10 ms·

Apple’s iOS 4 hardware encryption has been cracked

73 points by adeelarshad82 15y ago

guan 15y ago
Hopefully Remote Wipe will still work by shedding the keys altogether.
- GiraffeNecktie 15y ago
  Remote wipe wouldn't work if network access was disabled.
  - guan 15y ago
    Of course, I meant, hopefully a successful remote wipe will prevent this method from working. (A number of things could go wrong, including no signal, MobileMe being down, etc.)
sdz 15y ago
So... you can use brute force to break encryption? Is that news? It doesn't sound like there was any security hole in the implementation or a leaked cryptographic key, so in what sense is the encryption "cracked"?
- smackfu 15y ago
  I think it is more that someone is now selling a purpose-built software solution to brute force iPhones, that governments and other interested parties can buy.
pilif 15y ago
The encryption hasn't quite been cracked. This tool is just brute-forcing the passcode, which by default is 4 digits long, so it wouldn't take that long to brute-force that anyways. Also, the tool seems to perform an online attack with the phone connected, which means that Apple will be able to stop this from going on. Seing that only an online attack can be done hints at the fact that the key derivation method that turns the 4 digit passcode into the AES key isn't known (yet). I'd say that you are (still) pretty save if you use the longer password instead of the passcode and as long as the tool requires the phone to be connected, we can count on Apple patching the issue. It's funny how these articles always talk about having "cracked the AES encryption" when all they do is brute-forcing a password.
- ukdm 15y ago
  It's not just the passcode they are recovering. That recovery requires the phone, but there's also the key reocvery and bit-to-bit image copy. The ElcomSoft describes the 3 statges: - Extract hardware-dependent keys, file system keys and escrow keys from the device; - Recover the passcode (subject to passcode length and complexity); - Obtain bit-to-bit copy of device storage.
- seabee 15y ago
  Limiting your keyspace to 10000 combinations is insecure, there's nothing more you need to say really. The difference between the simple passcode and the complex password is the difference between a little padlock and a vault door. It shouldn't be news, except that the fundamentals of encryption aren't well-known by the public.
  - Tyrannosaurs 15y ago
    It doesn't limit it to that, it defaults to that. You can use a longer alphanumeric pass code if you'd rather, it's an option in settings. As with all security convenience is played off against security. For most people (who in reality aren't likely to be targeted by such an attack and aren't storing much in the way of critical data on their phones) a four digit pass doesn't seem completely unreasonable.
    - whakojacko 15y ago
      On top of that, a lot of companies have the requirement that once you hook up your corporate exchange to your iPhone, you have to have a >4 digit password (as in the iPhone forces you to change to a longer password)
      - irons 15y ago
        Exchange can also enforce a shorter time limit before the phone auto-locks. One of the reasons I was glad to dump the Exchange account from my phone when a client project ended.
- 15y ago
hsmyers 15y ago
Seems to me that the maxim 'put nothing on the internet that you don't want exposed' should be applied to cell phones as well. Given the decreasing protection provided by the courts, this sort of tool will be used more and more often. Those who talk of unreasonable search and seizure need to pay attention to today's realities.
- bad_user 15y ago
  put nothing on the internet that you don't want exposed IMHO, it's not the exposure I'm worried about, but the discrimination that follows. Getting drunk at a party and posting pictures on Facebook should not be grounds for you getting rejected at an interview. Also, talking about exposure, companies that found/asked for my social security number or home address, then exposed it on the Internet, should not be surprised when I sue them for huge amounts of money (I'm doing it right now and the only question is how much money I can win).
  - ghshephard 15y ago
    "Getting drunk at a party and posting pictures on Facebook should not be grounds for you getting rejected at an interview." I agree with the OP - If you don't want to be discriminated against, keep it off the internet, or it can be used against you. The only exceptions that I can think of would be those aspects that are considered "protected" - I'm in the rather liberal (but at-will-employment) California, so that includes (at last count, they've probably added more, "age (if over 35), ancestry, color, race, sex (gender), religion, national origin, marital status, physical or mental disability, medical condition, or sexual orientation." - Everything else is fair game. And certainly, drunk pictures of you on facebook would fall within the realm that an employer might reasonably discriminate against you. If you don't want it used against you, don't place it on the internet, despite the level of protection/encryption/privacy policy you think you have protecting you. The elcomsofts of the world are likely to make your private information less so more quickly than you would think.
    - yuhong 15y ago
      On that matter, I had a list of bad practices in HR that cause most of the problems here: http://news.slashdot.org/comments.pl?sid=2082332&cid=35811494 http://news.slashdot.org/comments.pl?sid=2082332&cid=358...
VengefulCynic 15y ago
It would seem that this "crack" could simply be circumvented by using an alphanumeric password and/or setting the iPhone to shred its crypto key after 10 consecutive password failures. Obviously, neither of these are standard features, but both are available.
- rimantas 15y ago
  I guess that by "neither of these are standard features" you mean "not on by default". It's two clicks in settings to turn these on.
  - omh 15y ago
    Or two clicks for your corporate sysadmin to force it :-)
    - Splines 15y ago
      Yay. Exchange policies + toddlers = fun times This is why I don't sync my phone to my work email. It's just not worth it.
- daeken 15y ago
  > setting the iPhone to shred its crypto key after 10 consecutive password failures This seems to do decryption on its own, so this setting wouldn't have an effect. If you have the data sitting there and have the encrypted key, there's nothing stopping you from directly decrypting the key with every possible passcode and checking it for validity.
omh 15y ago
Why does the iPhone talk to anything on the data port without entering the passcode first? It seems like this is reading the encrypted data and then brute forcing it, but there's no need to give access to even the 'secure' data without asking the user to enter the passcode. Then you can check for 10 incorrect codes and wipe the device if necessary. (I believe this is how the Blackberry handles things)
RexRollman 15y ago
I was under the impression that not all user data is encrypted on an iOS 4 device, mainly just the user data of apps from Apple that are included with the device. Does Apple's iOS provide for encryption of all user data? Or is it the case that the app's developer has to avail himself of an API to make this happen?
- r00fus 15y ago
  Correct, although Apple does provide an API to use the hardware encryption. Most apps do NOT use it. If you're paranoid, you can make most data reasonably secure by using the built-in apps and apps like StashPro (which does use the hardware crypto API). This includes putting a decent length password, which is also hard to use. Full-device encryption backed by hardware would be really great. IIRC, that's not possible on either iOS or Android right now (not sure about other platforms).
schmidp 15y ago
Will this also work if one has his iPhone set to delete its crypto keys after 10 failed attempts?
X-Istence 15y ago
I don't think that this is brute-forcing the passcode at all, rather I think it is brute-forcing another method to locking the iPhone, namely that of iTunes... iTunes has a special file on your computer that when you plug in your phone will allow it to start syncing data to and from your phone (including making backups) without requiring you to unlock it. What I believe they are doing is actually brute-forcing the required entry code for that. Once you get that code (and there is no limit to how many times you can try) you get full access to the phone, including that bit-for-bit copy they are talking about. Apparently the key space is small enough that it is easy enough to brute-force. In that case it doesn't matter what kind of protection you use, whether it is the pass code lock, or the alphanumeric that they introduced on the iPhone 4 (IIRC). Note that all of this is speculation, I have no inside knowledge, but that is how I would go about attacking the iPhone.
ritonlajoie 15y ago
Does it mean anything for the Ipad 2 Jailbreak ? I'm confused... It seems the encryption keys are in the chip in these Ipads, so I wonder if this article means that they could get the keys from the hardware ? If so, how is it related to an OS in particular ?

