JayJay
I highly doubt it, because if it was they would disable the password and be able to do full extract by switching on all USB. However this was not done, they had to do manual extract.
Why make an assumption about how they would want to extract data where they have the password? They probably wouldn't want to risk having an app wipe the device if they have another way to use it.
Also if it was, there would have been evidence with more upclose photographs, this was not provided as evidence either.
No, that's a bad assumption and doesn't indicate they didn't discover the password somehow.
An exploit has been used here to bypass.
No, that's not substantiated.
Not so long ago there was a simcard switch exploit that bypassed the password.
Only for After First Unlock state devices. You're ignoring the auto-reboot timer, which gets devices back to Before First Unlock state and was 18 hours by default since the 2024-01-13 release.
We know for a fact that such exploits has occurred before
That also required an After First Unlock state device and have been prevented outright as a class of vulnerability able to get data from user profiles since April 2024. You say to assume they were updated past that, so exploiting fastboot mode would only obtain data available Before First Unlock. A device in Before First Unlock state would also need to have the Titan M2 exploited to brute force a password. If it was a strong password, nothing would get the data in user profiles from a Before First Unlock state device. Titan M2 throttling is needed for a random 6 digit PIN or non-strong passphrase. Exploiting that is very difficult.
From 2022 https://www.youtube.com/watch?v=B6q0nJnltsk (simcard switch exploit).
This was an AFU device exploit, not doable after auto-reboot.
While I am not so updated on the CVS between 2024 until 2024-11-21 one cannot fully protect himself. A complex password+auto reboot timer+USB disabled can only protect you until you are being shoulder surfed.
Yes, they can record you entering the password. If you reuse the password, the weakest security machine where it's used can be targeted. It's also entirely possible someone reused it for a website or other service. You don't know how they got it. If it was a strong passphrase and ANY device was Before First Unlock then they wouldn't have been able to get data from that device without having recorded or obtained the password somewhere. Even if it was a mediocre password, it would take substantial resources and time to crack. The claim that they exploited the devices doesn't add up especially since you say at least one was turned off and therefore Before First Unlock. Exploits cannot bypass the disk encryption as multiple of your posts / statements are implying.
To be able to configure timebased complex password would protect you even further however it depends on what you are defending yourself against.
That doesn't make sense. A standard diceware passphrase combined with the device being Before First Unlock prevents getting past the encryption for user profile data. Even a mediocre passphrase would be a huge hassle to get past. You're implying they exploited the Titan M2 to brute force a relatively weak passphrase. That doesn't seem at all likely, contrary to what you're saying.
Or to be able to have some protection against airplane mode toggle, what-a-heck maybe even a configuration airplanemode toggle =autoreboot first. I mean there are of course more protection one can do but it will come at a cost of convenience.
Enabling airplane mode isn't a problem. Disabling it raises attack surface but is expected as part of emergency calls being possible while locked with it on. We've planned to allow disabling that feature for a while, but it would probably break some regulations.