How Apple is Locking Out Cops

0:00This show is sponsored by BetterHelp. It's that time of year we think about people we're thankful for. Here at 404 Media, we're thankful for all our subscribers and listeners and the people who have helped us start and make a sustainable new thing. This month, while you're thinking about what you're thankful for, take a moment to think inward and think yourself. Sometimes it's hard to remind ourselves we're all trying our best in a crazy world. And you can learn how to better process that world with therapy. Starting therapy has helped me understand what I can control and what I can't. Taught me positive coping skills, how to set boundaries, and how to deal with acute anxiety and more generally just take on the world.

0:40If you're thinking of starting therapy, give BetterHelp a try. It's entirely online, designed to be convenient, flexible, and suited to your schedule. Just fill out a brief questionnaire to get matched with a licensed therapist and switch therapists anytime for no additional charge. Let the gratitude flow with BetterHelp. Visit betterhelp.com slash 404media today to get 10 % off your first month. That's betterhelp.com slash 404media.

1:17Hello and welcome to the 404 Media podcast where we bring you unparalleled access to hidden worlds both online and IRL. 404 Media is a journalist-founded company and needs your support. To subscribe, go to 404media.co. As well as bonus content every single week, subscribers also get access to additional episodes where we respond to their best comments. Gain access to that content at 404media.co. I'm your host, Joseph, and with me are 404 Media co-founders sam cole howdy emmanuel mayberg hello and jason kebler hello all right this is going to be a slightly different episode we're gonna usually we talk about three stories uh each week right we're going to open with one and then we're going to talk about something that maybe jason is still going to write about but hasn't yet it's about the big migration to blue sky so i guess are you writing about that jason yeah probably it might be even be out by the time this is uh this is published who knows okay i guess we'll see and i'll see we'll see as for the first story um this is one i wrote apple quietly introduced iphone reboot code which is locking out cops um i guess i'll start with what apple has done and then um maybe jason has some questions for me but as the headline suggests apple has introduced this feature an undocumented feature i'll say like there isn't like a blog post about it there isn't anything really on apple's website but it appears to be called uh inactivity reboot or something like that and in essence what happens is if an iPhone has not been unlocked for around three or four days, it will reboot itself.

3:19And now you may be thinking, okay, why the hell would I care about that? Also, I don't know, maybe I have an alarm to go to the airport and it's going to ruin my alarm or something like that. The point is, it seems, to make the phone more secure against forensic equipment. Stuff like Greaky. Stuff like Celebrate. So, I want to talk about how cops get into phones. Like Celebrate and Greaky are two of them. But there's two different modes. There's before first unlock and then after first unlock. Maybe that is a good place to start here. Yeah, that's fair. So after first unlock, AFU is, as the name implies, imagine a user has taken their iPhone, they've powered it on as they would normally, and they've unlocked it at some point during the day.

4:19that puts the phone into an AFU state. And obviously it's on a case-by-case basis. The operating system, the phone, also applies to Google Android handsets as well. But broadly speaking, that makes it a bit easier for tools like GrayKey or Celebrate to get access to user data. You then have BFU before first unlock, which is basically when the user has not unlocked their phone. And you can imagine it's sort of the state a phone is in. As soon as somebody turns it on, you know, if I turn on my iPad, for example, I can't use Touch ID or anything like that to get into it. It always asks for the passcode.

5:03I haven't unencrypted that data or decrypted that data at any point. So that is a BFU state. And if you're a forensic investigator, you don't want a phone to be in a BFU state because it's going to be generally harder for you to actually get data out of there. Does that answer your question? It does. I think you've also reported recently on a few leaked, I guess they're spreadsheets, but they're basically like what types of iPhones and what iOS can be unlocked before first unlock. after first unlock and it's like some of these tools are able to uh are like not able to get into newer phones before first unlock if they're updated or it takes longer or or it's just like more difficult right yeah and i mean you're referring to some celebrate documents that we got a while you published a few months ago yeah yeah this was back in july and i think the documents were from a few months before that i think they were dated to april and there it says stuff like oh unlocking ios 17.4 at the time was in research and then actually shortly after we published that piece some people leaked some other more updated celebrate documents and they showed that celebrate had caught up and it was able to unlock IOS 17.4 in an AFU state specifically.