73 points by adeelarshad82 15y ago

guan 15y ago

Hopefully Remote Wipe will still work by shedding the keys altogether.

GiraffeNecktie 15y ago
Remote wipe wouldn't work if network access was disabled.
- guan 15y ago
  Of course, I meant, hopefully a successful remote wipe will prevent this method from working. (A number of things could go wrong, including no signal, MobileMe being down, etc.)

sdz 15y ago

So... you can use brute force to break encryption? Is that news? It doesn't sound like there was any security hole in the implementation or a leaked cryptographic key, so in what sense is the encryption "cracked"?

smackfu 15y ago
I think it is more that someone is now selling a purpose-built software solution to brute force iPhones, that governments and other interested parties can buy.

pilif 15y ago

The encryption hasn't quite been cracked. This tool is just brute-forcing the passcode, which by default is 4 digits long, so it wouldn't take that long to brute-force that anyways. Also, the tool seems to perform an online attack with the phone connected, which means that Apple will be able to stop this from going on. Seing that only an online attack can be done hints at the fact that the key derivation method that turns the 4 digit passcode into the AES key isn't known (yet). I'd say that you are (still) pretty save if you use the longer password instead of the passcode and as long as the tool requires the phone to be connected, we can count on Apple patching the issue. It's funny how these articles always talk about having "cracked the AES encryption" when all they do is brute-forcing a password.

