Max Planck Institute | Security and Privacy

Extracting iOS’ Passcode Blocklist
Maximilian Golla
March 2020 | Bochum, Germany

Biometric-Based Reauthentication“Face unlock feels almost like not having any lock screen security.”

Fingerprint

FaceIris“Intelligent Scan”

2 [Fingerprint] apple.com; [Face] apple.com; [Iris] Jason Cipriani/CNET

March 2020 | Bochum, Germany

Biometrics are a Convenience Feature!

TEK is flushed periodicallyand on device reboot.
[Ref. 1] Cherapau et al.: On the Impact of Touch ID on iPhone Passcodes. (SOUPS ‘15)

3 [Ref. 2] Apple Platform Security – Fall 2019 – PDF Version Page 10

March 2020 | Bochum, Germany

Knowledge-Based Authentication

4/6-digit PINs

4Passwords

Pattern

March 2020 | Bochum, Germany

iOS Passcode

Enrollment

Authentication

Knowledge-based auth. scheme• 6-Digit Numeric Code (default)• 4-Digit Numeric Code• Custom Numeric Code• Custom Alphanumeric Code
Strict rate-limiting (10 guesses)

5

March 2020 | Bochum, Germany

User-Chosen PINs

6 [Tweet] https://twitter.com/misterjamo/status/1050436638520823809

March 2020 | Bochum, Germany

Selection Bias
User-choice heavily biased.

Frequency

Usersat risk

Secret
7 User-Secret icon, Font Awesome (Fonticons, Inc.), No changes made, CC BY 4.0, https://fontawesome.com/license

March 2020 | Bochum, Germany

Threat Model
Attacker guesses the n most common
secrets in decreasing order of success.
Throttled Guessing Attack:iOS 9-14

Android 7-11

3 Guesses

00h 00m 00s

00h 00m 00s

10 Guesses

01h 36m 00s

00h 00m 30s

30 Guesses

Disabled

00h 10m 30s

100 Guesses

Disabled

10h 45m 30s

8 User-Secret icon, Font Awesome (Fonticons, Inc.), No changes made, CC BY 4.0, https://fontawesome.com/license

March 2020 | Bochum, Germany

What This Talk is Not About!

iPhone unlocking as used by law enforcement.
→ We only extract the iOS Passcode blocklist!

9 [Photo] GrayKey by MalwareBytes (Thomas Reed) - blog.malwarebytes.com

March 2020 | Bochum, Germany

iOS Passcode Blocklist• “Blocklist” consisting of weak PINs
• Not documented• Allows users to click-through(“Use Anyway”)
Examples:“000000”“123456”
or“2580”“1956”How to obtain the only “available” PIN blocklist
on the market?
10March 2020 | Bochum, Germany

Documentation?

11 [Screenshot] “Getting Ready for iOS 9” by Sarah Guarino – 9to5mac.com

March 2020 | Bochum, Germany

Interlocking Plastic Bricks Robot

14

March 2020 | Bochum, Germany

15

March 2020 | Bochum, Germany

16

March 2020 | Bochum, Germany

17

March 2020 | Bochum, Germany

18

March 2020 | Bochum, Germany

19

March 2020 | Bochum, Germany

20

March 2020 | Bochum, Germany

Schema
Raspberry Pi
Zero W

Camera0000.jpg

RemoteServer

OCR
Simulate
Keyboard
0000, Blocklist warning was shown…
5791, Blocklist warning was not shown[Icons] Raspberry Pi by OpenClipart; Video, WiFi, Mobile-Alt, Keyboard, Plug icon, Font Awesome (Fonticons, Inc.), No changes made, CC BY 4.0,
21 https://fontawesome.com/license; JPG icon, icons8.com, No changes made, CC BY-ND 3.0, https://creativecommons.org/licenses/by-nd/3.0/;
Computer Tower icon, onlinewebfonts.com.

March 2020 | Bochum, Germany

Parts List (~$100 + Phone)• 1x Raspberry Pi Zero W – $30✓ Case✓ Power supply✓ Micro SD card
• 1x Raspberry Pi Camera Module v2 – $25• 1x Micro USB cable – $5• 1x Lightning to USB 3 Camera Adapter – $39• 1x Apple iPhone 6s (or newer) – ~$150• Some interlocking plastic bricks

22 [iPhone] apple.com; [USB-Adapter] apple.com; [Plastic Bricks] “Block party” by The Lego Group

March 2020 | Bochum, Germany

Turn a Raspberry Pi Zero W Into a Keyboard

23 [Screenshot] https://github.com/c4software/pi-as-keyboard by Brosseau Valentin

March 2020 | Bochum, Germany

Turn a Raspberry Pi Zero W Into a Keyboard

250 -> 100 (milliwatts)
24 [Photo] “How to connect a USB Sound Interface that draws too much power to an iPad” by Gary Judge – head4space.com

March 2020 | Bochum, Germany

Idea
Test all possible PINs, e.g., via a keyboard
Problems:
Keyboard navigation
Rate-Limiting
Battery

How to navigate in iOS using a keyboard?
25 [Photo] “How to connect the Magic Keyboard to your iPhone” by Luke Filipowicz – imore.com

March 2020 | Bochum, Germany

Idea
Test all possible PINs, e.g., via a keyboard
Problems:
Keyboard navigation -> Activate “VoiceOver”
Rate-Limiting
Battery

