Grayshift

Last updated

Grayshift is an American mobile device forensics company which makes a device named GrayKey to crack iPhones, iPads, and Android devices. In 2023, it merged with the Canadian firm Magnet Forensics. [1] [2]

Grayshift was co-founded by David Miles, Braden Thomas, Justin Fisher and Sean Larsson. [3] The company is[ when? ] funded by private investors PeakEquity Partners and C&B Capital. [4] [5] As of 2023, it was majority controlled by investment firm Thoma Bravo. [2]

Grayshift was founded in 2016, and as of 2018 was a privately held company based in Atlanta, Georgia, with less than 50 employees. [6] In 2017, rumors started to circulate that it had created a device able to unlock iPhones, following the Apple–FBI encryption dispute where US law enforcement agencies unsuccessfully tried to compel Apple to write software that would enable the government bypass these devices' security and unlock the phones. [6]

The GrayKey product has been used by the FBI and U.S., British and Canadian local police forces. [7] [8] [9] [10] [11] [12] In 2022, the company stated that GrayKey was being used "by thousands of law enforcement and government defense agencies across 30 countries worldwide, including France, United Kingdom, Germany, Sweden, Spain, and Italy". [13]

According to media reports, GrayKey costs US$15,000 to US$30,000 per copy depending on the functional options chosen. [14] [ failed verification ] As of 2018, the device consisted of a gray box, 4 inches by 4 inches by 2 inches in size, with two Lightning cables. [6] In 2022, photos of the "GrayKey 2.0" device were revealed in an FCC filing. [15]

The GrayKey reportedly provides[ when? ] support for iPhones running iOS 9 and later. [16] Around 2019, Apple modified iOS so that external device connections must be authorized by the iPhone owner after it has been unlocked. [17] On newer iPhone models, only unencrypted files and some metadata might be extracted.[ citation needed ] With earlier models, full data extraction, such as decrypting encrypted files, is possible. [18] [ citation needed ] As of 2021, GrayKey was able to perform successful brute-force attack against iOS devices in some situations, with Grayshift being "constantly in a cat-and-mouse game with Apple", which continually works to fix the security exploits used by GrayKey. [19] In 2022, Motherboard concluded that "while it’s unclear exactly how it achieves it, GrayKey bruteforces the iPhone or Android phone’s passcode and unlocks it—essentially hacking the phone—allowing customers to access and extract data from the phones." [15]

In 2018, hackers obtained the GrayKey source code, and attempted to extort a payment of 2 bitcoins from Grayshift after leaking "small chunks of code". [20] [21]

GrayKey with Android support was released in early 2021. [22] According to a March 2024 announcement, Graykey has "full support" for iOS 17 devices, Samsung's Galaxy S24 smartphones, and Google's Pixel 6 and Pixel 7 devices. [3]

In 2023, it was announced that Grayshift would merge with the Canadian firm Magnet Forensics, following the latter's acquisition for $1.35 billion by investment firm Thoma Bravo, which also owned the majority of Grayshift at the time. [2] The merger was completed later the same year. [1]

Related Research Articles

iPhone Line of smartphones by Apple Inc.

The iPhone is a smartphone produced by Apple that uses Apple's own iOS mobile operating system. The first-generation iPhone was announced by then–Apple CEO Steve Jobs on January 9, 2007. Since then, Apple has annually released new iPhone models and iOS updates. As of November 1, 2018, more than 2.2 billion iPhones had been sold.

<span class="mw-page-title-main">Charlie Miller (security researcher)</span> American computer security researcher

Charles Alfred Miller is an American computer security researcher with Cruise Automation. Prior to his current employment, he spent five years working for the National Security Agency and has worked for Uber.

iOS jailbreaking is the use of a privilege escalation exploit to remove software restrictions imposed by Apple on devices running iOS and iOS-based operating systems. It is typically done through a series of kernel patches. A jailbroken device typically permits root access within the operating system and provides the right to install software unavailable through the App Store. Different devices and versions are exploited with a variety of tools. Apple views jailbreaking as a violation of the end-user license agreement and strongly cautions device owners not to try to achieve root access through the exploitation of vulnerabilities.

<span class="mw-page-title-main">Malwarebytes</span> Internet security company

Malwarebytes Inc. is an American Internet security company that specializes in protecting home computers, smartphones, and companies from malware and other threats. It has offices in Santa Clara, California; Clearwater, Florida; Tallinn, Estonia; Bastia Umbra, Italy; and Cork, Ireland.

Rooting is the process by which users of Android devices can attain privileged control over various subsystems of the device, usually smartphones and tablets. Because Android is based on a modified version of the Linux kernel, rooting an Android device gives similar access to administrative (superuser) permissions as on Linux or any other Unix-like operating system such as FreeBSD or macOS.

