This Box Bruteforces Your iPhone PIN Without Triggering The 10-Guess Limit

A simple PIN might keep your iPhone safe from the prying hands of a curious toddler or a drunk friend. But slap that thing in a robot that exists for no reason but to try every possible PIN one-by-one, and it’ll crack it right open.

These machines have existed for a while, but this one is particularly crazy: if you’ve got your iPhone set to clear all of its data after 10 failed guesses, it’ll try to exploit its way past that.

Note the “try” in that last sentence: while we’re still waiting on confirmation from Apple on this one, there’s a good chance that the trickery at play here only works if you’re on a build of iOS older than iOS 8.1.1 (Shipped November 2014). Apple’s notes for 8.1.1mention patching a bug (CVE-2014-4451) that could circumvent the “the maximum number of failed passcode attempts”; it’s not clear if that’s the same bug at play here, though it seems likely.

Here’s the device in use, via MDSec, who was able to obtain the bruteforcer for around $300:







It can be a bit hard to tell what’s going on in the video, so here’s what you’re looking at:
On the left is the iPhone, splayed open for direct access to its internals
On the right is the bruteforcing box.
The iPhone’s internal battery appears to be disconnected, giving the bruteforce box the ability to cut the iPhone’s power instantly
Each time the device makes a guess, it sends it to the iPhone over USB. (It makes its first guess in the video above at 0:30)
If the guess fails, an optical sensor strapped to the screen recognizes it, and…
In a split second, the bruteforce box cuts the power and forces the iPhone to shut down before it can write the failed attempt to memory.
The iPhone resets, and the box is free to try again.
When the optical sensor detects a successful entry (like the one at 1:53 in the video above), the box stops guessing, logs the correct PIN, and starts beeping to get the attention of whoever was using it.

Because each failed attempt requires a reset, each run takes roughly 44 seconds. If it fails until the very last try on a 4-digit password, that’s 4.5 days of bruteforcing. That’s not exactly Hollywood spy movie speed hackery — but if they’ve outright stolen your phone and really want to see what’s inside, it’s plenty quick.

So, how can you protect your device from this?
Update. If this isn’t fixed in iOS 8.1.1 or 8.2 (and it seems likely that it is), you can bet that Apple is rushing to patch this one now that this video is floating around.
Use a longer password. As JWZ points out: at 44 seconds per try, a 4-digit pin take up to 4 1/2 days to crack. A 7-digit pin takes up to 12 years.

We’ve reached out to Apple for comment on the status of the exploit at play in the video, but have yet to hear back.

Read More

Apple Researching Taptic Feedback For Keyboards With No Physical Keys

Apple has a new patent application that modifies one of their existing inventions based on one of their newly announced techs: Taptics. The application, published by the USPTO today (via Patently Apple) features a virtual keyboard design that resembles the current Magic Trackpad accessory in its construction, with a smooth piece of aluminum used instead of physical buttons. Virtual buttons without touch-based input are used instead, and Apple employs haptics to provide feedback for key presses.

Its own taptic version of haptic feedback could theoretically be used in the way it’s employed with the new Force Touch trackpadApple has created for its MacBook and 13-inch Retina MacBook Pro. This would allow users to get the sensation that they were actually pressing physical keys, even though the keyboard itself would have no mechanical movement, which would answer one of the biggest criticisms users have of virtual keyboards.

Apple could also then offer up user customizations for the input device, configurable via software, the way it has on the Force Touch trackpad. You might be able to select different “depth” of key press sensations, depending on preference, or use Force Touch (secondary, deeper presses) to activate features like special characters, accents for other languages, or for triggering function keys.


Virtual input for things like standalone or MacBook keyboards has a lot in the way of potential benefits – imagine a keyboard that never needs dusting, or even thinner MacBooks thanks to the elimination of the need to build-in key travel. It’s also just less mechanically complex, which should make for longer life without failure. Apple’s recent advances with taptics could finally mean that this kind of keyboard is possible without the drawbacks of eliminating the physical typing sensation, which would differentiate it from other efforts to do the same.

We’ve already seen many predict that taptics will come to the iPhone and iPad next, but Apple’s tech is also a logical next step for its hardware keyboards, too.

Read More

Apple Researching Taptic Feedback For Keyboards With No Physical Keys

Apple has a new patent application that modifies one of their existing inventions based on one of their newly announced techs: Taptics. The application, published by the USPTO today (via Patently Apple) features a virtual keyboard design that resembles the current Magic Trackpad accessory in its construction, with a smooth piece of aluminum used instead of physical buttons. Virtual buttons without touch-based input are used instead, and Apple employs haptics to provide feedback for key presses.

Its own taptic version of haptic feedback could theoretically be used in the way it’s employed with the new Force Touch trackpadApple has created for its MacBook and 13-inch Retina MacBook Pro. This would allow users to get the sensation that they were actually pressing physical keys, even though the keyboard itself would have no mechanical movement, which would answer one of the biggest criticisms users have of virtual keyboards.