6:40Like you look at the spreadsheet and it says, yes, we can do it, but only an after first unlock, which goes back to the point I said earlier about if you're a cop or forensic expert, you want in an AFU state, because it seems, you know, at least with these leaked Celebrite documents we reported on a while back and have seen the newer ones, it's easier, basically, for them to do. Do you want to talk a little bit about how you first started reporting on this specific story? Because there's actually two articles, one based on a specific leaked cop document that you got, and then where they were sort of theorizing what had happened, and then you figured it out and published a second story explaining the whole situation.

7:25Yeah. So I'll put this one in the show notes as well. I just didn't want to lead with it because it's not that we were wrong. The cops were wrong. I was just reporting what they were saying. But the headline was police freak out at iPhones mysteriously rebooting themselves, locking cops out. Okay. Sounds kind of straightforward. I got sent a document, which is written by, it seems law enforcement in Detroit. And they said that they had a bunch of iPhones ready to be forensically examined in their forensic laboratory or whatever and they go in to do that and a bunch of them have magically or mysteriously rebooted and they're like what the hell, the phones weren't like this which is very interesting to us and very very concerning to them they theorized that Apple had pushed an update to iOS 18 that was telling iOS 18 phones, like sending them a message to nearby phones saying, oh, reboot yourself, almost like it was infecting or like poisoning other phones in the lab.

8:38That is a very interesting theory. Multiple people I spoke to said they didn't really put much weight into that theory. And then another leak I actually got later from somebody who works with Greiky, said they doubt it as well. So basically the cops were like half right. They were right, obviously. The phones are rebooting because they can see it right in front of them. They were just wrong about how and why exactly because it wasn't some sort of poisoning iOS 18 code that was infecting other devices. It was more, there's basically a timer counting down when a phone is on the most recent Apple operating system.

9:25And I should say that I published that first piece and then researchers very diligently start digging through what updates may have happened. And one found the inactivity reboot. I then spoke to a couple of others and then got a leak as well. And that's how we got to the ultimate answer. There's this undocumented feature. And I'll just clarify that, Apple hasn't given a statement on this. Obviously, I'm talking to Apple and I'm trying to get a statement out of them. But they haven't confirmed it. Instead, I've spoken to three or four people about it who independently verified it. Do you think that we could...

10:09Can you safely say that this feature was added for the express purpose of preventing tools like gray key and celebrate from breaking into phones or is it a broader security mechanism like obviously we probably can't say for sure but i think like does this seem like something that is targeted at the cops or is it more of a broad security feature for its customers that has like other implications like anti-theft and things like that yeah again apple isn't commenting but i feel pretty confident in saying, at least in my own opinion, that it's the latter. I think that Apple takes a much more general approach to security, uh, and where they could, they can introduce features that will impact lots of different parts or threats or that sort of thing.

11:05I mean, you can think about it sort of when they did that lockdown mode and that, and that sort of restricts a lot of features on the phone um some people will say that came in response to nso malware being spread on iphones and that sort of thing i don't think so i think it's broadened that there's many more malware vendors and contractors and i think it's sort of here in that um having a phone reboot after a certain period of time will also potentially stop data being extracted from phones have been stolen for example just by normal thieves on the street i don't think they're necessarily specifically going out and being like we're gonna screw over greykey or we're gonna screw over celebrate i mean the consequences they definitely are but i don't think uh at least in my opinion that they're doing that um specifically for that you know and i think you can look back at some earlier features where they've they've introduced new stuff like there There was USB restricted mode quite a few years ago at this point.

12:09And that made it so after a certain period of time, you couldn't sort of make the phone interact with a computer. It basically became like a dumb charging cable. So you couldn't plug it into these devices and that sort of thing. I see it sort of in that context, you know. Yeah, I mean, the cat and mouse game between Apple and I guess Google as well, and other phone manufacturers, but especially Apple and Google and law enforcement and the government and hackers more broadly is super interesting. And it's something that you've been covering for a really long time. It's also something that, I mean, the big sort of flashpoint was the San Bernardino shooting a long time ago.

12:54I mean, it wasn't that long ago, but that was sort of a moment where there was a ton of pressure on Apple to put a backdoor into the suspected shooter's phones. Well, they were the actual shooter's phones. And I feel like this is just my opinion, but I think that there's some truth to it. There was an ongoing court case between the Department of Justice and Apple, and it was headed toward this very important, or what would have probably been a pretty important court decision. And what happened instead is the Department of Justice and the FBI found another way to get into that phone. And I believe we still don't know, at least on the record, who did it.

