GrayKey public disclosure

Mr. David Miles,

This is addressed to you and any other people interested in keeping GrayKey product secure and not available to the wide public.

We are a "business group" looking forward to bring into your attention the fact that we HAVE obtained the source code for your product GrayKey and would appreciate any donation above 2 BTC sent to 1Cg61mVzMCvs2ZP148VeoBnQnv8rHxAZES if you consider that keeping this information secure is crucial.

Below BTC address will be monitored in the next 7 days waiting for any given donations. After the countdown ends, security on the available source code cannot be anymore assured by our group. You cannot contact us in any other form, rather than donation. Once donation is received, we'll contact you david@grayshift.com with further details.

Any other wild bidders are welcomed to join the donation race to 1BqFDiNKjAKBopdr37Mw7vM2oG8pgWvzNL if you want full information to be publicly released.

And yeah...just to make things clear from the beginning, let us state we're talking real deal. Take a quick peek at some juicy stuff extracts we have and think if they ring the bell.

[....]--->
<script>
    var lastApplogicVersion = null;
    var sawDataCopyComplete = false;
    var seenFirstPoll = false;
    var pollInterval = null;
    var settingsObj = {
        "ALPHANUMERIC_DICTIONARY": {
            "info": {
                "help": "To brute force a complex alphanumeric passcode, upload a custom password dictionary.  If a dictionary is not uploaded, GrayKey will not attempt to brute force custom alphanumeric passcodes. The format of the dictionary is a plaintext file with one word per line.",
                "name": "Custom alphanumeric dictionary",
                "type": "FILE"
            },
            "value": "File \u0027passcode.txt\u0027, 10.0B"
        },
        "AUTOMATIC_DATA_DOWNLOAD": {
            "info": {
                "help": "If disabled, data extraction must be manually initiated from the GrayKey UI.",
                "name": "Automatically perform data extraction",
                "type": "BOOL"
            },
            "value": true
        },
        "COLLECT_ROOTFS": {
            "info": {
                "help": "Collect the read-only system partition during data extraction. The system partition can be collected, but under normal circumstances is not able to be modified by the device user.",
                "name": "Collect system partition",
                "type": "BOOL"
            },
            "value": true
        },
        "DISABLE_SESHAT": {
            "info": {
                "help": "Persistently disable future enrollment in SE-bound passcodes on the device after initial access.",
                "name": "Disable SE-bound passcode enrollment",
                "type": "BOOL"
            },
            "value": true
        },
        "DOWNLOAD_INACCESSIBLE_METADATA": {
            "info": {
                "help": "If an immediate extraction of accessible data is occurring, collect metadata for inaccessible files. The inaccessible files will appear empty, but the metadata will be accurate. This can occur in two instances - (1) SE-Bound and Before First Unlock or (2) \"Automatically perform data extraction\" is disabled and user has initiated an extraction before passcode discovery.",
                "name": "Extract metadata for inaccessible files",
                "type": "BOOL"
            },
            "value": true
        },
        "DOWNLOAD_PROCMEM": {
            "info": {
                "help": "Enabling this setting will extract memory from all running processes after initial access.",
                "name": "Extract process memory After First Unlock",
                "type": "BOOL"
            },
            "value": true
        },
        "INITIAL_DOWNLOAD_SESHAT": {
            "info": {
                "help": "Perform immediate extraction of all accessible data when the device has an SE-bound passcode and is in the Before First Unlock state. This may be desired because bruteforce could take a very long time.",
                "name": "Immediate extraction when SE-bound passcode Before First Unlock",
                "type": "BOOL"
            },
            "value": true
        },
        "STORE_STATE_NVRAM": {
            "info": {
                "help": "If checked, the agent will save bruteforce state in NVRAM every 6 hours. If device power is lost, when the agent is re-installed it will restart the passcode bruteforce at the last saved state. Once the agent is uninstalled (manually or automatically), the state will be removed from NVRAM. Writing to NVRAM has no effect on the device filesystem.",
                "name": "Save bruteforce state in NVRAM",
                "type": "BOOL"
            },
            "value": true
        }
    };

    String.prototype.toReadableSize = function() {
        var sz_num = parseInt(this, 10); // don't forget the second param
        if (sz_num < 1024)
            return sz_num;
        else if (sz_num < 1024 * 1024)
            return Math.floor(sz_num / 1024) + "KB";
        else if (sz_num < 1024 * 1024 * 1024)
            return Math.floor(sz_num / (1024 * 1024)) + "MB";

        var gb = sz_num / (1024 * 1024 * 1024);
        return gb.toFixed(2) + "GB";
    }

    String.prototype.toHHMMSS = function() {
        var sec_num = parseInt(this, 10); // don't forget the second param
        var hours = Math.floor(sec_num / 3600);
        var minutes = Math.floor((sec_num - (hours * 3600)) / 60);
        var seconds = sec_num - (hours * 3600) - (minutes * 60);

        if (hours < 10) {
            hours = "0" + hours;
        }
        if (minutes < 10) {
            minutes = "0" + minutes;
        }
        if (seconds < 10) {
            seconds = "0" + seconds;
        }
        return hours + ':' + minutes + ':' + seconds;
    }

    function pollExploitStatus() {
        $.getJSON('/exploitStatus', function(data) {
                    var keepPolling = true;
                    if (data) {
                        console.log(data);

                        if ('version' in data && data['version'] != lastApplogicVersion) {
                            if (lastApplogicVersion == null) {
                                lastApplogicVersion = data['version'];
                            } else {
                                // applogic has been updated
                                window.location.reload(true);
                                return;
                            }
                        }
                        if ('nresults' in data && data["nresults"] > 0) {
                            $("#hasResults .btn").text(data["nresults"] + " stored results");
                            $("#hasResults").show()
                        } else {
                            $("#hasResults").hide()
                        }
                        $("#dataDownloadReady").hide();

                        showAttachedDeviceInfo(data);

                        var exploit_phase = data['phase'];

<---[......]

------>[......]
        function showDownloadingUI(status, title) {
            if (!status.downloadState) {
                return;
                /* no download state? abort */
            }
            /* calculate the download percent */
            var percent = (status.downloadState.downloaded / status.downloadState.size) * 100;
            if (percent < 0) {
                percent = 0;
            }
            if (percent > 100) {
                percent = 100;
            }
            /* make the stat message */
            var percentStr = percent.toFixed() + "%";
            var statMsg = title + " " + status.downloadState.version + ":"
                /* update the elements */
            $('#auxHeaderMessageContainer').removeClass('hidden');
            $('#auxProgress').addClass('progress-bar-success');
            $('#auxProgress').removeClass('active');
            $('#auxProgress').css('width', percentStr).attr('aria-valuenow', percent);
            $('#auxProgressMessage').html(statMsg);
            // ensure the iframe is visible
            $('#applogicFrame').removeClass('hidden');
        }

        function showWaitingUI(status, title) {
            // show the aux message container
            $('#auxHeaderMessageContainer').removeClass('hidden');
            // set the progress bar to 100% gray and active
            $('#auxProgress').removeClass('progress-bar-success');
            $('#auxProgress').addClass('active');
            $('#auxProgress').css('width', '100%').attr('aria-valuenow', 100);
            // display the message
            var statMsg = title + " " + status.downloadState.version + " install pending:"
            $('#auxProgressMessage').html(statMsg);
            // ensure the iframe is visible
            $('#applogicFrame').removeClass('hidden');
        }
<------[.....]