Exploits, Tools & Data Recovery · Passcode Bypass & the Unlocking Industry · Lesson 4 of 5

How Phones Fight Back

See the hardware, timers and theft features that keep locked phones locked.

Hardware that won't hurry

The earlier modules followed people looking for a way past the lock screen. This one is about the other side: what phone makers build to make that hard, and why it keeps getting harder.

The core idea is the same on both platforms. The check that decides whether your passcode is right, and how fast someone may keep guessing, runs on hardware kept apart from the main operating system. If an attacker takes over the main system, that hardware still says no.

On iPhone, that's the Secure Enclave you met in iOS Internals. It mixes your passcode with a secret built into the chip, so guesses must happen on that one phone. It enforces the delays, starting at 1 minute after the 4th wrong try and rising to 8 hours by the 9th. Apple's Platform Security guide also describes a Secure Storage Component on newer devices, a separate tamper-resistant part that keeps track of failed attempts so the count can't simply be wiped.

On Android, the lock screen check runs inside a Trusted Execution Environment (TEE), an isolated area of the main processor, which also slows down repeated wrong guesses. Many phones add a separate security chip. Google's Pixel 6 and later use the Titan M2 chip, which acts as the phone's StrongBox, the tamper-resistant key safe you met in Android App Security. Google says Titan M2 helps protect the lock screen passcode against guessing.

Why does this matter so much? A 6-digit passcode has only a million combinations. Without enforced limits, a machine could try them all quickly. With them, an attacker gets nowhere near a million tries. A longer passcode, or one with letters, raises the bar much further.

This is why brute force comes up so often in the leaked support charts. A tool that can guess quickly on a modern phone usually relies on a flaw that sidesteps these limits on particular models and versions. Once the phone maker fixes the flaw, guessing slows back down to the hardware's pace.

Locks for a locked phone

Hardware limits on guessing are the foundation. On top of them, both platforms now add protections aimed at the moment a phone is taken.

On iPhone, you met three of them in iOS Internals. USB Restricted Mode means a locked iPhone won't talk to a new accessory or computer over its port, so a tool can't simply be plugged in. The inactivity reboot, which researchers found in iOS 18.1, restarts an iPhone that hasn't been unlocked for about three days, putting it back in BFU, where nearly all data is sealed. Magnet's own Graykey page advertises features that help "safeguard" extractions from automatic reboot timers, a sign the reboot matters to tool makers. Stolen Device Protection stops a thief who learned your passcode from quickly changing your account or turning off Find My.

On Android, Google announced a set of theft protection features in 2024, many delivered through Google Play services to phones running Android 10 or later. You turn them on in Settings, under Google, then Theft protection:

• Theft Detection Lock uses an on-device model to spot a grab-and-run motion and locks the screen.
• Offline Device Lock locks the screen if the phone is kept offline for a long time, so a thief can't simply cut it off from Find My Device.
• Remote Lock lets you lock your phone from any browser using its phone number.
• Identity Check asks for your fingerprint or face before sensitive changes when you're away from trusted places, much like Stolen Device Protection.

Android 16 also brought an optional Advanced Protection mode. Google and press coverage describe it as including a restart after three days locked and limiting new USB connections to charging while locked. Availability varies by phone.

The most important protection, though, is the plain one: updates. Every commercial unlocking capability depends on bugs, and updates fix bugs. The leaked charts you read about showed the newest software as the hardest target.