13:37Well, the FBI never confirmed it, but it's Asimov Security, which is, I had one source. I covered about Asimov Security with our former colleague Lorenzo years ago, and they're a super important, very, very small hacking shop that works with Five Eyes intelligence agencies and law enforcement. And then the Washington Post reported later that it was them that basically broke the San Bernardino phone. Yeah. I guess I bring it up because Apple is actually... There's kind of a symbiotic relationship between Apple and companies like Azimuth and Celebrite and Grayshift where Apple will update iOS to not be as hackable.

14:22then they update their hacking tools to break into them and in some ways this keeps some of the pressure off of apple to have a formal backdoor into ios or into the iphone where apple probably doesn't like the existence of these companies but the fact that they do exist has taken a lot of pressure off of them in my opinion like can you talk a little bit about that I mean, I think that's a really, really good way of putting it. It's similar to, I gave a talk recently at DEF CON, and there's the free options when you get data from companies, right? There's the front door, and you send a search warrant or a court order to Discord, and it gives the user messages or something like that.

15:06At least when it comes to encrypted messaging services like Signal, you don't really want them doing that, right? That would kind of suck. The other one is a backdoor, which you also don't really want for signal and to your point you don't really want a backdoor in the iphone because there's going to be all sorts of unintended consequences because can that backdoor be protected would it be abused is it going to be available to non-western law enforcement all of that sort of thing and the third option is basically what we have which is hacking goes on apple and others try to stop it the hacking companies get better and get workarounds and the cycle continues and it's expensive and it's labor intensive, but that's better than having a backdoor, you know?

15:51And I think the way you put it, Jason, was really interesting in that the taking pressure off Apple, I haven't really thought about it that way before. That's really, really interesting. Yeah. I mean, I guess it's just like if these tools didn't exist, we would probably be having the encryption debate constantly in the United States. And it hasn't gone away entirely, but I think the fact that law enforcement can get into most phones has made it so that there's not as much political pressure on Apple to introduce a full backdoor into the iPhone. Because that was something they were obsessed with for a while.

16:27There's a huge history of going dark and just this tension between law enforcement and technology creators and encryption providers. And you still have some of that, especially worldwide. There's been some attempts to force Apple and other companies to put a backdoor in, but it feels like the US government has at least pulled off of that for a while. Anyways, what do you think happens next? What is the ultimate impact of this new feature that you found? Yeah, usually I would say, well, they'll just continue and the cycle of life carries on and people find exploits and they hack into iPhones and that sort of thing.

17:15And I do think that's the case. And I do think that will continue. That being said, having a four-day timer in the iPhone to reboot, to go into a state where the cops can't get in, that is dramatic, for sure you know and i think what will happen practically is that i mean of course maybe the grey keys and the celebrites of the world will try to find more technical solutions to get around that uh i think it will probably change policy uh i don't know local state federal forensic laboratories where they say like we have three or four days to get into this phone and we need it to be stores correctly we need to get it we need to get it into a afu state we need to unlock it something like that um technically again you're going to need the tools to do that potentially maybe there will be then be more pressure to uh on the individual suspects like you have a time you have a deadline to unlock this phone for us and if you don't there's going to be a problem you know because it even got to the point where they started introducing face id and touch id right you then have in the search warrants new boy not new now but at the time boilerplate language saying we can force you to put your finger on here like legally you know and i don't know maybe they introduced more language that could um do something about the timeline you know i think before we end this section, do we have a sense of how long it takes to break into a phone with a strong password that is updated?

19:00This isn't necessarily a 10-second process, as we understand. That's a fair point, actually. I don't have modern or recent data on how long it would take. But it's interesting in that if that four-day timer is counting down since it was unlocked before, if your brute-forcing attempt or your unlocking attempt is going to take more than four days, are you just also screwed there as well? It's not like, oh, we can just keep the phone alive. It's like, no, you have to basically get in there. I don't know. Yeah, it really depends on the passcode, that sort of thing. Yeah, it's just because you can alter, not alter, but there's an option on the iPhone to, instead of using a four or six number passcode, you can have an alphanumeric password.

19:52And if it's a really long one, that is by definition going to take longer to brute force. If that is how these tools are currently working, which, you know, it's kind of hard to say, but that's an interesting, that's like a question I have essentially. Yeah, for sure. I mean, hopefully we get some clarity on that as well. um all right we'll leave that there and then when we come back after the break we're going to talk about blue sky we'll be right back after this

20:32for a gift that's always on time and lasts a lifetime you can't do better than masterclass With Masterclass, your loved ones can learn from the best to become their best. Masterclass is the only streaming platform where you can learn and grow with over 200 of the world's best. That's why Wirecutter calls it, quote, an invaluable gift. Gift unlimited learning. Learn from any Masterclass instructor, anywhere. On a smartphone, computer, smart TV, or if you're always on the go like me, you can even listen in audio mode while you drive, walk the dog, or exercise. Help your loved one learn to skateboard with Tony Hawk, learn directing from Ron Howard, or the art of the viral video with Marcus Brownlee.