Apple could also then offer up user customizations for the input device, configurable via software, the way it has on the Force Touch trackpad. You might be able to select different “depth” of key press sensations, depending on preference, or use Force Touch (secondary, deeper presses) to activate features like special characters, accents for other languages, or for triggering function keys.

Virtual input for things like standalone or MacBook keyboards has a lot in the way of potential benefits – imagine a keyboard that never needs dusting, or even thinner MacBooks thanks to the elimination of the need to build-in key travel. It’s also just less mechanically complex, which should make for longer life without failure. Apple’s recent advances with taptics could finally mean that this kind of keyboard is possible without the drawbacks of eliminating the physical typing sensation, which would differentiate it from other efforts to do the same.

We’ve already seen many predict that taptics will come to the iPhone and iPad next, but Apple’s tech is also a logical next step for its hardware keyboards, too.

Read More

Quid Raises $39M More To Visualize Complex Ideas

Quid just announced that it has raised $39 million Series D.

Quid describes itself as “the artificial intelligence company that accelerates research and insights to address the world’s most complex issues.” More specifically it points to its ability to process millions of documents and create a visual map of the results — for example helping a business visualize the online response to a product launch.

The company, by the way, was once the owner of what we called the most pretentious startup website ever — by now, though the typeface descriptions have now been replaced with a marketing pitch for the technology, and quotes from customers like Hyundai, Microsoft, and the Boston Consulting Group.

When we wrote about the company back in 2010, it was focused on tracking emerging technologies, but it seems to have broadened its scope since then. Quid now says it has signed up 80 clients since launching the current platform at the beginning of last year.

The new funding was led by Liberty Interactive Corporation, with participation from ARTIS Ventures, Buchanan Investments, Subtraction Capital, Tiger Partners, Thomas H. Lee Limited Family Partnership II, Quid board member Michael Patsalos-Fox and Quid chairman Charles Lho.

Read More

Tesla Says It Will Now Be “Impossible To Run Out Of Range Unintentionally” In A Model S

A few days ago, Elon Musk pledged to “end range anxiety” for Model S owners by way of an over-the-air software update.

Today, he’s detailed how he plans to do that.

The short version: the Model S will now run constant calculations (regardless of whether or not you’re using the built in turn-by-turn system) on how far you are from a supercharger.

If you are about to drive too far from a supercharger to make it back to one, the car will warn you. “This makes it effectively impossible for a driver to run out of range unintentionally”, says Musk. “You’ll have to confirm you want to, actually. Twice.”

The Model S already tries to estimate how much charge you’ve got left on your battery; it’ll also tell you how far you are from the nearest supercharger. This update really just ties those two points together, as well as some outside data, to put a big ol’ warning sign up when you’re about to drive just a littletoo far.

The system will also now have a built-in trip planner, which allows you to route long distance trips with superchargers in mind. The range estimator here will factor in things like the additional energy needed for climbing up windy mountain passes, as well as real-time data like high-wind speed.

Story developing

Read More

In Emerging Markets, Internet Blamed For Having Negative Impact On Morality

A new study out this morning from Pew Research takes a deep dive into the impact that internet access is having on emerging markets, especially in terms of how it’s shaping public opinion.

Today, tech companies like Facebook and Google have made significant investments in bringing internet access to developing countries, the former withinitiatives like Internet.org designed to offer free mobile internet access in select geographies, and the latter with aerial projects like its Project Loon balloons or high-flying drones that would provide internet access to previously unconnected regions. But whether or not the region’s citizens will ultimately view these moves as helpful or appreciated, has yet to be examined.

While most of those reading sites like TechCrunch generally view the internet and the access to information it provides as an overall positive, we can sometimes gloss over the realities that come alongside having a network that allows everyone in the world the ability to connect. In more recent years, we’ve seen the network abused as a tool that’s allowed the government to spy on its own citizens, as well as a place where people can anonymously harass and threaten others with violence, while hiding behind the safety of their keyboards and mobile screens.

Despite these downsides, most would rather have internet access than be without it. But will the same hold true for those who are just now being connected for the first time? Will they eventually share these sentiments?

According to Pew Research’s study, which examined technology use in 32 emerging and developing nations, people’s thoughts on the benefits of internet access were mixed. Those Pew spoke with were more likely to say that the internet is a negative influence on morality, and were divided on its effect on politics. At the same time, they saw its advantages when it came to education, and to some extent, valued its effects on personal relationships and the economy.



In these emerging markets, Pew says that a median of 64% of the general population, including non-internet users, say the internet is a positive influence on education, and 53% feel the same about its influence on personal relationships. 52% believe it’s also a positive impact on the economy. However, only 29% say the internet is a good influence on morality – and a further 42% go so far as to say it’s a bad influence.

These sentiments, notes Pew, are fairly consistent across the countries it studied. And there was no country where the internet was viewed as positively influencing morality.



What’s interesting is that those who gain internet access are more likely to feel positive about its societal influences. For instance, 65% of internet users in the emerging markets believe the internet is a positive for personal relationships, while only 44% of non-internet users would agree. In addition, the more highly educated share this viewpoint, too, with 6 in 10 believing in the positive influence on this matter, while only 44% of those with less education feel the same.

