Security Market Segment LS
Thursday, 10 May 2018 06:26

New iOS feature will disable USB port after seven days


A new feature in iOS 11.4, which is expected to be released in the next few weeks or even sooner, disables the Lightning port after seven days of the device in question being unlocked, and is aimed at preventing device acquisition by law enforcement, a researcher claims.

Oleg Afonin of the desktop and mobile forensic tools maker Elcomsoft said in a blog post that the new feature was known as USB Restricted Mode and had been introduced in the beta version of the 11.4 release.

The claim comes in the wake of recent claims by the FBI that it had been unable to gain access to 7800 mobile devices in 2017, a claim that was questioned by US politicians. In 2016, the agency had a stoush with Apple over gaining access to an iPhone used by a terrorist to kill people in San Bernardino, California.

The FBI subsequently gained access to the iPhone through the services of a private firm known as Cellebrite. More recently, another company, GrayShift, has been reported to be selling devices to unlock the latest iPhones.

The way it works, Afonin said, was "To improve security, for a locked iOS device to communicate with USB accessories you must connect an accessory via Lightning Connector to the device while unlocked — or enter your device passcode while connected — at least once a week.”

The functionality provided by this feature was that an iPhone or iPad would disable the USB data connection a week after the device had been last unlocked.

But some things were not still clear, Afonin added. "At this point, it is still unclear whether the USB port is blocked if the device has not been unlocked with a passcode for seven consecutive days; if the device has not been unlocked at all (password or biometrics); or if the device has not been unlocked or connected to a trusted USB device or computer.

"In our test, we were able to confirm the USB lock after the device had been left idle for seven days. During this period, we have not tried to unlock the device with Touch ID or connect it to a paired USB device. What we do know, however, is that after the seven days the Lightning port is only good for charging."

Afonin said this meant law enforcement would have to act within seven days to gain access to any data on an iPhone or iPad. "Apparently, iOS stores information about the date and time the device was last unlocked or had a data connection to a USB port," he said.

"After the seven days elapse, the Lightning port will be disabled. Once this happens, you will no longer be able to pair the device to a computer or USB accessory, or use an existing lockdown record, without unlocking the device with a passcode. The only thing you’ll be able to do is charging."

He said the arrival of USB Restricted Mode had been expected. "Companies such as Cellebrite and the recent newcomer GrayShift make their business by unlocking protected iPhones. While Cellebrite offers this exclusively as an in-house service, and the service is only available to select law enforcement agencies with proper court orders, GrayKey supplies the actual unlocking hardware to North American law enforcement.

"Both companies keep their lips shut as to the details of their techniques, so the exact method they use to gain access to the devices is not known to Apple. However, their ability to unlock even the latest hardware running the latest version of iOS is worrisome, so Apple is taking action with the USB Restricted Mode."


You cannot afford to miss this Dell Webinar.

With Windows 7 support ending 14th January 2020, its time to start looking at your options.

This can have significant impacts on your organisation but also presents organisations with an opportunity to fundamentally rethink the way users work.

The Details

When: Thursday, September 26, 2019
Presenter: Dell Technologies
Location: Your Computer


QLD, VIC, NSW, ACT & TAS: 11:00 am
SA, NT: 10:30 am
WA: 9:00 am NZ: 1:00 pm

Register and find out all the details you need to know below.



iTWire can help you promote your company, services, and products.


Advertise on the iTWire News Site / Website

Advertise in the iTWire UPDATE / Newsletter

Promote your message via iTWire Sponsored Content/News

Guest Opinion for Home Page exposure

Contact Andrew on 0412 390 000 or email [email protected]


Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.



Recent Comments