Hardening modern iPhone against forensic tools

[fria]

Yeah but no auto reboot like GrapheneOS has and honestly how often do you turn your phone off.

[NkHoszcg]

@whoami6

All FFS extractions on A12+ require sideloading an agent (app) to to the device. This applies to all forensic vendors and can be easily verified by reading here . That app cannot be installed if you follow this tutorial.

Given the extensive chat log, could you please specify where it mentions that 1. an agent is necessary and 2. that MDM can prevent the installation of such an agent, even when using Cellebrite Premium or CAS? I contend that MDM is merely a UI block and can be easily circumvented by Cellebrite Premium or CAS. They can evidently bypass the USB restricted mode and bypass the manual approval required to trust an enterprise or side-loaded app, which is typically needed in the user interface if installed normally.

@whoami6

Unless there is a new undisclosed jailbreak on the lose. Keep in mind, these forensic companies have lot’s of money and hiring a well known jailbreak dev (like Cellebrite did) and keeping them hush wouldn’t be hard.

I believe Cellebrite possesses several local privilege escalation (LPE) zero-day vulnerabilities that allow them to gain AFU access. While they may not be able to achieve a complete jailbreak with these zero-days, they can obtain enough privileges to access the file system.

@whoami6

This is why I personally like the modern iPhone + GrapheneOS combo. Use iPhone for casual texting, business stuff, gmail, apps not supported by Graphene. Use GrapheneOS for social media, password managers, proton suite, etc.

I completely agree. My responses are not intended as a criticism of your hardening recommendations; in fact, I think they are excellent. My comments are aimed at the overall security of the iPhone. Based on the evidence, I believe that no amount of hardening can fully prevent Cellebrite Premium or CAS. However, this hardening does effectively protect against Cellebrite Enterprise, Cellebrite UFED, and similar tools.

[anonbird]

Yeah, but this guide doesn’t make them resistant to AFU extraction, so you still have to turn off your phone

[JohnDose]

It’s because AFU states are insecure by definition. Honestly, turning off your phone is almost always possible in any case unless you suddenly get shot from police, etc.

[anonbird]

GrapheneOS seems to resist AFU extraction

[whoami6 (whoami)]

The usb bypass is possible due to apple not actually doing what is advertised unlike GrapheneOS. They likely still allow some sort of connection that these “adapters” can spoof themselves as. My Magic Keyboard still works BFU+ Lockdown Mode but I don’t know if that’s intended or not. These screenshots also back up this theory.

Hopefully we find more AFU limitations in the future and apple fixes its lousy usb restricted mode.

[Quantum]

Just from the screen shot it isn’t clear if that iPhone is in BFU or AFU. Also unknown if it has USB restricted mode enabled or if the unlock attempt was ever eventually successful.

We do know Major Adam’s phone remains locked.

[fria]

@JohnDose

It’s because AFU states are insecure by definition.

Not necessarily. It’s pretty much always going to be less secure but not inherently insecure.

@JohnDose

Honestly, turning off your phone is almost always possible in any case unless you suddenly get shot from police, etc.

Not always going to be possible especially if you’re in distress. GrapheneOS has an auto reboot feature for this reason; it just needs to hold out in AFU long enough for auto reboot to kick in.

[whoami6 (whoami)]

@Quantum

Just from the screen shot it isn’t clear if that iPhone is in BFU or AFU. Also unknown if it has USB restricted mode enabled or if the unlock attempt was ever eventually successful.

We do know Major Adam’s phone remains locked.

“Also using Graykey 5.2.0 and it doesn’t even recognize that a device gets plugged into it to even
do a BFU or an initial device identify.”

He got DM’s stating that he needs a new adapter from people with direct knowledge about these tools not internet scavengers like me.

Considering the usb setting is enabled by default on newer iOS, chances are like 80/20 that it was enabled.

This screenshot from a Cellebrite employee makes me wonder if USB-C added some limitations to their capabilities because it seems like the lightning connectors gave them no issue at all. The police officer also says Cellebrite Inseyets UFED documents refer to “locked USB-C” devices as unsupported but this has never been a problem before.

[NkHoszcg]

@whoami6

This screenshot from a Cellebrite employee makes me wonder if USB-C added some limitations to their capabilities because it seems like the lightning connectors gave them no issue at all.

I suspect that the challenge lies more with Cellebrite’s engineering. Since Cellebrite CAS can bypass the USB-C restricted mode and perform AFU without any problems, I think they are simply delayed in implementing and rolling out this exploit across their Cellebrite Premium boxes, especially given the different variants of Cellebrite Premium boxes they need to support. Essentially, even the USB-C iPhone can be AFU extracted; it’s only a matter of time before all Cellebrite Premium boxes are capable of doing the same.

[Tech-Trooper]

Thank you for your meticulous post. Do you think about converting it to a blog post, maybe?

[whoami6 (whoami)]

iOS 18 and higher introduced a inactivity reboot timer that sends your device back to BFU after a certain amount of days. This is why keeping your phone up to date is important!
Apple Quietly Introduced iPhone Reboot Code Which is Locking Out Cops

[whoami6 (whoami)]

I kinda just keep replying to this with new info I gather

[whoami6 (whoami)]

Video of iPhone running iOS 18.2 beta 2 rebooting after 72 hours of not being unlocked.

Update on inactivity reboot by Magnet Forensics

[whoami6 (whoami)]

Apparently Graykey support matrix has been leaked. Standing by for now…