cross-posted from: https://infosec.pub/post/54044619

Ok, so this is hilarious. A few years ago I forget the PIN to my iPad mini 1 and basically everything else about it. When I dredged the device out of its bin, I knew pretty much nothing about it! Like the PIN, iOS version, or even if it had any photos on it. (Well, apparently, I changed the PIN to 123456 to be smart)

Instead of just trying a basic PIN like this, I tried the PINs that I thought it was. Then I tried following some Reddit posts from AsyJAIZ in order to get the device into pwnDFU mode and then creating a ram disk manually... which was misguided. In hindsight, the post from AsyJAIZ just sucks. A lot of what they tell you to do could have been simplified far more than it was.

I waited a few years to pick this up again, and then a week-long journey that required an Arduino Uno R3, USB Host Shield, a fork of checkm8, hacktiv8, the Google Code iphone-dataprotection repository plus some code from AsyJAIZ (and myself), tuanemss/32bit-Bruteforce-Passcode, and developing on MacOSX Yosemite 10.10 with the iOS 8.1 SDK. I decided to eventually just ignore AsyJAIZ's written instructions and instead look into their GitHub repository and apply those patches (which were actually helpful) to a different repository (by dinosec on GitHub), compile it using some SDKs, and then replace files used by tuanemss' shell scripts which then bake a final Ramdisk for me! All I really did was write some C code to try PINs in a different order.

I unlocked the device and it went into iCloud activation lock (which I had to bypass with hacktiv8), then I transferred the three (3) photos off the device. In the end there wasn't much reward for having done all this, besides a few pictures of my dog.

Anyway, it's been an insane journey and I hate myself now. If anything I actually have a good reason now to hate anything Apple makes (at least it pisses off law enforcement). The last apple device I will ever own is my 4 year old SE.

• https://github.com/AsyJAIZ/iphone-dataprotection
• https://github.com/tuanemss/32bit-Bruteforce-Passcode
• https://github.com/bneils/iphone-dataprotection (based on AsyJAIZ)
• https://github.com/overcast302/hacktiv8
• https://github.com/LukeZGD/checkm8-a5

cross-posted from: https://infosec.pub/post/54044619

Ok, so this is hilarious. A few years ago I forget the PIN to my iPad mini 1 and basically everything else about it. When I dredged the device out of its bin, I knew pretty much nothing about it! Like the PIN, iOS version, or even if it had any photos on it. (Well, apparently, I changed the PIN to 123456 to be smart)

Instead of just trying a basic PIN like this, I tried the PINs that I thought it was. Then I tried following some Reddit posts from AsyJAIZ in order to get the device into pwnDFU mode and then creating a ram disk manually... which was misguided. In hindsight, the post from AsyJAIZ just sucks. A lot of what they tell you to do could have been simplified far more than it was.

I waited a few years to pick this up again, and then a week-long journey that required an Arduino Uno R3, USB Host Shield, a fork of checkm8, hacktiv8, the Google Code iphone-dataprotection repository plus some code from AsyJAIZ (and myself), tuanemss/32bit-Bruteforce-Passcode, and developing on MacOSX Yosemite 10.10 with the iOS 8.1 SDK. I decided to eventually just ignore AsyJAIZ's written instructions and instead look into their GitHub repository and apply those patches (which were actually helpful) to a different repository (by dinosec on GitHub), compile it using some SDKs, and then replace files used by tuanemss' shell scripts which then bake a final Ramdisk for me! All I really did was write some C code to try PINs in a different order.

I unlocked the device and it went into iCloud activation lock (which I had to bypass with hacktiv8), then I transferred the three (3) photos off the device. In the end there wasn't much reward for having done all this, besides a few pictures of my dog.

Anyway, it's been an insane journey and I hate myself now. If anything I actually have a good reason now to hate anything Apple makes (at least it pisses off law enforcement). The last apple device I will ever own is my 4 year old SE.

• https://github.com/AsyJAIZ/iphone-dataprotection
• https://github.com/tuanemss/32bit-Bruteforce-Passcode
• https://github.com/bneils/iphone-dataprotection (based on AsyJAIZ)
• https://github.com/overcast302/hacktiv8
• https://github.com/LukeZGD/checkm8-a5

Ok, so this is hilarious. A few years ago I forget the PIN to my iPad mini 1 and basically everything else about it. When I dredged the device out of its bin, I knew pretty much nothing about it! Like the PIN, iOS version, or even if it had any photos on it. (Well, apparently, I changed the PIN to 123456 to be smart)

Instead of just trying a basic PIN like this, I tried the PINs that I thought it was. Then I tried following some Reddit posts from AsyJAIZ in order to get the device into pwnDFU mode and then creating a ram disk manually... which was misguided. In hindsight, the post from AsyJAIZ just sucks. A lot of what they tell you to do could have been simplified far more than it was.

I waited a few years to pick this up again, and then a week-long journey that required an Arduino Uno R3, USB Host Shield, a fork of checkm8, hacktiv8, the Google Code iphone-dataprotection repository plus some code from AsyJAIZ (and myself), tuanemss/32bit-Bruteforce-Passcode, and developing on MacOSX Yosemite 10.10 with the iOS 8.1 SDK. I decided to eventually just ignore AsyJAIZ's written instructions and instead look into their GitHub repository and apply those patches (which were actually helpful) to a different repository (by dinosec on GitHub), compile it using some SDKs, and then replace files used by tuanemss' shell scripts which then bake a final Ramdisk for me! All I really did was write some C code to try PINs in a different order.

