10 ms·

iOS 10: Security Weakness Discovered, Backup Passwords Much Easier to Break

220 points by cpach 10y ago

0x0 10y ago
Why would apple implement a new weaker scheme in parallel to the existing old? Are the designers of the otherwise so secure enclave blundering? Or is this done on purpose?! (Hard to believe they would believe they would get away with it, so... amateur hour accident?) Is this Apple's Bitlocker Elephant Diffuser? Can I have some extrabacon with that?!
- pervycreeper 10y ago
  I think your second explanation goes a long way to explaining the whole San Bernadino iPhone 5c dog-and-pony-show that Apple put on early this year.
- bsamuels 10y ago
  yes, the company that went out of their way to fab their own soc JUST for encryption/improving device security purposefully degraded their password backup scheme to allow the government to break into their devices i dont even like apple but come on, the hyperbole can only go so far
  - JohnStrange 10y ago
    You do know that it was possible to get the FileVault password for other users with a simple grep command up until OS X 10.7, don't you?
    - tptacek 10y ago
      You do know that if you can run commands on someone's machine, FileVault has already failed to protect them, right?
- jonathanstrange 10y ago
  Probably just a secret deal with the DHS. Don't worry about it.
robmcm 10y ago
Humm, a skeptical view of this would suggest deliberate weakening of security. Perhaps not a full back door, but more of an open upstairs window?
- sosborn 10y ago
  Why does everything have to be a conspiracy?
  - croon 10y ago
    Because people have faith in other people not being complete dullards.
    - kalleboo 10y ago
      That doesn't work either because Apple would have to be complete dullards to not realize that someone would found this obvious flaw within a week of the release of the OS. Especially right after launching a bug bounty.
  - robmcm 10y ago
    perhaps because the old API is still there? This appears to be a new less secure duplicate, with seemingly no benefit. Also Apple took a lot of heat from the FBI case, perhaps this was part of the deal for them to drop the suit, which isn't a blatant back door. The proof will be in their response to the issue.
- shabbyrobe 10y ago
  iOS 10 has felt pretty buggy to me. Lots of little glitches here and there. We are still trying to get some hard data on a sneaky problem with random dropouts when using BLE beacons. I'd say this is more likely to be more of the same than a conspiracy.
  - eklavya 10y ago
    You could say that it's not as common a problem and could be missed. But what do you say when the push notification is not working well with the new hotness and there is no fix. You need to uninstall, restart, install until the next update of your app is released and then you have to repeat that. https://forums.developer.apple.com/thread/49512 https://forums.developer.apple.com/thread/49512
tetrep 10y ago
Some technical detail would be nice. At the moment, this is just an advertisement for their iPhone backup cracking software.
- mkagenius 10y ago
  yup, literally anyone could claim that.. bad article
  - huhtenberg 10y ago
    Elcomsoft is hardly "anyone" when it comes to this particular subject matter. You may want to look them up.
    - jjnoakes 10y ago
      That sounds close to an appeal to authority.
      - spdustin 10y ago
        It's not the logical fallacy you think it is when there's an actual authority involved.
        jjnoakes 10y ago
        Appeal to authority requires an actual authority to be involved.
        spdustin 10y ago
        And it's not a fallacy > An argument from authority (Latin: argumentum ad verecundiam), also called an appeal to authority, is a common type of argument which can be fallacious, such as when an authority is cited on a topic outside their area of expertise or when the authority cited is not a true expert. https://en.m.wikipedia.org/wiki/Argument_from_authority https://en.m.wikipedia.org/wiki/Argument_from_authority Calling it a fallacy when there's an actual authority is the part that's incorrect. It's no longer a fallacy when the appeal to authority (argument from authority) involves an actual authority.
acqq 10y ago
Until it get fixed (if), everybody who does the local backup and worries about its possible bruteforcing should 1. wipe his previous ios10 backups 2. if the backup password is not significantly long, increase the length of his backup password with some random enough material. And, of course, never forget that "$5 wrench" comics. I still hope Apple will publicly respond on this. It simply doesn't fit with the other steps they did at least starting with iPhone 5s.
- pfg 10y ago
  The article seems to suggest that an attacker would be able to perform a (new) backup without unlocking the phone if they had access to a "pairing record from a trusted computer", which I assume means an iTunes installation that's paired with the phone. In other words, you might have to unpair the phone (or protect the iTunes installation with FDE) in addition to deleting any backups.
camillomiller 10y ago
Ok, ELI5 for me please: how using a SHA256 function unsalted with 1 iteration - as suggested by Per Torsheim - would influence the fact that you can try more passwords per second? Isn't that a flaw of whatever kind of software password-trial limit more than a flaw of the algo used by iOS to encrypt the backup?
- acqq 10y ago
