FBI says it's impossible but Cambridge computer security expert proves them wrong.
Passcodes on iPhones can be hacked using store-bought electronic components worth less than $100 (£77), according to one Cambridge computer scientist.

Sergei Skorobogatov has demonstrated that NAND mirroring—the technique dismissed by James Comey, the director of the FBI, as unworkable—is actually a viable means of bypassing passcode entry limits on an Apple iPhone 5C. What's more, the technique, which involves soldering off the phone's flash memory chip, can be used on any model of iPhone up to the iPhone 6 Plus, which use the same type of LGA60 NAND chip. Later models, however, will require "more sophisticated equipment and FPGA test boards."

In a paper he wrote on the subject, Skorobogatov, a Russian senior research associate at the Cambridge Computer Laboratory's security group, confirmed that "any attacker with sufficient technical skills could repeat the experiment," and while the technique he used is quite fiddly, it should not present too much of an obstacle for a well-resourced branch of law enforcement.

The attack works by cloning the iPhone's flash memory chip. iPhones generally allow users six attempts to guess a passcode before locking them out for incrementally longer periods of time; by the complex process of taking the phone apart, removing its memory chip, and then cloning it, an attacker is able to have as many clusters of six tries as they have the patience to make fresh clones. Skorobogatov estimates that each run of six attempts would take about 45 seconds, meaning that it would take around 20 hours to do a full cycle of all 10,000 passcode permutations. For a six-digit passcode, this would grow to about three months—which he says might still be acceptable for national security.

He demonstrated the fruits of his labour in a YouTube video, which clearly shows him making more than the regulation number of passcode entries by switching a fresh, identical chip into a physical port he'd attached to the phone he was attacking. "Because I can create as many clones as I want, I can repeat the process many many times until the passcode is found," he explained in the video.

https://youtu.be/tM66GWrwbsY

Apple doesn't readily release the part numbers or wiring diagrams for the chips and circuits inside each iPhone, but the information is easy to find online (see the recent iPhone 7 teardown). This information can be used to cleanly open the handset up and identify the location of the flash memory chip on its main board. And while NAND flash memory manufacturers have so far managed to prevent the release of any documentation on how they actually work, it's possible to eavesdrop on their protocols and commands with an oscilloscope or a logic analyser.

NAND memory is usually preferred to NOR memory on small devices due to its higher density and faster data-transfer rate, though it can only withstand tens of thousands of rewrites rather than hundreds of thousands for NOR, which complicates the hacking process.

Despite the strength of the solder and epoxy which affixes the memory to the board, it proved relatively easy to separate the phone's NAND chip, provided a certain amount of care was taken. From there, Skorobogatov attached an external connector for fresh chips, forcing him to painstakingly rewire the board to get the balance of voltages right once the components were in a different configuration. He then listened to the way the memory chip communicated with the rest of the device and spoofed the commands on a PC, "to support reading, erasing, and rewriting of the flash memory in a separate setup controlled... via a serial port."
With this basis and a little refinement, it is possible for a determined hacker to use the technique to brute-force the re-engineered iPhone's passcode, giving full access without the possibility of overwriting the memory too much and changing vital information within.

According to Skorobogatov, "the process does not require any expensive and sophisticated equipment."

By using the described and successful hardware mirroring process it was possible to bypass the limit on passcode retry attempts. This is the first public demonstration of the working prototype and the real hardware mirroring process for iPhone 5C. Although the process can be improved, it is still a successful proof-of-concept project.
Knowledge of the possibility of mirroring will definitely help in designing systems with better protection. Also some reliability issues related to the NAND memory allocation in iPhone 5C are revealed.

The demonstration should also please the FBI, which earlier this year tried and failed to persuade Apple to build backdoors for law enforcement into future versions of iOS, following a deadly shooting in San Bernardino, California, last December. The FBI had wanted to access a phone taken from one of the killers, which was protected by a passcode; in March, Director Comey insisted that NAND mirroring "doesn't work."
Eventually, the FBI paid a reported $1.3 million (£1 million) to a private security contractor to get into the phone—itself an iPhone 5C.

iPhone models since the release of iPhone 6 Plus come with upgraded NAND memory chips, which Skorobogatov told Ars would require "an advanced team of researchers" to properly analyse.

We don't know for sure if this attack will work for iPhone 7 therefore we're going to investigate this. However, due to more advanced NAND m-PCIe interface being used starting from iPhone 6S, more sophisticated equipment will be required to decode the protocol and talk to NAND.
In order to analyse iPhone 7 for any threats an advanced team of researchers will be necessary, this of course requires substantial funding.

Meanwhile, he said, "iPads use very similar hardware, hence models which are based on A6 SoC or previous generations should be possible to attack," though "newer versions will require further testing."

And because Android phones are "normally based on standard NAND products, reading them and cloning should be easier because standard off-the-shelf programmes can be used." However, he added that it "all depends on particular implementations," as "NAND mirroring can be defeated." He included suggestions on how to defeat NAND mirroring in his paper.