Thieves are stealing iPhone pin codes | GrapheneOS settings and protections

published 2023-03-13 · updated 2023-03-13 #privacy #security #grapheneos #apple
The Wall Street Journal recently reported on a trend of iPhone pin codes being stolen.

Transcript

Please excuse any grammatical errors. I used a tool to generate the transcript and haven't had a chance to read through it yet. ✔️

The other day, someone sent me this video from The Wall Street Journal. It was a good video, so if you have some time, you might enjoy watching it. The video covered a situation that's occurring where someone will be at a bar. An individual or a group of individuals will either observe or befriend a Target to determine what their pin code is as they enter it into their device. As it's normal for someone to enter their pin code multiple times while they are out for the evening, they have various chances to figure out what it is.

Once they figure out what the PIN code is, they either swipe the iPhone when the suspect is distracted or they forcefully take it. Now, what happens after that is quick and calculated. The thieves using the PIN code are able to change the victim's password associated with their Apple ID, thus locking them out of their account and rendering finding my iPhone unusable. Once that step is completed, the thieves start draining any Financial accounts on the user's device that uses the PIN code to authenticate. In addition, if the victim uses the iCloud keychain chain, the PIN code can also be used to gain access to that which would then allow them access to any accounts stored in there.

The video goes over in more detail, and if anyone you care about uses an iPhone, consider sending them the video to make them aware of the situation so they can be more cautious. I will also link a post below that has some advice for iPhone owners on steps they can take to protect themselves.

In today's video, I wanted to cover some settings and suggestions you can implement on graphene OS to help with these kinds of attacks. While it's not the exact same scenario, I do think these are useful options. So, the example scenario is that you have a Google pixel running graphene OS, and either you or you and your friends decided to go out and grab a bite to eat or some drinks at a local bar.

The first suggestion I want to make for this type of scenario is to use biometric authentication, which is a fancy way of saying to use your fingerprint. To access that setting, you can go into Settings > Security > Fingerprint unlock. Enter your passcode and you can then set up a new fingerprint to authenticate with. I know some people don't like the idea of using biometric authentication, but the main advantage that using your fingerprint has for authentication is that you can't shoulder surf a fingerprint. Someone can't observe you and gain access to your fingerprint. So in a social setting where others might see you enter a PIN code on your device, using your fingerprint can avoid this altogether.

Graphene OS also has a quick option to disable the fingerprint reader. So let's say you're going through TSA at the airport or a police officer pulls you over, you can press and hold down the power button and then select "Lockdown." At this point, biometric authentication is disabled and you need to enter your PIN code to access your device. If you aren't comfortable using biometric authentication, another useful feature is pin scrambling. To access that, go into Settings > Security > Pin scrambling. Go ahead and enable that. What that does is, on your lock screen, the PIN code will be scrambled every time you go to enter it. This means that someone observing you can't determine your PIN code based on the physical location of your finger on the screen when entering your PIN code. And while it's not guaranteed that they can't determine what your PIN code is, it will make it much more difficult and hopefully deter them enough that they pick an easier target.

And while we are on the topic of PIN codes, the longer the PIN code, the better. It's going to be much more difficult to determine a 10-digit PIN code compared to a four-digit PIN code. My next suggestion is to use a separate user profile with a different PIN code from your main owner profile, specifically for situations where you're in a public setting with a large amount of individuals around who could watch you enter your PIN code into your device.

To do that, we're going to go into Settings > System > Multiple users > Enable "Allow multiple users" > Add user > Set a name for your new user profile. For this example, on this restricted user profile, I'm going to leave phone calls and SMS disabled, but as far as apps go, I do think it would be helpful to have NewPipe installed in case I need to look up a video to show someone. Other than that, I won't install any other apps. The "Install available apps" feature is a convenient feature to install apps on separate user profiles so that you don't need to install a separate App Store on the other user profile.

Separate user profiles are a great way to keep your sensitive apps like banking apps separate from a profile you'll be using in a public setting. So now that we have our new user profile created, you can switch to that by either tapping "Switch to" and your profile name or you can swipe down, pull down again, tap the user icon in the bottom right, and then select your new user profile.

So you won't be able to see it in the screen recording because it stopped recording when I switched, but all I did was go through the initial profile setup and set a different pin code for my main owner profile. So now here we are in the new user profile. If we swipe up, we can see NewPipe was installed, but Signal was not installed. So now at this point, we have a separate user profile created with a different pin code from our main owner profile that we can use in public settings so that in a worst-case scenario, if someone does get our pin code, they won't have access to our main owner profile with our sensitive data.

I also want to note that every user profile has separate settings, so you will need to enable pin scrambling on this new user profile we just created. The last setting I want to talk about is auto reboot, and this setting is only accessible from the main owner profile. So make sure you switch back to that user profile. To access that, go into Settings > Security > Auto reboot. I like the 12 hours option. What this setting does is it will reboot the phone if there hasn't been any successful unlock within the timeframe selected. This puts the device fully at rest in a pre-first unlock state, which is the most secure state for your data.

The reason this is useful for us is if we're logged into that separate user profile, worst-case scenario someone finds out our pin code, they swipe our device, they now have access to that restricted user profile. Once there is no successful authentication within 12 hours, the device will reboot itself. And now at that point, they need to enter the main owner pin code, which is required to unlock any separate user profiles. The entire device is now inaccessible to them since they don't know the main owner PIN code, and therefore they cannot access that separate user profile we created. For all intents and purposes, your device is a brick to them.

Probably the best protection, at least in the United States, is the fact that you are using an Android device. Most thieves target Apple devices because they have a great resale value and just how connected they are to everything else on the device. So an Android device being less premium is a solid defense.

Those are the ideas that I came up with. If you have any other suggestions, feel free to leave those down below in the comments. And if you enjoyed this video, I think you'll like the top one shown here, and the bottom one has been selected for you based on your viewing habits.