Grayshift

Grayshift is an American mobile device forensics company which makes a device named GrayKey to crack iPhones, iPads, and Android devices. In 2023, it merged with the Canadian firm Magnet Forensics.

Grayshift was co-founded by David Miles, Braden Thomas, Justin Fisher and Sean Larsson. The company is funded by private investors PeakEquity Partners and C&B Capital. As of 2023, it was majority controlled by investment firm Thoma Bravo.

Grayshift was founded in 2016, and as of 2018 was a privately held company based in Atlanta, Georgia, with less than 50 employees. In 2017, rumors started to circulate that it had created a device able to unlock iPhones, following the Apple–FBI encryption dispute where US law enforcement agencies unsuccessfully tried to compel Apple to write software that would enable the government bypass these devices' security and unlock the phones.

The GrayKey product has been used by the FBI and U.S., British and Canadian local police forces. In 2022, the company stated that GrayKey was being used "by thousands of law enforcement and government defense agencies across 30 countries worldwide, including France, United Kingdom, Germany, Sweden, Spain, and Italy".

According to media reports, GrayKey costs US$15,000 to US$30,000 per copy depending on the functional options chosen. As of 2018, the device consisted of a gray box, 4 inches by 4 inches by 2 inches in size, with two Lightning cables. In 2022, photos of the "GrayKey 2.0" device were revealed in an FCC filing.

The GrayKey reportedly provides support for iPhones running iOS 9 and later. Around 2019, Apple modified iOS so that external device connections must be authorized by the iPhone owner after it has been unlocked. On newer iPhone models, only unencrypted files and some metadata might be extracted. With earlier models, full data extraction, such as decrypting encrypted files, is possible. As of 2021, GrayKey was able to perform successful brute-force attack against iOS devices in some situations, with Grayshift being "constantly in a cat-and-mouse game with Apple", which continually works to fix the security exploits used by GrayKey. In 2022, Motherboard concluded that "while it’s unclear exactly how it achieves it, GrayKey bruteforces the iPhone or Android phone’s passcode and unlocks it—essentially hacking the phone—allowing customers to access and extract data from the phones."

In 2018, hackers obtained the GrayKey source code, and attempted to extort a payment of 2 bitcoins from Grayshift after leaking "small chunks of code".

GrayKey with Android support was released in early 2021. According to a March 2024 announcement, Graykey has "full support" for iOS 17 devices, Samsung's Galaxy S24 smartphones, and Google's Pixel 6 and Pixel 7 devices.

In 2023, it was announced that Grayshift would merge with the Canadian firm Magnet Forensics, following the latter's acquisition for $1.35 billion by investment firm Thoma Bravo, which also owned the majority of Grayshift at the time. The merger was completed later the same year.