A lone researcher at the University of Cambridge has done what the FBI said was impossible: he has mirrored the NAND flash memory in an iPhone 5c and managed to brute force the passcode of the device.
Sergei Skorobogatov used equipment from local electronics retailers for his experiment and spent a few hundred dollars to obtain the passcode of the iPhone 5c which was running iOS9.3.
Earlier this year, the FBI got into a stoush with Apple over an iPhone 5c which had been used by Syed Rizwan Farook, one of the two terrorists involved in an attack in San Bernardino, California, in December last year.
When the FBI got a court order compelling Apple to break into the device, the company resisted. In the end, the FBI paid more than US$15,000 to an Israeli company named Cellebrite to access the passcode on the phone and ended the stoush before it came to court.
{loadposition sam08}Midway through this episode, one of the methods suggested for cracking the passcode was by mirroring the NAND flash chips and bypassing the limit placed on guessing the passcode.
If security is enabled on the iPhone 5c, then on powering up or waking up it asks for the passcode. After five incorrect attempts, one has to wait five seconds to make the next guess. This increases to one minute, then five minutes, then 15 minutes and finally 60 minutes.
After 10 incorrect attempts, one is given the option of permanently deleting all the data on the phone.
Skorobogatov wrote that he had successfully removed the NAND flash memory and used brute force methods to guess the passcode. A four-digit code would take about 20 hours to guess while a six-digit one would take about three months, he said.
He said his method would also work on the iPhone 5s and iPhone 6 which use similar flash chips. While other phones use different chips, he said his method could be adapted to work with them.