iPhone encryption can be cracked in under two minutes

#1 Digix on 24 Jul 2009 - 14:24

yep well i think it would be fair to say apples choices have left them in same basket of mistakes sony chose to take with psp and this is the end result.

#2 neufuse on 24 Jul 2009 - 14:29

Discussion on this already going on here -> http://www.neowin.net/forum/index.php?show...#entry591322768

#3 sphbecker on 24 Jul 2009 - 14:53

Where there any details released? Or was that an unsubstantiated claim?

(6 replies) #4 roadwarrior on 24 Jul 2009 - 14:59

The iPhone is not, nor has it ever been, marketed for high security corporate use. Why would people be expecting it to be employing that level of security?

#4.1 neufuse on 24 Jul 2009 - 15:01

companies seemed to think since the US Military has an interest in them all the sudden they must be secure

#4.2 RealFduch on 24 Jul 2009 - 15:07

roadwarrior said,

The iPhone is not, nor has it ever been, marketed for high security corporate use. Why would people be expecting it to be employing that level of security?

Hahaha! Wow! haven't you read your Almighty's own website?
http://images.apple.com/iphone/business/do...ty_Overview.pdf
First paragraph:

iPhone can securely access corporate services and protect data on the device. It provides strong encryption for data in transmission, proven authentication methods for access to corporate services, and for iPhone 3GS, hardware encryption for all data stored on the device. iPhone also provides secure protection through the use of passcode policies that can be enforced and delivered over-the-air. And if the device falls into the wrong hands, users and IT administrators can initiate a remote wipe command to help ensure that
private information is erased.

Stop lying please.

#4.3 dagamer34 on 24 Jul 2009 - 15:28

Even the jailbreak itself is a security breach since it bypasses Apple's walled garden given anyone full access to the firmware below for easy modifications. You could easily install a keylogger of some sort, and boom passwords galore.

The real problem is not that Apple is advertising a false sense of security with the iPhone 3GS, but any IT person worth their salt should have already realized the jailbreaking is a MASSIVE breach of security and wouldn't bother with the iPhone for sensitive personnel/information anyway.

#4.4 roadwarrior on 24 Jul 2009 - 17:24

RealFduch said,

Hahaha! Wow! haven't you read your Almighty's own website?

Stop lying please.

Stop with the arrogance. I had not read that and I stand corrected. The fact remains that this supposed crack has not been substantiated.

FYI, I own a BlackBerry, my wife owns a 3G iPhone. We have two computers in the house, neither of which is an Apple, although I do have OS X installed on the main system (dual boot with Vista) for a few apps that aren't available on Windows.

#4.5 leojei on 24 Jul 2009 - 22:13

roadwarrior said,

Stop with the arrogance. I had not read that and I stand corrected. The fact remains that this supposed crack has not been substantiated.

FYI, I own a BlackBerry, my wife owns a 3G iPhone. We have two computers in the house, neither of which is an Apple, although I do have OS X installed on the main system (dual boot with Vista) for a few apps that aren't available on Windows.

Your come back isn't really related to what he said...

#4.6 roadwarrior on 26 Jul 2009 - 23:04

leojei said,

Your come back isn't really related to what he said...

How is it not? I admitted that I had not read the web page on Apple's site, and I shot down his claim that Apple was my "Almighty", since I only have two Apple products in my house, along with several non-Apple ones. My wife's iPhone isn't a 3GS so hers doesn't have the hardware based encryption that the article is referring to.

(2 replies) #5 jpcahn on 24 Jul 2009 - 15:03

Nerds may be boring but at least they take security seriously. The hippies at Apple would rather spend their time making the interface look good then making it secure!

#5.1 Jugalator on 24 Jul 2009 - 18:53

Right on!

#5.2 hotdog963al on 25 Jul 2009 - 01:56

I'd prefer that, myself.

(1 reply) #6 ahhell on 24 Jul 2009 - 15:48

Apple FAIL

#6.1 hotdog963al on 25 Jul 2009 - 01:57

Great Comment

(3 replies) #7 bigfootabercrombie on 24 Jul 2009 - 16:03

Where is the proof? How do we know this is true?
"a well known hacker is claiming that the phones encryption can be cracked in less than two minutes."
Claiming? I could claim that the moon is made of cheese, but just because I put it on the internet that doesn't make it true...

I have never had a problem with my iPhone and therefore remain unconvinced.

#7.1 bob_c_b on 24 Jul 2009 - 16:16

bigfootabercrombie said,

Where is the proof? How do we know this is true?
"a well known hacker is claiming that the phones encryption can be cracked in less than two minutes."
Claiming? I could claim that the moon is made of cheese, but just because I put it on the internet that doesn't make it true...

I have never had a problem with my iPhone and therefore remain unconvinced.

1. thank you, if he can prove his claim then we can wring our hands in worry.
2. it's really only an issue if Apple does nothing about it.

#7.2 +macf13nd on 24 Jul 2009 - 18:13

Well I don't think he needs to 'prove' how to jailbreak and ssh an iPhone, does he?

~iPhone user

#7.3 leojei on 24 Jul 2009 - 22:14

I don't really think any consumer would need to worry? It's a corporate thing afterall.

#8 Nexus- on 24 Jul 2009 - 16:37

It never was ready for the business world. No editing of office documents and no multi-tasking. Engadget recently did an article about how lame this is for business. Just because you support exchange doesnt make you a winner.

(4 replies) #9 +Ricardo Gil on 24 Jul 2009 - 16:37

So? It's a cellphone.

#9.1 kazuyette on 24 Jul 2009 - 16:40

So ? It's an unsecure cellphone.

