {
37    'accept_incoming': true
38  });
39  gtag('config', 'G-VGMRYDBB5R');
40  gtag('config', 'UA-30485364-1');
41</script>

41</head>
42<body class="overlord blog">
43<style scoped>
44figure.avatar a,
45figure#user_logo a,
46figure#user_foot a,
47nav#overlord.user_top figure#logo_top a,
48figure.kudo.complete div.filling {
49  background-image: url('https://svbtleusercontent.com/a13SN72ksz2v4vgHL35Br202310xsuap_medium.png')
50}
51
52figure.kudo.activated div.filling,
53figure.kudo.complete div.filling {
54  background-color: #800080;
55}
56
57figure.kudo.activated a,
58figure.kudo.complete a {
59  border-color: #800080;
60}
61
62blockquote,
63a blockquote,
64div#readnext:hover span.flank_title,
65div#foot_more:hover a,
66div#foot_userbar a#bottom_tagline span:hover,
67article.linked h1.article_title a:hover,
68a.continue_button:hover,
69article p a:hover,
70ul#lightning_drop,
71figure#user_foot,
72ul#user_links li a:hover,
73ul#foot_links li a:hover,
74a.buttonize:hover,
75button.buttonize:hover,
76a.buttonize.outline:hover,
77button.buttonize.outline:hover,
78nav.pagination span.next a:hover,
79nav.pagination span.prev a:hover,
80section#readnext:hover p span,
81nav#overlord.user_top figure#logo_top {
82  border-color: #800080;
83}
84/*figure#user_logo,*/
85
86figure.avatar,
87nav#overlord.user_top figure#logo_top a,
88ul#user_links li a:hover,
89ul#foot_links li a:hover,
90a.buttonize:hover,
91button.buttonize:hover,
92a.buttonize.outline:hover,
93button.buttonize.outline:hover,
94nav.pagination span.next a:hover,
95nav.pagination span.prev a:hover,
96figure#user_logo a,
97figure#user_foot a  {
98	background-color: #800080;
99}
100
101h6.separator_title.read_first,
102header#user_top h2 a,
103footer#blog_foot h5 a,
104article.post h1 a:hover,
105div.preview strong,
106nav#overlord h2#nav_title.user_top a,
107section#readnext:hover h3,
108section#readnext:hover p span {
109  color: #800080;
110}
111
112@keyframes titlePulse
113  {
114  0% {
115    color: #000000;
116  }
117  50% {
118    color: #800080;
119  }
120  100% {
121    color: #000000;
122  }
123}
124
125@-moz-keyframes titlePulse
126  {
127  0% {
128    color: #000000;
129  }
130  50% {
131    color: #800080;
132  }
133  100% {
134    color: #000000;
135  }
136}
137
138@-webkit-keyframes titlePulse
139  {
140  0% {
141    color: #000000;
142  }
143  50% {
144    color: #800080;
145  }
146  100% {
147    color: #000000;
148  }
149}
150
151
152</style>
153
154<figure id="loading">&nbsp;</figure>
155<nav id="overlord" class="user_top">
156  <div id="lockup" class="">
157    <figure id="logo_top" class=" user_top">
158      <a href="/">Svbtle</a>
159    </figure>
160    <h2 id="nav_title" class="user_top"><a href="https://wstraf.me">will strafach</a></h2>
161  </div>
162  <figure id="hamburger">
163    <a href="#menu" id="hamburger_button">Menu</a>
164  </figure>
165  <ul id="dropdown" class="onblog">
166    <li class="dropdown_message">
167     <a href="https://svbtle.com">will strafach is writing on the <span class="logoize">Svbtle</span> network.</a>
168    </li>
169    <li><a href="https://linkedin.com/in/willstrafach"  target="_blank">linkedin.com/in/wi...</a></li>
170    <li><a href="https://x.com/chronic" class="xdotcom" target="_blank">@chronic</a></li>
171    <li><a href="mailto:[email protected]?subject=hi%20from%20svbtle">say&nbsp;hello</a></li>
172    <li><a href="/feed">rss feed</a></li>
173    <li style="margin: 0; padding: 0;"><hr class="overlord_nav" /></li>
174    <li><a href="https://svbtle.com/about">about svbtle</a></li>
175    <li><a href="https://svbtle.com/signup">sign up</a></li>
176  </ul>
177</nav>
178<div id="whiteout"></div>
179
180<section id="container" class="blog user_post">
181  <article id="q3MaEaQiCFz4E7vJfCXsvR" class="post  historical">
182	<time datetime="2012-04-02" class="article_time">April  2, 2012</time>
183  <h1 class="article_title">
184    <a href="https://wstraf.me/two-min-passcode-crack-bs">On the “two minute passcode cracking” claims</a>
185  </h1>
186	<p>The “iPhone passcode can be cracked in two minutes!” linkbait headlines going around has been bothering me (see <a href="http://www.bgr.com/2012/03/28/iphone-passcode-security-can-be-bypassed-in-less-than-two-minutes-video/">here</a> for an example of one, and <a href="http://www.zdnet.com/blog/sybase/three-ways-to-thwart-xrys-2-minute-iphone-passcode-hack/2874">here</a> for a <strong>bad</strong> example of an article teaching you how to “thwart” the hack). It seems that people don’t fully understand what is going on, and some generalized / misinformation is circulating about the issue. I’d like to clarify some things, as well as tell you some real ways to “thwart” their system.</p>