21:16I'm on a cooking kick, so I'm learning how to make stocks and sauces from Chef Thomas Keller. The classes really make a difference. 88 % of members feel that Masterclass made a positive impact on their lives. Plus, there's no risk. Every new membership comes with a 30-day money-back guarantee. Give your loved ones a year of learning with Masterclass. Masterclass always has great offers during the holidays, sometimes up to as much as 50 % off. Head over to masterclass.com slash 404pod for the current offer. That's up to 50 % off at masterclass.com slash 404pod. masterclass.com slash 404pod. This podcast is sponsored by LegalZoom.

21:59You're listening right now to a real LegalZoom customer. That's right. 404 Media used LegalZoom to take our business from an idea to a registered compliant entity. I'll be honest, I was really overwhelmed trying to figure out how to start a business. But with LegalZoom, we didn't have to worry. LegalZoom helps business owners like you take your first step and every step after. From reliable business formation to experience guidance in legal and tax. Setting up your business properly and remaining compliant are things you want to get right from the get-go, but you also don't want to strain your brain or wallet.

22:35LegalZoom saves you from wasting hours making sense of the legal stuff. At LegalZoom.com, you can take care of business legal needs in just a few clicks. And if you need some hands-on help, their network of experienced attorneys from around the country has your back. Launch, run, and protect your business to make it official today at LegalZoom.com and use promo code 404media to get 10 % off any LegalZoom business formation product, excluding subscriptions and renewals. Expires 12-31-24. Get everything you need from setup to success at LegalZoom.com and use promo code 404media. LegalZoom.com and use promo code 404media.

23:17LegalZoom provides access to independent attorneys and self-service tools. LegalZoom is not a law firm and does not provide legal advice except where authorized through its subsidiary law firm LZ Legal Services, LLC. In today's world, data breaches happen all the time, and even the most secure companies can't always protect their employees' personal information from ending up in the wrong hands. That's where Delete Me comes in. Delete Me is a service that removes your employees' sensitive information from hundreds of data broker websites. Sites where hackers can find phone numbers and emails within seconds.

23:54Rachel Toback, CEO of Social Proof Security, says attackers use this data to target employees with phishing messages and AI-powered phone scams. But Delete Me makes it harder for these bad actors by scrubbing your employees' details regularly. It's simple. Attackers are lazy. If it's too hard to find contact info, they'll move on to easier targets. Delete Me takes care of this for you, doing the heavy lifting so you don't have to. And over time, they keep removing the information so it stays down, protecting your team from constant exposure. If your business has a social presence or deals with clients, you need DeleteMe.

24:34Visit deleteme.com slash 404media and start safeguarding your team's information today. That's deleteme.com slash 404media. Hackers and cybercriminals have always held this kind of special fascination. Obviously, I can't tell you too much about what I do. It's a game. Who's the best hacker? And I was like, well, this is child's play. I'm Dina Temple-Raston. And on the Click Here podcast, you'll meet them and the people trying to stop them. We're not afraid of the attack. We're afraid of the creativity and the intelligence of the human being behind it. Click here. Stories about the people making and breaking our digital world.

25:16AI machines. Satellite. Engine ignition. Click here. And lift up. Click here. Every Tuesday and Friday, wherever you get your podcasts.

25:37All right, and we are back. we're going to call this section the Big Blue Sky Migration. So what happened? What happened to Blue Sky over the weekend? Did everybody get more followers? Is that what happened? Did anything happen in the last week? Like anything big that would make something happen with social media? I don't know. I mean, you can lay out if you want. I mean, do you want to lay out the timeline? It's a very short timeline, but. I think I'll let Jason do it because I think he maybe has a different perspective. I mean, obviously Trump won and Elon owns Twitter is kind of the very short version.

26:14So, yeah. The interesting thing to me is I haven't seen like a specific like call to action in the way that I have seen in the past when people have migrated off of Twitter to other platforms. I mean, I feel like it was kind of just like a some sort of like shared holy shit moment after Trump was elected as sort of like with the help of Elon Musk. But I don't know. Like I don't, I didn't see some like amazing blog post that said like everyone needs to move to Blue Sky now. It just seemed like people started doing it. And like now everyone is talking about it. But over the weekend, I was trying to figure out why people are moving to blue sky.