  Because the SHA-generated value is available to any program which can employ all the cores of the CPU and all the cores of the GPU to try the generated passwords in parallel, and one try is very, very cheap for SHA, compared to the "serious" algorithms, plus, anybody can buy special SHA breaking devices which are built all the time. For example, this device, which was priced just 1300 USD tries https://www.bitmaintech.com/productDetail.htm?pid=00020160912073506474G9tUPWlH069D https://www.bitmaintech.com/productDetail.htm?pid=0002016091... 11.85T hashes per second, that's 1 with 13 zeroes per second and that shows what today is possible to achieve so cheap. Elcomsoft's software for previous, non-weak algorithm, managed to try 150000 passwords per second using the GPU, that is, this weakening is like giving an attacker some tens of thousands of computers for free, or tens of millions of computers for $1000.
  - camillomiller 10y ago
    Geez... Thanks
  - ikeboy 10y ago
    AFAIK bitcoin miners can't be used to crack hashes. See https://security.stackexchange.com/questions/62800/is-it-possible-to-use-bitcoin-miners-to-decrypt-files-communication https://security.stackexchange.com/questions/62800/is-it-pos..., https://rya.nc/asic-cracking.html https://rya.nc/asic-cracking.html
    - acqq 10y ago
      If the hash is SHA256 they can, read your links.
kondro 10y ago
Meh, my iTunes backups are stored encrypted at rest.
- scott_karana 10y ago
  Do you mean FDE? Because an unprivileged account compromise could still get access to your backups in that case. GPG or TrueCrypt-like would be the way to go there.
pearjuice 10y ago
And this is something visible on the surface. Imagine what else they added. Or removed. This is exactly why you shouldn't trust proprietary software. https://www.gnu.org/philosophy/free-software-even-more-important.en.html https://www.gnu.org/philosophy/free-software-even-more-impor...
- yoz-y 10y ago
  I think that history has proven that being open source does not render you immune from bugs and security holes.
  - pearjuice 10y ago
    https://www.gnu.org/philosophy/free-software-for-freedom.html https://www.gnu.org/philosophy/free-software-for-freedom.htm...
    - yoz-y 10y ago
      My bad, I should have said that "I think that history has proven that being open source or free software does not render you immune from bugs and security holes." Free software is not some magical silver bullet that makes your software impervious to bugs or mishandling.
coldcode 10y ago
Clearly they will tell Apple before publishing on their website. Then again they sell cracking software for money. iTunes is done by a different team than the OS. At one point at least much of the iTunes web side was handled by remote contractors, not sure of the app itself. Given that Apple is releasing 4 new OSs every year its not surprising something gets screwed up. It will be fixed within a week I bet.
- joshstrange 10y ago
  It will be interesting to see how they fix it, I'd guess it would have to be an iTunes and iOS fix because if it's only iTunes there is nothing stopping me from using an older version of iTunes to get a backup. You would need an iOS bump to force the user to upgrade to the newer iTunes before it would allow it backup.
camillomiller 10y ago
Ok, I got it clearer: somebody at Apple fucked up and left a weak SHA256 Hash and salt inside a db table that shouldn't be there. Probably used in testing for the betas, then nobody remembered to comment it away before the public release. Some engineer and somebody in QA will get their ass kicked pretty badly. Next iOS public release will solve it, everybody's gonna be happy. Nothing to see here folks, we can move on :)
- 0x0 10y ago
  That sounds maybe plausible, although what could they have possibly been debugging that required a weaker hash? Of course, with the paranoid hat on, if your task was to subvert the mechanism, this is probably exactly how you'd go about it - make it seem like an accident. Just like gotofail :)
  - camillomiller 10y ago
    Yeah, and hide it in plain sight. Plausible, yes. Although goto fail; had another vibe to it. It was really strangely placed and hardly explainable. Plus it made possible to perform some pretty nasty MiTM attacks over a network. Here you have a method that security experts tinkering with the betas knew of since probably last July. Everybody expected Apple to fix it in the GM, but it didn't happen. Now the cat's out of the bag with some deservedly good (and harmless) publicity for Elcomsoft and it's gonna be fixed in no time. If we even want to give credit to the malicious actor hypothesis, what's the benefit for them? Accessing iOS 10 beta backups more easily for three months? Nah, I don't see that, not this time.
    - jobu 10y ago
      > Although goto fail; had another vibe to it. It was really strangely placed and hardly explainable. Plus it made possible to perform some pretty nasty MiTM attacks over a network. The goto fail looked very much like a bad code merge. (I actually had a similar issue with a duplicated line when merging changes two days ago.) It's impossible to know without reviewing their full source control history, but it seemed like a plausible mistake to me.
blinkingled 10y ago
Reality continues to ruin Apple's marketing ;) Given the other crap[1], relatively speaking they still shine though - at least a patch will be out soon to everyone that turns on their device. [1] FCC should really look into making security updates for mobile devices mandatory with a time limit, in absence of which OEM or the Carrier must replace the device free of charge with one that doesn't have the vulnerability. It's criminal what OEMs and carriers are getting away with while making ton of profits.
djrogers 10y ago
The link makes it entirely unclear how this relates to decrypting the keychain. Yes, this makes it much easier to get access to the keychain, but isn't it also encrypted?

