Apple might soon release an update for the iPad and iPhone that disables the Lightning port after the phone has been locked for 7 days. Software company Elcomsoft discovered the new security measure in a beta of iOS 11.4. The feature should make it harder for the police or secret services to retrieve information from locked iOS devices.
The feature that disables the Lightning port is called USB Restricted Mode. If the feature is enabled, then iOS will keep track of when the device has been unlocked for the last time or when a trusted computer or accessory was connected for the last time. When iOS finds that none of those events happened the last seven days, it will disable the Lightning port. The Lightning port can then only be used to charge the device.
“In other words, law enforcement will have at most 7 days from the time the device was last unlocked to perform the extraction using any known forensic techniques, be it logical acquisition or pass code recovery via GreyKey or other services. Even the 7 days are not a given, since the exact date and time the device was last unlocked may not be known,” according to security researcher Oleg Afonin from Elcomsoft.
Elcomsoft develops password recovery and decryption tools, and supplies a range of mobile extraction and analysis tools. Customers are e.g. law enforcement and data forensic companies. It will become harder for the company and its customers to do forensics on locked iOS devices, especially when the phone is disabled and the pass code is unknown, according to Afonin.
For now the feature is only in a beta version of iOS 11.4 and it's not sure whether it will also be added to the actual release version of iOS 11.4. Especially because the feature also didn't make it to the definitive version of iOS 11.3 while Apple did make it available in the beta of iOS 11.3.