26:59And I mean, the reason is Trump's election, Elon Musk's dominance over Twitter. I think also people are starting to get annoyed with threads for reasons we can possibly talk about. But it seemed like people were just moving over very quickly over the weekend. And I got like 6 ,000 followers in two days over the weekend, two and a half days, something like that. I was getting hundreds of followers an hour. And I wasn't even doing anything. I don't know. I just was refreshing Blue Sky. And I don't say that to brag, although I do like my serotonin. It definitely sounds like you're bragging. My serotonin go way up.

27:44Dopamine, etc. Because I was like, wow, people following me. But it was more like... It feels like there's a critical mass on this... social media network for like maybe the first time, but I don't know. Did anyone else, was anyone else even excited about this or is everyone just very mad at me for talking about it endlessly? I'm like begrudgingly back posting again on blue sky. I just, I'm so tired of thinking about like which social network is the right one to be on. And I don't want to add another one to my list of things to check. Like I have to stay on Twitter because we're journalists. So we kind of need to be there.

28:27But now I guess everybody's on blue sky. Like it just feels like another thing to check. So like, that's, that's why I have an attitude about it that people may be picking up on. That Jason has definitely picked up on because I've told him up front, fuck blue sky. But you know, it's like, it's not anything against the people moving there. It's just like, God, here we go again. And it's happened. It happened in, you know, every time there's like a major thing that pisses people off on Twitter, people are like, I'm goodbye to the hell site. And it's like, okay, see you in three days. Like, I don't know.

28:57But this feels different. It definitely feels different in that the last time there was the, well, there was an attempt at a big migration was at, at least as I can remember, was when Musk originally bought Twitter, right? And then there were the blog posts and there were the articles about it's time to leave. We're going to leave it. And, you know, nothing wrong with writing those. And I agree broadly, broadly with all of their points. it's just that sort of what you were getting at Jason this one felt more organic in that people weren't like talking about doing it they just did it and that's interesting you know Emmanuel did you notice any uptick and sort of were you already there or not?

29:38I am there and I definitely noticed the uptick I think one reason that this wave seems to hold more than other ones. And definitely the reason I'm noticing it is the lists that people use now to kind of get up to speed are very useful, right? Like, I mean, the most annoying thing for me about migrating to a new social network is reconstructing your feed and getting all the follows you want. And somebody, many people have just created like lists of people you should follow and you can follow all of them with one click. The startup acts. Yeah, the startup acts. And I think the reason we're seeing like so many like i've gotten a few thousand follows as well and that's probably because i'm on like a couple of lists and i think that's probably true for all of us so that makes it that makes it easy to get up to speed and it makes it very useful um just personally um i think maybe i don't know two years ago or around when elon bought twitter there were a lot of takes and I think there was maybe one on Motherboard about how it's the end of the social media age.

30:52And just from the perspective of an individual user, that's where I'm at. I'm on all the networks and I look at all of them looking for stories. And that's something we were talking about this week. Like, okay, how do I get an interesting feed so I can find cool stories on Blue Sky? um but i am not i think ever going to again be a person who is just like tweeting or skeeting my thoughts and feelings of what i'm doing throughout the day like i think that i'm done with that forever yeah i share my stories um which i know is a very boring feed so i don't begrudge anyone for not following me um and i i go and i read as much as i can always i'm on there all day looking for stuff but i'm i'm not interested in interacting that way and i thought like we as a society were kind of moving away from that um and if anything i mean whatever people should go wherever they're happy and and like do whatever they want i don't judge you for for for tweeting or skeeting but um i thought i thought we were moving towards like group chats and discord channels and uh comments on subscription websites like four four media like i'm i love interacting there if you email me i'll email you back if you comment on a story i will i will respond to the comment um we love reading you know emails and comments you you send us here on the podcast, but just like tweeting into the void.

32:26No, thank you. I don't care where you're doing it. So there was in the aftermath of the election, there was like this really widespread take that the left needs a version of Joe Rogan, which I won't get into here, but it feels to me like this is that, but for social media where people are saying like the left needs a version of Twitter now that Twitter is expressly owned by someone who may work in the Trump administration, who actively campaigned for Trump. You have also things like Truth Social and Parler and Rumble and Gab, which are these specific right-wing social media networks that, To be honest, I have more or less discounted over the last few years.

33:23There was this whole time when people were saying,