a reminder on how iPhones are bad in protecting encryption keys in AFU state

grayway2

We were aware with the cellebrite iOS matrix that iphones are literally open boxes in AFU state. This article from magnet is a reminder.

https://www.magnetforensics.com/blog/that-one-artifact-part-2/

Apple introduced auto-reboot in iOS 18 after 72 hours which is clearly insufficient.

Apple is not doing enough to makes iPhones more secure. Sometimes I have the feeling that it's a deliberate act from Apple to make the work of forensic guys more easy.

Google is following GrapheneOS practices such as disabling USB data access for locked devices (Android 16)
They also followed GrapheneOS proposal to zeroing the memory when booting in fastboot.

GrapheneOS is the right example of what looks like a secure OS on a secure hardware.

Google failed to properly secure stockOS. Apple also failed to make iOS enough secure. They had the possibility to do much more but they didn't.

Plotwis

grayway2 What is the relationship between your article dating from 2024 and iPhone security? Up-to-date iPhones cannot be unlocked either in AFU or BFU, the 2025 celebrity matrix is clear on it. Then it was always clear that if you had a threat model integrating the lack of trust in the security hardware element (titan m2 or sep) then your password should be more than 20 alphanumeric characters.

Upstate1618

Plotwis
That's not true. There's no leaked 2025 Celebrate matrix on iPhone. iPhone are vulnerable to AFU extraction per 2024 matrix.

Upstate1618

Plotwis There's no evidence that iPhone are safe from Cellebrite AFU extractions, Period.

Plotwis the 2025 celebrity matrix is clear on it

You are spreading misinfomation with literally NO evidence.

grayway2

Plotwis I was only about AFU not BFU. Up-to-date iPhones are not vulnerable to AFU extraction because Cellebrite or Magnet need to do some research and adapt their forensic tools. But, it's only a matter of weeks if not days while GrapheneOS AFU is not vulnerable since 2022.

Plotwis

Upstate1618 iPhones have been updated several times since 2024, this matrix is no longer accurate. And we are no longer in 2024.

Plotwis

Upstate1618 But do your research before saying people who are disinforming!

Plotwis

Upstate1618 https://www.it-connect.fr/apple-faille-zero-day-exploitee-cve-2025-24200-patchez-votre-iphone/

I would add that even if iphones are exploited, the fact that all data goes automatically and by default to iCloud, makes it impossible to recover data on the device since it contains no information or very little

ryrona

Plotwis I would add that even if iphones are exploited, the fact that all data goes automatically and by default to iCloud, makes it impossible to recover data on the device since it contains no information or very little

No, that is not how it works. Data synced to the cloud is also stored locally on the device, except in corner cases where storage is close to full, where some files may be offloaded entirely to cloud. Either way, getting the access token to the cloud storage would be way enough to recover all files stored there too. I believe most app data is not stored in the cloud at all, and cannot be synced there at all, unless each specific app implements support for that.

Upstate1618

Plotwis there's no matrix in the link you provided. Matrix is a internal document from Cellebrite which shows the iPhone models, iOS versions and corresponding extraction capabilities. The newest leaked matrix is from 2024.

Can you provide the image of newly leaked 2025 matrix?

natoal

Plotwis

How can you claim to not spread misinformation when claiming something so blatantly false

locked

Apple is known to fight governments for the right to data privacy even recently but they were also caught listening on conversations in a flagrant violation of that principle

We know that customers have been concerned by recent reports of people listening to audio Siri recordings as part of our Siri quality evaluation process — which we call grading. We heard their concerns, immediately suspended human grading of Siri requests and began a thorough review of our practices and policies. We’ve decided to make some changes to Siri as a result.

locked

I believe that Apple indeed leaves iPhones open to make it posible for forensics to be able to succeed in getting in. Apple plays a very clever game here. Its unfortunate that they succomed to the pressure probably around 2016.

Plotwis

locked This is wrong since they patched the vulnerability that allowed the exploitation of data via the connector. I shared the link.

Upstate1618

Plotwis There may be other unpatched vulnerabilities. You can't get the conclusion that iPhone are safe against AFU extractions because Apple patched a usbc vulnerabilities. Where's the 2025 matrix you mentioned?
On the other hand I don't think Apple would leave backdoor in their OS for third parties including government.

Plotwis

Upstate1618 The matrix cannot be disclosed at this time, iPhones running iOS 18.4.1 cannot be exploit at this time, and the data sent to iCloud is not stored on the device.

Upstate1618

Plotwis
Do you have it? What's the version number of the matrix? What's the status of 18.4.1 on the matrix(like coming soon, in research etc)? What about 18.3.1 and 18.2?
It's expected 18.4.1 cannot be exploited because it's release this month so it's being worked on.

Dartagnan

Upstate1618 ios 18.4.1 has already been out for at least two weeks.
I have a question, for example in France a policeman does not have the right to unlock your smartphone without your agreement, unlocking is considered as a search with your agreement and your presence. If you refuse, you could be sentenced to 3 years in prison plus a fine. In other countries, for example the USA, if you refuse to allow a police officer to access your smartphone, you're also sentenced to prison. In countries like Iraq and others in the same style, it's even worse. My question is: who would want to prevent this kind of country from investigating your phone? and who would be crazy enough to walk around with grapheneos, /e/os or tails on it in this kind of country? it's a very serious question and I'd like to know who practices this?

Dartagnan

grayway2 Interesting, does this mean that a 4a pixel that hasn't been updated since 2023 is not usable?

grayway2

Dartagnan it's usable but not secure. GrapheneOS still support the 4a which is a total nonsense and they don't look ready to drop the few devices that google does not support anymore.

It makes sense to only support the 5a for a few more months as google might add a security update in case of an extreme vulnerability like Apple did with unsupported iPhones.

raccoondad

grayway2 still support the 4a which is a total nonsense

Its not really that odd to give extended support so people can move devices? GOS devs basically beg you to switch on the forum.