Court evidence shows FBI accessed Signal texts on locked iPhone

Court documents obtained by Forbes indicate the FBI has a way of accessing Signal texts even if they’re behind the lock screen of an iPhone…

breaking into Apple iPhones: iPhone passcode lock screen
iPhone passcode lock screen

Thomas Brewster for Forbes:

The clues came via Seamus Hughes at the Program on Extremism at the George Washington University in court documents containing screenshots of Signal messages between men accused, in 2020, of running a gun trafficking operation in New York…

In the Signal chats obtained from one of their phones, they discuss not just weapons trades but attempted murder too, according to documents filed by the Justice Department. There’s also some metadata in the screenshots, which indicates not only that Signal had been decrypted on the phone, but that the extraction was done in “partial AFU.” That latter acronym stands for “after first unlock” and describes an iPhone in a certain state: an iPhone that is locked but that has been unlocked once and not turned off. An iPhone in this state is more susceptible to having data inside extracted because encryption keys are stored in memory. Any hackers or hacking devices with the right iPhone vulnerabilities could then piece together keys and start unlocking private data inside the device.

For police to access private Signal messages from an iPhone, there are some other caveats besides a device needing to be in AFU mode. The iPhone in question appears to be either an iPhone 11 (whether Pro or Max) or a second generation iPhone SE. It’s unclear if the police can access private data on an iPhone 12. It’s also not clear what software version was on the device. Newer iOS models may have better security. Apple declined to comment, but pointed Forbes to its response to previous research regarding searches of iPhones in AFU mode, in which it noted they required physical access and were costly to do.

MacDailyNews Take: It’s likely the FBI used GrayKey or Cellebrite to access Signal text on these older iPhones that were likely not running Apple’s latest iOS version.

Even with a new iPhone 12 model running iOS 14.x, don’t use simple four-digit iPhone passcodes if you’re concerned about privacy.

To thwart brute-force attempts to unlock your devices, always use long, custom, alphanumeric passcodes. Use at least seven characters – even longer is better – and mix numbers, letters, and symbols.

To change your passcode in iOS:
Settings > Face ID & Passcodes > Change Passcode > Passcode Options: Custom Alphanumeric Code

4 Comments

  1. Re this;

    “ the extraction was done in “partial AFU.” That latter acronym stands for “after first unlock” and describes an iPhone in a certain state: an iPhone that is locked but that has been unlocked once and not turned off”

    Does that mean never been turned off and restarted after the first set up after purchase, or a phone that has been turned off and restarted, unlocked and then locked but is on.

    /asking for a friend.

Reader Feedback

This site uses Akismet to reduce spam. Learn how your comment data is processed.