The IP Box costs less than £200 and can guess all possible four-digit passwords in 111 hours.
The device bypasses the secure wipe triggered by ten bad guesses by "aggressively cutting the power after each failed PIN attempt, but before the attempt has been synchronized to flash memory."
Further research suggests this could be the issue detailed in CVE-2014-4451 but this has yet to be confirmed. We plan to test the same attack on an 8.2 device and will update with our progress. In the mean time, our advice to all is ensure you have a sufficiently complex password applied to your device rather than a PIN.
Apple iOS Hardware Assisted Screenlock Bruteforce [Mdsec]
(via JWZ)