26 [Photo] VoiceOver - apple.com

March 2020 | Bochum, Germany

Idea
Test all possible PINs, e.g., via a keyboard
Problems:
Keyboard navigation
Rate-Limiting
Battery

Bluetooth Prototype
27

March 2020 | Bochum, Germany

Idea
Test all possible PINs, e.g., via a keyboard
Problems:
Keyboard navigation
Rate-Limiting -> Exploit initial setup
Battery

28 [Photo] Create a Passcode - apple.com

March 2020 | Bochum, Germany

Idea
Test all possible PINs, e.g., via a keyboard
Problems:
Keyboard navigation
Rate-Limiting
Battery

iPad 2 Prototype
29 [USB-Adapter] apple.com

March 2020 | Bochum, Germany30 [Tweet] https://twitter.com/dbreunig/status/792034409788518401

March 2020 | Bochum, Germany

Idea
Test all possible PINs, e.g., via a keyboard
Problems:
Keyboard navigation
Rate-Limiting
Battery -> Use “Lightning to USB 3 Camera Adapter”

31 [USB-Adapter] apple.com

March 2020 | Bochum, Germany

Enter PIN + Take a Photo (Raspi Part)
for pin in pins:
for digit in pin:
send_key(digit)
time.sleep()# Enter a PIN

take_picture(camera_pid, pin) # Tell Pi to take a photo32

discard_warning()
time.sleep()# Navigate down

enter_stop_pin()time.sleep()# Intentionally fail to# re-enter the PIN

March 2020 | Bochum, Germany

Optical Character Recognition (Server Part)
import pytesseract
import cv2# Tesseract OCR Engine# OpenCV (Computer Vision)

for file in files:
cv2.imread()# Read img. from disk
cv2.threshold()# Convert img. to grayscale
pytesseract.image_to_string() # Convert img. to text

if len(text) > 14:
output = “PIN is blocklisted”
else:
output = “No warning was shown”

33

March 2020 | Bochum, Germany

Raspberry Pi Camera Module v2 (8MP)
raspistill -hf -vf -roi 0.4,0.37,0.24,0.24 --width 1280 --height 1024--nopreview --quality 25 --timeout 0 --signal -o /dev/shm/%06d.jpg

999000.jpg

34159753.jpg

March 2020 | Bochum, Germany

OpenCV – RGB ↔ GRAY and Thresholding
cv2.cvtColor(image, cv2.COLOR_BGR2GRAY)
cv2.threshold(gray, 0, 255, cv2.THRESH_BINARY | cv2.THRESH_OTSU)[1]999000.jpg

35159753.jpg

March 2020 | Bochum, Germany

Tesseract Open Source OCR Engine
pytesseract.image_to_string(Image.open(filename))

36<EMPTY_STRING>Are You Sure You Want
to Use This Code?
This code is commonlyused and can be easilcuessed. Change Use
Code999000.jpg

159753.jpg

March 2020 | Bochum, Germany

The iOS Passcode Blocklist
4-digit Passcodes:

6-digit Passcodes:

Search: ~ 9h (1x Setup)
Key space: 10,000 PINs
Blocklisted: 274 PINs (2.74%)• Common PINs: Bonneau et al. [1]• Years: 1956-2015• Patterns:✓ aaaa✓ abab✓ aabbSearch: ~30 days (2x Setups)
Key space: 1,000,000 PINs
Blocklisted: 2910 PINs (0.29%)• Common PINs: Wang et al. [2]• Ascending/Descending: “543210”• Patterns:✓ aaaaaa✓ abcabc✓ abccba[Ref. 1] Bonneau et al.: A Birthday Present Every Eleven Wallets? The Security of Customer-Chosen Banking PINs. (FC ‘12)

37 [Ref. 2] Wang et al.: Understanding Human-Chosen PINs: Characteristics, Distribution and Security. (Asia CCS ‘17)

March 2020 | Bochum, GermanyLessons Learned• Be prepared to reset the devices• iOS 9.3.5 blacklist != iOS 10.3.3 blacklist• Mute the phone, because it is called“VoiceOver”!
• We reduced the brightness to a minimum,still, 2x iPhones were harmed in the process

38 [Photo] https://twitter.com/hackerfantastic/status/1022142922052067331

March 2020 | Bochum, GermanyResponsible Disclosure

39

March 2020 | Bochum, Germany

Great Robot, But Isn’t There an Easier Way?

40

March 2020 | Bochum, Germany

Extracting the “Common” Passcodes Directly From the IPSW
1. Download and install Malus-Security/iExtractor by Răzvan Deaconescu(A tool for macOS to automate the extraction of data from iOS firmware files.)

2. Download and decrypt the latest iOS version using iExtractor
3. Use the following code to extract the PINs directly from the dyld_shared_cache:•VERSION="13.3.1_17D50"
iOS 7 to iOS

CODENAME="YukonD17D50.D22D221OS"
FILE="dyld_shared_cache_arm64" # or "dyld_shared_cache_armv7s" for iOS 7 to 10.3
hdiutil attach decrypted.dmg
strings /Volumes/$CODENAME/System/Library/Caches/$FILE | \grep "\bSecPasswordSeparator\b" -A 120 > blocklist_iOS_$VERSION.txt
hdiutil unmount $CODENAME

41[GitHub] https://github.com/malus-security/iExtractor by Răzvan Deaconescu

March 2020 | Bochum, Germany