GrayKey Bypasses iOS 18.1 Inactivity Reboot
On October 2, IT Home reported alarming cybersecurity news. The technology media outlet 404 Media published a blog post yesterday, October 1. They revealed the existence of a novel forensic tool named GrayKey Preserve. This powerful software successfully bypasses the Inactivity Reboot protection introduced by Apple in iOS 18.1.
The Power of the After First Unlock State
Magnet Forensics manufactures advanced law enforcement forensic tools. They proudly claim their GrayKey Preserve delivers unprecedented access. This tool allows an iPhone to maintain its After First Unlock (AFU) state following a system reboot. Consequently, investigators can access device data much more easily in this state compared to a standard reboot scenario.
Understanding Apple Security Measures
Apple strategically incorporated the Inactivity Reboot feature into iOS 18.1. An iPhone will automatically reboot if it remains locked for 72 consecutive hours. Subsequently, the device enters the highly secure Before First Unlock (BFU) state. This defensive state strictly limits access to critical encryption keys. Therefore, it significantly increases the difficulty of executing successful brute-force attacks.
Evidence Preservation and Device Isolation
The media outlet disclosed a confidential law enforcement training video. This footage detailed the capabilities of the GrayKey Preserve device. Furthermore, Magnet provides a specialized Evidence Preservation Mode for existing GrayKey hardware. Police departments routinely utilize GrayKey technology to access locked smartphones. Magnet asserts that GrayKey Preserve effectively sustains the AFU state after an iPhone restarts.
Preserving Crucial Digital Evidence
The Evidence Preservation Mode allegedly offers additional forensic benefits. It prevents the expiration of cached geographic locations. It also secures recently deleted photos and aging iMessages. Consequently, investigators can preserve highly relevant data for extended periods. Upon completing the initial access, GrayKey Preserve diligently disables cellular networks, Bluetooth, and Wi-Fi. This crucial isolation measure severs the iPhone from all external communications. Therefore, it prevents new messages or remote connections from altering pristine device data.
The Mechanics Behind the Bypass
The training video does not explicitly explain the underlying technical principles. However, iPhone security researcher Jiska Classen offered a compelling hypothesis. She firmly believes the feature might involve artificially tampering with the internal system clock. Alternatively, the tool might silently disable the background system tasks responsible for purging expired data.