220 points by cpach 10y ago

0x0 10y ago

Why would apple implement a new weaker scheme in parallel to the existing old? Are the designers of the otherwise so secure enclave blundering? Or is this done on purpose?! (Hard to believe they would believe they would get away with it, so... amateur hour accident?) Is this Apple's Bitlocker Elephant Diffuser? Can I have some extrabacon with that?!

pervycreeper 10y ago
I think your second explanation goes a long way to explaining the whole San Bernadino iPhone 5c dog-and-pony-show that Apple put on early this year.
bsamuels 10y ago
yes, the company that went out of their way to fab their own soc JUST for encryption/improving device security purposefully degraded their password backup scheme to allow the government to break into their devices i dont even like apple but come on, the hyperbole can only go so far
- JohnStrange 10y ago
  You do know that it was possible to get the FileVault password for other users with a simple grep command up until OS X 10.7, don't you?
  - tptacek 10y ago
    You do know that if you can run commands on someone's machine, FileVault has already failed to protect them, right?
jonathanstrange 10y ago
Probably just a secret deal with the DHS. Don't worry about it.

robmcm 10y ago

Humm, a skeptical view of this would suggest deliberate weakening of security. Perhaps not a full back door, but more of an open upstairs window?

sosborn 10y ago
Why does everything have to be a conspiracy?
- croon 10y ago
  Because people have faith in other people not being complete dullards.
  - kalleboo 10y ago
    That doesn't work either because Apple would have to be complete dullards to not realize that someone would found this obvious flaw within a week of the release of the OS. Especially right after launching a bug bounty.
- robmcm 10y ago
  perhaps because the old API is still there? This appears to be a new less secure duplicate, with seemingly no benefit. Also Apple took a lot of heat from the FBI case, perhaps this was part of the deal for them to drop the suit, which isn't a blatant back door. The proof will be in their response to the issue.
shabbyrobe 10y ago
iOS 10 has felt pretty buggy to me. Lots of little glitches here and there. We are still trying to get some hard data on a sneaky problem with random dropouts when using BLE beacons. I'd say this is more likely to be more of the same than a conspiracy.
- eklavya 10y ago
  You could say that it's not as common a problem and could be missed. But what do you say when the push notification is not working well with the new hotness and there is no fix. You need to uninstall, restart, install until the next update of your app is released and then you have to repeat that. https://forums.developer.apple.com/thread/49512 https://forums.developer.apple.com/thread/49512