<span class="mw-page-title-main">Fastboot</span> Recovery mode included in Android mobile operating system

Fastboot is a communication protocol used primarily with Android devices. It is implemented in a command-line interface tool of the same name and as a mode of the bootloader of Android devices. The tool is included with the Android SDK package and used primarily to modify the flash filesystem via a USB connection from a host computer. It requires that the device be started in Fastboot mode. If the mode is enabled, it will accept a specific set of commands, sent through USB bulk transfers. Fastboot on some devices allows unlocking the bootloader, and subsequently, enables installing custom recovery image and custom ROM on the device. Fastboot does not require USB debugging to be enabled on the device. To use fastboot, a specific combination of keys must be held during boot.

<span class="mw-page-title-main">Hacking of consumer electronics</span>

The hacking of consumer electronics is a common practice that users perform to customize and modify their devices beyond what is typically possible. This activity has a long history, dating from the days of early computer, programming, and electronics hobbyists.

Cellebrite DI Ltd. is an Israeli digital intelligence company that provides tools for federal, state, and local law enforcement as well as enterprise companies and service providers to collect, review, analyze and manage digital data. On April 8, 2021, Cellebrite announced plans to go public via a merger with a blank-check firm, valuing the company at approximately $2.4 billion. Their flagship product series is the Cellebrite UFED.

<span class="mw-page-title-main">AirDrop</span> Proprietary file sharing between Apple devices

AirDrop is a proprietary wireless ad hoc service in Apple Inc.'s iOS, macOS, iPadOS and visionOS operating systems, introduced in Mac OS X Lion and iOS 7, which can transfer files among supported Macintosh computers and iOS devices by means of close-range wireless communication. This communication takes place over Apple Wireless Direct Link 'Action Frames' and 'Data Frames' using generated link-local IPv6 addresses instead of the Wi-Fi chip's fixed MAC address.

A lock screen is a computer user interface element used by various operating systems. They regulate immediate access to a device by requiring the user to perform a certain action in order to receive access, such as entering a password, using a certain button combination, or performing a certain gesture using a device's touchscreen. There are various authentication methods to get past the lock screen, with the most popular and common ones being personal identification numbers (PINs), the Android pattern lock, and biometrics.

<span class="mw-page-title-main">Kali Linux</span> Debian-based Linux distribution for penetration testing

Kali Linux is a Linux distribution designed for digital forensics and penetration testing. It is maintained and funded by Offensive Security. The software is based on the Debian Testing branch: most packages Kali uses are imported from the Debian repositories. The tagline of Kali Linux and BackTrack is "The quieter you become, the more you are able to hear", which is displayed on some backgrounds.

David Wang is a mobile phone hacker.

<span class="mw-page-title-main">Juice jacking</span> Mobile security risk

Juice jacking is a theoretical type of compromise of devices like smartphones and tablets which use the same cable for charging and data transfer, typically a USB cable. The goal of the attack is to either install malware on the device, or to surreptitiously copy potentially sensitive data. As of April 2023 there have been no credible reported cases of juice jacking outside of research efforts.

<span class="mw-page-title-main">Apple–FBI encryption dispute</span> 2015-2016 public relations and legal dispute

The Apple–FBI encryption dispute concerns whether and to what extent courts in the United States can compel manufacturers to assist in unlocking cell phones whose data are cryptographically protected. There is much debate over public access to strong encryption.

Pegasus is a spyware developed by the Israeli cyber-arms company NSO Group that is designed to be covertly and remotely installed on mobile phones running iOS and Android. While NSO Group markets Pegasus as a product for fighting crime and terrorism, governments around the world have routinely used the spyware to surveil journalists, lawyers, political dissidents, and human rights activists. The sale of Pegasus licenses to foreign governments must be approved by the Israeli Ministry of Defense.

<span class="mw-page-title-main">Exposure Notification</span> Initiative for mobile device-based privacy-preserving contact tracing

The (Google/Apple) Exposure Notification System (GAEN) is a framework and protocol specification developed by Apple Inc. and Google to facilitate digital contact tracing during the COVID-19 pandemic. When used by health authorities, it augments more traditional contact tracing techniques by automatically logging close approaches among notification system users using Android or iOS smartphones. Exposure Notification is a decentralized reporting protocol built on a combination of Bluetooth Low Energy technology and privacy-preserving cryptography. It is an opt-in feature within COVID-19 apps developed and published by authorized health authorities. Unveiled on April 10, 2020, it was made available on iOS on May 20, 2020 as part of the iOS 13.5 update and on December 14, 2020 as part of the iOS 12.5 update for older iPhones. On Android, it was added to devices via a Google Play Services update, supporting all versions since Android Marshmallow.