I unlocked the device and it went into iCloud activation lock (which I had to bypass with hacktiv8), then I transferred the three (3) photos off the device. In the end there wasn't much reward for having done all this, besides a few pictures of my dog.

Anyway, it's been an insane journey and I hate myself now. If anything I actually have a good reason now to hate anything Apple makes (at least it pisses off law enforcement). The last apple device I will ever own is my 4 year old SE.

• https://github.com/AsyJAIZ/iphone-dataprotection
• https://github.com/tuanemss/32bit-Bruteforce-Passcode
• https://github.com/bneils/iphone-dataprotection (based on AsyJAIZ)
• https://github.com/overcast302/hacktiv8
• https://github.com/LukeZGD/checkm8-a5

I take credit for this fan edit of the movie Timecrimes. It was something I did over the summer when I realized that my previous edit was seriously out of sync. I had a load of fun learning new things in the movie (e.g. the radios get replayed) and the ending walkie talkie realization that I hadn't paid enough attention to.

I pinged every IP address that wasn't reserved. The image is 8k by 8k and is re-encoded as an AVIF to be friendlier to mobile devices. Like every other survey done, it is using a Hilbert Curve to convert the linear address space to a contiguous 2d space. The hotter the colors (blue is coolest), the denser the ping responses were.

(If you are interested the full-resolution pyramidal-tiled TIFF can be downloaded and viewed in QuPath on desktop. I've also compressed the ping response data into its own format down to about 150 MB. PM me for a link)

Non-proxied image

Here is a 2006 survey to compare.

Some observations: Big Tech (USA) is in the top left. US government allocations, for the most part, did not respond to any pings. And maybe you didn't realize this before, but Multicast (Class D) & Class E consume a whopping 12% of the IPv4 range.

Hello lemmings, I made a program to ping every IPv4 address and collect data on respondents. I am almost done, but I want feedback on things I should change or how I can improve my current record of 5,000 pings / second.

I am currently aware that I need to properly parse the data I receive on the receive socket, since it's possible the TTL router messages might be confused as replies. ICMP is used on networks to inform other machines of network problems.

One issue I'm aware of is the tuning that has to go into maximizing throughput while also avoiding a total system freeze. My code seems to spend too much time opening sockets that it leaves no room for the actual OS. My only fix currently is limiting the CPU time to the ping timeout I used.

The overall program works like this: It keeps a linked list / pool of task objects. All objects are initially in the "free list" and then when they become associated with a socket, they move to the "active list". The program first checks for updated sockets with epoll which results in like 5% of sockets giving a response. It then closes any tasks that have timed out via linked list in O(1) each. The slow part is when it creates new sockets, since it doesn't really know when to stop, besides when the non-blocking socket informs it that it would block. I implemented a time limit on sending that is currently the maximum of the ping timeout. To increase throughput it seems like I need to streamline how I send ICMP packets.

https://github.com/bneils/PingStorm

Hello lemmings, I made a program to ping every IPv4 address and collect data on respondents. I am almost done, but I want feedback on things I should change or how I can improve my current record of 5,000 pings / second.

I am currently aware that I need to properly parse the data I receive on the receive socket, since it's possible the TTL router messages might be confused as replies. ICMP is used on networks to inform other machines of network problems.

One issue I'm aware of is the tuning that has to go into maximizing throughput while also avoiding a total system freeze. My code seems to spend too much time opening sockets that it leaves no room for the actual OS. My only fix currently is limiting the CPU time to the ping timeout I used.

The overall program works like this: It keeps a linked list / pool of task objects. All objects are initially in the "free list" and then when they become associated with a socket, they move to the "active list". The program first checks for updated sockets with epoll which results in like 5% of sockets giving a response. It then closes any tasks that have timed out via linked list in O(1) each. The slow part is when it creates new sockets, since it doesn't really know when to stop, besides when the non-blocking socket informs it that it would block. I implemented a time limit on sending that is currently the maximum of the ping timeout. To increase throughput it seems like I need to streamline how I send ICMP packets.

https://github.com/bneils/PingStorm

Hello lemmings, I made a program to ping every IPv4 address and collect data on respondents. I am almost done, but I want feedback on things I should change or how I can improve my current record of 5,000 pings / second.

I am currently aware that I need to properly parse the data I receive on the receive socket, since it's possible the TTL router messages might be confused as replies. ICMP is used on networks to inform other machines of network problems.

One issue I'm aware of is the tuning that has to go into maximizing throughput while also avoiding a total system freeze. My code seems to spend too much time opening sockets that it leaves no room for the actual OS. My only fix currently is limiting the CPU time to the ping timeout I used.

The overall program works like this: It keeps a linked list / pool of task objects. All objects are initially in the "free list" and then when they become associated with a socket, they move to the "active list". The program first checks for updated sockets with epoll which results in like 5% of sockets giving a response. It then closes any tasks that have timed out via linked list in O(1) each. The slow part is when it creates new sockets, since it doesn't really know when to stop, besides when the non-blocking socket informs it that it would block. I implemented a time limit on sending that is currently the maximum of the ping timeout. To increase throughput it seems like I need to streamline how I send ICMP packets.

https://github.com/bneils/PingStorm