tetrep 10y ago

Some technical detail would be nice. At the moment, this is just an advertisement for their iPhone backup cracking software.

mkagenius 10y ago
yup, literally anyone could claim that.. bad article
- huhtenberg 10y ago
  Elcomsoft is hardly "anyone" when it comes to this particular subject matter. You may want to look them up.
  - jjnoakes 10y ago
    That sounds close to an appeal to authority.
    - spdustin 10y ago
      It's not the logical fallacy you think it is when there's an actual authority involved.
      - jjnoakes 10y ago
        Appeal to authority requires an actual authority to be involved.
        spdustin 10y ago
        And it's not a fallacy > An argument from authority (Latin: argumentum ad verecundiam), also called an appeal to authority, is a common type of argument which can be fallacious, such as when an authority is cited on a topic outside their area of expertise or when the authority cited is not a true expert. https://en.m.wikipedia.org/wiki/Argument_from_authority https://en.m.wikipedia.org/wiki/Argument_from_authority Calling it a fallacy when there's an actual authority is the part that's incorrect. It's no longer a fallacy when the appeal to authority (argument from authority) involves an actual authority.

acqq 10y ago

Until it get fixed (if), everybody who does the local backup and worries about its possible bruteforcing should 1. wipe his previous ios10 backups 2. if the backup password is not significantly long, increase the length of his backup password with some random enough material. And, of course, never forget that "$5 wrench" comics. I still hope Apple will publicly respond on this. It simply doesn't fit with the other steps they did at least starting with iPhone 5s.

pfg 10y ago
The article seems to suggest that an attacker would be able to perform a (new) backup without unlocking the phone if they had access to a "pairing record from a trusted computer", which I assume means an iTunes installation that's paired with the phone. In other words, you might have to unpair the phone (or protect the iTunes installation with FDE) in addition to deleting any backups.

camillomiller 10y ago

Ok, ELI5 for me please: how using a SHA256 function unsalted with 1 iteration - as suggested by Per Torsheim - would influence the fact that you can try more passwords per second? Isn't that a flaw of whatever kind of software password-trial limit more than a flaw of the algo used by iOS to encrypt the backup?

acqq 10y ago
Because the SHA-generated value is available to any program which can employ all the cores of the CPU and all the cores of the GPU to try the generated passwords in parallel, and one try is very, very cheap for SHA, compared to the "serious" algorithms, plus, anybody can buy special SHA breaking devices which are built all the time. For example, this device, which was priced just 1300 USD tries https://www.bitmaintech.com/productDetail.htm?pid=00020160912073506474G9tUPWlH069D https://www.bitmaintech.com/productDetail.htm?pid=0002016091... 11.85T hashes per second, that's 1 with 13 zeroes per second and that shows what today is possible to achieve so cheap. Elcomsoft's software for previous, non-weak algorithm, managed to try 150000 passwords per second using the GPU, that is, this weakening is like giving an attacker some tens of thousands of computers for free, or tens of millions of computers for $1000.
- camillomiller 10y ago
  Geez... Thanks
- ikeboy 10y ago
  AFAIK bitcoin miners can't be used to crack hashes. See https://security.stackexchange.com/questions/62800/is-it-possible-to-use-bitcoin-miners-to-decrypt-files-communication https://security.stackexchange.com/questions/62800/is-it-pos..., https://rya.nc/asic-cracking.html https://rya.nc/asic-cracking.html
  - acqq 10y ago
    If the hash is SHA256 they can, read your links.