187<h2 id="the-software-from-xry-and-all-similar-softwar_2">

187The software from XRY and all similar software utilizes jailbreak exploits to accomplish their task. <a class="head_anchor" href="#the-software-from-xry-and-all-similar-softwar_2">#</a></h2>
188<p>They do not use anything special that is “similar to” the exploits used in jailbreak programs; They are simply loading a custom ramdisk by utilizing the publicly available “limera1n” exploit by George Hotz. The ramdisk isn’t even very special, because anyone could put together their own using open source tools. The only “special” thing XRY has done is create a tool that is simple enough to be utilized by LE personnel.</p>
189<h2 id="if-you-have-an-iphone-4s-an-ipad-2-or-an-ipad_2">If you have an iPhone 4S, an iPad 2, or an iPad 3, then this tool cannot be used on your device. <a class="head_anchor" href="#if-you-have-an-iphone-4s-an-ipad-2-or-an-ipad_2">#</a></h2>
190<p>Due to the not-so-techincally-informed reporters writing about the XRY software, this fact has been overlooked. Personally, I think it’s a pretty important fact. The simpliest way to “thwart” the use of this software on your phone would be to get the latest model, because (as people who are farmilliar with jailbreaking know) the limera1n exploit is fixed in the bootrom of the A5 (iPad 2 and iPhone 4S) as well as the A5X (iPad 3) chip.</p>
191<h2 id="the-quottwo-minutesquot-it-takes-to-crack-you_2">The “two minutes” it takes to crack your passcode will only hold true if your passcode is 0000, the passcode that XRY showed in their demo video. <a class="head_anchor" href="#the-quottwo-minutesquot-it-takes-to-crack-you_2">#</a></h2>
192<p>If you don’t feel like upgrading to the latest model and your device is exploitable, it is still possible to protect yourself from tools like this. Just open Settings on your device, then tap the “General” menu, then go into the “Passcode Lock” menu. You should see a switch labelled “Simple Passcode”. If you turn this off and then set a lengthier password to unlock your device, that’ll make it take much longer than two minutes to crack the passcode on your device (the longer, the better).</p>
193
194<p>I know this post is a few days late (been a bit busy lately), but hopefully I was able to clear up some misconceptions and put the minds of some at ease.</p>
195
196  <figure class="postend kudo able clearfix" id="kudo_q3MaEaQiCFz4E7vJfCXsvR">
197    <a href="#kudo">
198      <div class="filling">&nbsp;</div>
199    </a>
200    <div class="num">1,314</div>
201    <div class="txt">Kudos</div>
202  </figure>
203  <figure class="side kudo able clearfix" id="kudo_side_q3MaEaQiCFz4E7vJfCXsvR">
204    <a href="#kudo">
205      <div class="filling">&nbsp;</div>
206    </a>
207    <div class="num">1,314</div>
208    <div class="txt">Kudos</div>
209  </figure>
210</article>
211
212</section>
213<footer id="blog_foot" class="cf">
214  <ul id="foot_links">
215    <li><a href="https://x.com/chronic">@chronic</a></li>
216    <li><a href="mailto:[email protected]?subject=Svbtle">say hello</a></li>
217    <li><a href="https://linkedin.com/in/willstrafach" >linkedin.com/in/wi...</a></li>
218  </ul>
219  <figure id="user_foot"><a href="/">Svbtle</a></figure>
220  <h5><a href="https://wstraf.me">will strafach</a></h5>
221</footer>
222<footer id="foot">
223  <figure id="logo_foot"><a href="https://svbtle.com">Svbtle</a></figure>
224  <a href="https://svbtle.com/terms" style="color: #ccc; margin-left: 25px;">Terms</a> <span style="color: #ccc;">•</span> <a href="https://svbtle.com/privacy" style="color: #ccc;">Privacy</a>
225  <span style="color: #ccc;">•</span> <a href="https://svbtle.com/promise" style="color: #ccc; margin-right: 15px;">Promise</a>
226  <br/><br/>
227</footer>
228
229<div id="lights">&nbsp;</div>
230<div id="app-data" data-name="svbtle" data-version="8.5-legible" data-magicNum="2572031820.15"></div><div id="px-data" data-ax="posts" data-sx="show"></div><div id="user-data" data-here="false" data-state="logged-out"></div><div id="blog-data" data-title="will strafach" data-blogname="will" data-extid="svXkuUpUm6ttUTfTL7bo9x" data-color="800080" data-color-rgb="128,0,128" data-color-rgba="(128,0,128,0.5)" data-blog-tracker="UA-30485364-1"></div></body>
231</html>