<span class="mw-page-title-main">Bootloader unlocking</span> Process of disabling secure device booting

Bootloader unlocking is the process of disabling the bootloader security that makes secure boot possible. It can make advanced customizations possible, such as installing a custom firmware. On smartphones this can be a custom Android distribution or another mobile operating system. Some bootloaders are not locked at all, others can be unlocked using a standard command, others need assistance from the manufacturer. Some do not include an unlocking method and can only be unlocked through a software exploit.

<span class="mw-page-title-main">Cellebrite UFED</span> Software to extract data from mobile devices

The UFED is a product series of the Israeli company Cellebrite, which is used for the extraction and analysis of data from mobile devices by law enforcement agencies.

<span class="mw-page-title-main">Android recovery mode</span> Mode on Android operating system for installing system updates and wipe data

The Android recovery mode is a mode of Android used for installing updates and wipe data. It consists of a Linux kernel with ramdisk on a separate partition from the main Android system.

The Linux kernel can run on a variety of devices made by Apple, including devices where the unlocking of the bootloader is not possible with an official procedure, such as iPhones and iPads.

References

  1. 1 2 Tools capable of extracting personal data from phones being used by 13 federal departments, documents show
  2. 1 2 3 "Magnet Forensics to Merge With Grayshift After $1.35B Buyout". GovTech. 2023-01-23. Retrieved 2024-07-17.
  3. 1 2 "Leadership" . Retrieved 2021-01-04.
  4. ↑ "Investors and Advisors" . Retrieved 2021-01-04.
  5. ↑ "Grayshift, The Startup That Breaks Into iPhones For The Feds, Raises $47 Million". Forbes . 2020-10-26. Retrieved 2021-01-04.
  6. 1 2 3 Reed, Thomas (2018-03-14). "GrayKey iPhone unlocker poses serious security concerns | Malwarebytes Labs". Malwarebytes . Retrieved 2024-07-17.
  7. ↑ Miller, Chance (2020-01-16). "Report: The FBI recently unlocked an iPhone 11 Pro with GrayKey, raising more doubts about the Pensacola case". 9to5Mac. Retrieved 2020-01-16.
  8. ↑ Fox-Brewster, Thomas (March 5, 2018). "Mysterious $15,000 'GrayKey' Promises To Unlock iPhone X For The Feds". Forbes. Retrieved 2020-01-16.
  9. ↑ Burgess, Matt (2018-10-19). "UK police are buying top secret hacking tech to break into iPhones". Wired UK. ISSN   1357-0978 . Retrieved 2020-01-16.
  10. ↑ Cox, Joseph (2018-04-12). "Cops Around the Country Can Now Unlock iPhones, Records Show". Vice.com . Retrieved 2020-01-16.
  11. ↑ "Waterloo Regional Police have a device that can crack locked phones". 2021-01-03. Retrieved 2021-01-04.
  12. ↑ "More questions than answers as Guelph Police confirm ownership of controversial forensic tool". 2020-12-02. Retrieved 2021-01-04.
  13. ↑ Grayshift. "Grayshift Announces Office in France and Continues to Invest in European Growth". www.prnewswire.com (Press release). Retrieved 2022-07-12.
  14. ↑ Nicas, Jack (2020-10-21). "The Police Can Probably Break Into Your Phone". The New York Times. Retrieved 2021-01-04.
  15. 1 2 Franceschi-Bicchierai, Lorenzo (2022-09-30). "This Is the 'GrayKey 2.0,' the Tool Cops Use to Hack Phones". Vice. Retrieved 2024-07-17.
  16. ↑ "FBI got data from a locked iPhone 11 using GrayKey: how does this tool work?". 22 January 2020. Retrieved 2021-01-04.
  17. ↑ "USB Restricted Mode in iOS 13: Apple vs. GrayKey, Round Two". ElcomSoft blog. 2019-09-27. Retrieved 2024-07-17.
  18. ↑ Fukami, Aya; Stoykova, Radina; Geradts, Zeno (2021-09-01). "A new model for forensic data extraction from encrypted mobile devices" (PDF). Forensic Science International: Digital Investigation. 38: 301169. doi: 10.1016/j.fsidi.2021.301169 . ISSN   2666-2817.
  19. ↑ Cox, Joseph (2021-06-22). "Instructions Show How Cops Use GrayKey to Brute Force iPhones". Vice. Retrieved 2024-07-17.
  20. ↑ "Look, a GrayKey interface on the internet!". 2018-05-25. Retrieved 2021-01-04.
  21. ↑ "Hackers Leaked The Code Of iPhone Cracking Device "GrayKey", Attempted Extortion". 2018-05-24. Retrieved 2021-01-04.
  22. ↑ "Grayshift Introduces Android Support on GrayKey". Grayshift. Retrieved 2021-05-25.


This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.