kondro 10y ago

Meh, my iTunes backups are stored encrypted at rest.

scott_karana 10y ago
Do you mean FDE? Because an unprivileged account compromise could still get access to your backups in that case. GPG or TrueCrypt-like would be the way to go there.

pearjuice 10y ago

And this is something visible on the surface. Imagine what else they added. Or removed. This is exactly why you shouldn't trust proprietary software. https://www.gnu.org/philosophy/free-software-even-more-important.en.html https://www.gnu.org/philosophy/free-software-even-more-impor...

yoz-y 10y ago
I think that history has proven that being open source does not render you immune from bugs and security holes.
- pearjuice 10y ago
  https://www.gnu.org/philosophy/free-software-for-freedom.html https://www.gnu.org/philosophy/free-software-for-freedom.htm...
  - yoz-y 10y ago
    My bad, I should have said that "I think that history has proven that being open source or free software does not render you immune from bugs and security holes." Free software is not some magical silver bullet that makes your software impervious to bugs or mishandling.

coldcode 10y ago

Clearly they will tell Apple before publishing on their website. Then again they sell cracking software for money. iTunes is done by a different team than the OS. At one point at least much of the iTunes web side was handled by remote contractors, not sure of the app itself. Given that Apple is releasing 4 new OSs every year its not surprising something gets screwed up. It will be fixed within a week I bet.

joshstrange 10y ago
It will be interesting to see how they fix it, I'd guess it would have to be an iTunes and iOS fix because if it's only iTunes there is nothing stopping me from using an older version of iTunes to get a backup. You would need an iOS bump to force the user to upgrade to the newer iTunes before it would allow it backup.

camillomiller 10y ago

Ok, I got it clearer: somebody at Apple fucked up and left a weak SHA256 Hash and salt inside a db table that shouldn't be there. Probably used in testing for the betas, then nobody remembered to comment it away before the public release. Some engineer and somebody in QA will get their ass kicked pretty badly. Next iOS public release will solve it, everybody's gonna be happy. Nothing to see here folks, we can move on :)

0x0 10y ago
That sounds maybe plausible, although what could they have possibly been debugging that required a weaker hash? Of course, with the paranoid hat on, if your task was to subvert the mechanism, this is probably exactly how you'd go about it - make it seem like an accident. Just like gotofail :)
- camillomiller 10y ago
  Yeah, and hide it in plain sight. Plausible, yes. Although goto fail; had another vibe to it. It was really strangely placed and hardly explainable. Plus it made possible to perform some pretty nasty MiTM attacks over a network. Here you have a method that security experts tinkering with the betas knew of since probably last July. Everybody expected Apple to fix it in the GM, but it didn't happen. Now the cat's out of the bag with some deservedly good (and harmless) publicity for Elcomsoft and it's gonna be fixed in no time. If we even want to give credit to the malicious actor hypothesis, what's the benefit for them? Accessing iOS 10 beta backups more easily for three months? Nah, I don't see that, not this time.
  - jobu 10y ago
    > Although goto fail; had another vibe to it. It was really strangely placed and hardly explainable. Plus it made possible to perform some pretty nasty MiTM attacks over a network. The goto fail looked very much like a bad code merge. (I actually had a similar issue with a duplicated line when merging changes two days ago.) It's impossible to know without reviewing their full source control history, but it seemed like a plausible mistake to me.

blinkingled 10y ago

Reality continues to ruin Apple's marketing ;) Given the other crap[1], relatively speaking they still shine though - at least a patch will be out soon to everyone that turns on their device. [1] FCC should really look into making security updates for mobile devices mandatory with a time limit, in absence of which OEM or the Carrier must replace the device free of charge with one that doesn't have the vulnerability. It's criminal what OEMs and carriers are getting away with while making ton of profits.

djrogers 10y ago

The link makes it entirely unclear how this relates to decrypting the keychain. Yes, this makes it much easier to get access to the keychain, but isn't it also encrypted?