#9.2 +Ricardo Gil on 24 Jul 2009 - 17:31

kazuyette said,

So ? It's an unsecure cellphone.

And? Do you store company trade secrets in your phone? Cellphones aren't secure devices, they never were.

#9.3 +Frazell Thomas on 24 Jul 2009 - 18:21

Ricardo Gil said,

And? Do you store company trade secrets in your phone? Cellphones aren't secure devices, they never were.

Maybe to you it is just a cell phone and doesn't have confidential data on it, but the reality for businesses is they do need that security.

The executives at large companies and the high ranking politicians in this country, like President Obama, conduct discussions via email on their phones regularly. That means if someone stole the physical phone from these people they would have access to trade secrets, or in the case of the President possibly more, and that stuff needs to be securely wiped.

The fact that the iPhone's encryption can be bypassed so easily means it can't be used in these high security contexts, AKA business + government.

For Joe Consumer, like you, it doesn't make a difference. Your texts about being drunk or nude pics of yourself aren't important enough

#9.4 leojei on 24 Jul 2009 - 22:16

Frazell Thomas said,

For Joe Consumer, like you, it doesn't make a difference. Your texts about being drunk or nude pics of yourself aren't important enough

totally agree. A stolen business could access many trade secrets (first and foremost - emails), so security means a whole lot to corporates.

#10 +Chrono951 on 24 Jul 2009 - 17:11

This is just another reason why the iPhone will not take any ground in the corporate arena.

(2 replies) #11 antareus on 24 Jul 2009 - 17:18

From the neowin thread up top, it appears you need to first jailbreak the phone, then dump the phone's memory to access the encrypted data. If physical access is indeed required, then that makes this much less of an issue.

It should still be fixed, mind you.

#11.1 +Ricardo Gil on 24 Jul 2009 - 17:30

Don't you have to restore the firmware in order to jailbreak it thereby erasing everything? Or has it changed with the current methods?

#11.2 roadwarrior on 24 Jul 2009 - 17:45

Yes you do. This security expert is doing nothing but trying to promote his law enforcement forensic utilities.

#12 craybox on 24 Jul 2009 - 17:26

do we know if the actual data is encrypted ? were they able to de unencrypt the files once they had them

(2 replies) #13 Magallanes on 24 Jul 2009 - 17:28

which encryption?.

The encryption to the communication in between layers of the device, or the encryption used to communicate with the world? (bluetooth, 3g and such)

#13.1 Jugalator on 24 Jul 2009 - 18:54

Few seem to care, or even if there's any substance to this claim.

#13.2 leojei on 24 Jul 2009 - 22:16

let's not getting into details before the actual details of the hack surfaces.

#14 pc_tool on 24 Jul 2009 - 17:28

Is there anything analogous to jail breaking any other phones?

#15 roadwarrior on 24 Jul 2009 - 17:43

He has updated with videos of him supposedly demonstrating this, but all it shows is him encrypting the iPhone, then restoring the iPhone, taking a picture, then accessing that picture. I fail to see how this is bypassing the security.

(2 replies) #16 Joshie on 24 Jul 2009 - 19:02

So will this get a security fix?

*gets slapped by Apple PR* "That's security ENHANCEMENT!"

#16.1 Wanderermy on 24 Jul 2009 - 19:52

Joshie said,

So will this get a security fix?

*gets slapped by Apple PR* "That's security ENHANCEMENT!"

For only $9.99!

#16.2 darkpuma on 26 Jul 2009 - 02:29

Wanderermy said,

Joshie said,

So will this get a security fix?

*gets slapped by Apple PR* "That's security ENHANCEMENT!"

For only $9.99!

Best comment so far. A+!
But move the decimal place over 1, and you'll be more accurate, considering that we're talking about an apple product...

(1 reply) #17 powerade01 on 24 Jul 2009 - 19:10

This is what happens when you become the second (or third) most popular mobile OS.

(Symbian is first mobile OS BTW and it cannot be compromised unless the application is signed and you, the user, agree to install the application that breaches security. Note the words I use.)

#17.1 leojei on 24 Jul 2009 - 22:18

Correct me if I'm mistaken, but I think there's also jail-breaking for Symbian... no?

(1 reply) #18 M_Lyons10 on 24 Jul 2009 - 21:52

Ouch. If this is true, this is really going to hurt Apple. The comment that it's the worst implementation of security he'd ever seen is definitely gotta hurt... :|

I wonder if this is really true though...

#18.1 hotdog963al on 25 Jul 2009 - 01:57

I doubt it will, to be honest.

#19 leojei on 24 Jul 2009 - 22:18

I don't think it really matters how worst the implementation is. It's just difference between secure, and insecure. Corporates tend not to look at how insecure since they know they won't use it.

(2 replies) #20 Shadrack on 24 Jul 2009 - 22:49

I do not understand the complexity of encryption but I pretty much threw this article in the FUD bin when I read that there needs to be physical access to the phone. iPhone data can be nuked remotely if stolen. You can also set it up to self-nuke if the user enters the wrong pass code so many times.

#20.1 wakers01 on 25 Jul 2009 - 05:10

I'm thinking if he's figured out how to hack the phone in 2 minutes, he's not brute forcing the password, so the self nuke is a non-issue for him. Then, supposing he got in, he drops the phones data/cell connection and, BAM, no more remote nuke either. Now your data = pwnd.

#20.2 roadwarrior on 26 Jul 2009 - 23:20

There is also a self-nuke that can be configured for a certain number of failed passcode attempts. In the video, it appears that he is running some type of law enforcement forensic software, along with apparently doing a restore on the iPhone.

Neowin.net