Although the students could not see the key’s digits, they guessed at them by a repetitive process of changing a digit or a letter in the key and sending it back to the target phone.
That sounds like a timing attack against the iMessage servers, probably also involving the unpatched client.
That sounds like a timing attack against the iMessage servers, probably also involving the unpatched client.