Facebook, from a business perspective, is right to invest in spreading its network’s reach, Pew’s new data also supports. It seems that, once connected, those in developing regions embrace socializing online as their preferred digital activity with 86% contacting friends and family, and 82% joining a social networking site. Among the internet users in these countries, 82% use sites like Facebook and Twitter.

Meanwhile, fewer users take advantage of the internet to get political news (54%), get health information (46%), or get information on government or services (42%). Fewer still use their newfound access for things related to career or commerce, like job hunting (35%), making payments (22%), shopping (15%) or taking online classes (13%).

It’s unfortunate, though, that Pew’s research didn’t dig further into the questions users had about the internet and its impacts on morality – the report doesn’t mention the specific problems people believed the internet was to blame for, or the types of services or activities that helped to erode morality as a whole.

But given that the majority of users quickly turn to online socializing after gaining access to the web, there a likely some connection between people’s online social behavior and this shared belief. With the absence of face-to-face connections and the pressures that come with abiding by a society’s rules, people feel freer online. And that can mean they’re also freer to abuse others and to share their true thoughts, even those they wouldn’t admit to in public. Those behavioral changes could influence people to think of the internet as a largely more negative force when it comes to morality.



The full report, which also details how users get connected, as well as what sorts of activities they engage in on a per country basis, is available here. It’s worth noting that even though the internet is affecting more people’s lives in these regions, large numbers are still without access – across the 32 countries studied, only 44% use the internet at least occasionally, compared with 87% of U.S. adults.

Read More

Shuddle Raises $9.6M For Its Uber-Style Service For Kids And Seniors

As Uber continues to extend is well-funded tentacles into ever-more categories of transportation, a startup focusing on children and elderly people has raised some money of its own to compete. Shuddle, a car service and app founded one of the co-founders of Sidecar and aiming its service on minors and seniors, is today announcing a Series A round of $9.6 million led by RRE Ventures.

Existing investors Comcast Vento res, Forerunner Ventures, Accel Partners and angels also chipped in. The total amount raised by Shuddle is now $12 million.

CEO and founder Nick Allen (who left Sidecar in 2013) tells me that the funding will be used to expand the company’s business both in the Bay Area — its only market since coming out of beta in October 2014 — as well as into new markets.

“We are at capacity for the service today,” he says. “We are adding new drivers every week and we have grown five times in ride volume since coming out of beta.” He says new cities will be announced in the next couple of months. The service now has some 200 drivers on is books.

Shuddle sets itself apart from services like Uber in a couple of different ways: In addition to specialised insurance specifically designed for minor and elderly passengers and drivers that need to drive and accompany them outside of the car (more on that below), Shuddle makes people go through extra training and two different sets of background and reference checks before they can become drivers on the platform.

Right now the “vast majority” of its 200 drivers are only women, he says. And this in itself makes Shuddle a notable and often welcome alternative.

“Women have been largely excluded as drivers by other services because the experience can be unsafe,” he says. “They don’t know who they are picking up or where they are going. Women are attracted to our value proposition. These drives are in the daytime, you know it’s someone who isn’t threatening. It really is different and women are responding to this.”

He says that people who are signing up to drive on the Shuddle service include teachers and nannies “who are doing this kind of thing anyway so this fits into the routine.”

On top of this, there are differences in how the service presents itself to customers. To use Shuddle you need to pay a $9 membership fee each month to cover things like driver training and screening. Allen says that the per-ride fee is typically 15% more expensive than UberX “to compensate drivers for extra training.”

And while services like Lyft and Uber have built their credibility on being on-demand, Shuddle typically books for rides between 24 hours and one week in advance.

No plans yet to add on-demand into the mix, he says, because of the nature of what Shuddle does, which can include not just collecting passengers, but physically going into schools or other places to sign them in or out. But one thing they are looking at is a carpooling-style service, which is handy considering this is one way that parents today typically work around endless ferrying obligations.

All the same, Shuddle competes directly with the likes of Uber to drive kids and elderly people from points A to B — services like Uber and Lyft are already used in this way, and Allen tells me in fact that he came up with the idea for Shuddle when he was still at Sidecar.

“I saw parents using sidecar in LA for the purpose of driving their kids around, but we didn’t have the right insurance and the service just wasn’t built for that,” he says. “But I started talking to parents and they really emphasized how much of a pain point this was.” Indeed, as a parent myself that has to juggle work and small kids with activities every day of the week — I can attest to this first hand.

It’s the extra attention that attracted the extra investment.

“Nearly every parent struggles with getting their kid(s) from point A to point B because they often need to be in two places at once. Shuddle solves this problem,” said Steve Schlafman, Principal at RRE Ventures, in a statement. “RRE Ventures is incredibly excited to partner with Shuddle to bring safe, reliable and trustworthy transportation to millions of families across America.” The VC has funded other e-commerce marketplaces aimed at specific verticals before, including Bark & Co.

Read More