ukdm 15y ago
It's not just the passcode they are recovering. That recovery requires the phone, but there's also the key reocvery and bit-to-bit image copy. The ElcomSoft describes the 3 statges: - Extract hardware-dependent keys, file system keys and escrow keys from the device; - Recover the passcode (subject to passcode length and complexity); - Obtain bit-to-bit copy of device storage.
seabee 15y ago
Limiting your keyspace to 10000 combinations is insecure, there's nothing more you need to say really. The difference between the simple passcode and the complex password is the difference between a little padlock and a vault door. It shouldn't be news, except that the fundamentals of encryption aren't well-known by the public.
- Tyrannosaurs 15y ago
  It doesn't limit it to that, it defaults to that. You can use a longer alphanumeric pass code if you'd rather, it's an option in settings. As with all security convenience is played off against security. For most people (who in reality aren't likely to be targeted by such an attack and aren't storing much in the way of critical data on their phones) a four digit pass doesn't seem completely unreasonable.
  - whakojacko 15y ago
    On top of that, a lot of companies have the requirement that once you hook up your corporate exchange to your iPhone, you have to have a >4 digit password (as in the iPhone forces you to change to a longer password)
    - irons 15y ago
      Exchange can also enforce a shorter time limit before the phone auto-locks. One of the reasons I was glad to dump the Exchange account from my phone when a client project ended.
15y ago

hsmyers 15y ago

Seems to me that the maxim 'put nothing on the internet that you don't want exposed' should be applied to cell phones as well. Given the decreasing protection provided by the courts, this sort of tool will be used more and more often. Those who talk of unreasonable search and seizure need to pay attention to today's realities.

bad_user 15y ago
put nothing on the internet that you don't want exposed IMHO, it's not the exposure I'm worried about, but the discrimination that follows. Getting drunk at a party and posting pictures on Facebook should not be grounds for you getting rejected at an interview. Also, talking about exposure, companies that found/asked for my social security number or home address, then exposed it on the Internet, should not be surprised when I sue them for huge amounts of money (I'm doing it right now and the only question is how much money I can win).
- ghshephard 15y ago
  "Getting drunk at a party and posting pictures on Facebook should not be grounds for you getting rejected at an interview." I agree with the OP - If you don't want to be discriminated against, keep it off the internet, or it can be used against you. The only exceptions that I can think of would be those aspects that are considered "protected" - I'm in the rather liberal (but at-will-employment) California, so that includes (at last count, they've probably added more, "age (if over 35), ancestry, color, race, sex (gender), religion, national origin, marital status, physical or mental disability, medical condition, or sexual orientation." - Everything else is fair game. And certainly, drunk pictures of you on facebook would fall within the realm that an employer might reasonably discriminate against you. If you don't want it used against you, don't place it on the internet, despite the level of protection/encryption/privacy policy you think you have protecting you. The elcomsofts of the world are likely to make your private information less so more quickly than you would think.
  - yuhong 15y ago
    On that matter, I had a list of bad practices in HR that cause most of the problems here: http://news.slashdot.org/comments.pl?sid=2082332&cid=35811494 http://news.slashdot.org/comments.pl?sid=2082332&cid=358...

VengefulCynic 15y ago

It would seem that this "crack" could simply be circumvented by using an alphanumeric password and/or setting the iPhone to shred its crypto key after 10 consecutive password failures. Obviously, neither of these are standard features, but both are available.

rimantas 15y ago
I guess that by "neither of these are standard features" you mean "not on by default". It's two clicks in settings to turn these on.
- omh 15y ago
  Or two clicks for your corporate sysadmin to force it :-)
  - Splines 15y ago
    Yay. Exchange policies + toddlers = fun times This is why I don't sync my phone to my work email. It's just not worth it.
daeken 15y ago
> setting the iPhone to shred its crypto key after 10 consecutive password failures This seems to do decryption on its own, so this setting wouldn't have an effect. If you have the data sitting there and have the encrypted key, there's nothing stopping you from directly decrypting the key with every possible passcode and checking it for validity.

omh 15y ago

Why does the iPhone talk to anything on the data port without entering the passcode first? It seems like this is reading the encrypted data and then brute forcing it, but there's no need to give access to even the 'secure' data without asking the user to enter the passcode. Then you can check for 10 incorrect codes and wipe the device if necessary. (I believe this is how the Blackberry handles things)

RexRollman 15y ago

I was under the impression that not all user data is encrypted on an iOS 4 device, mainly just the user data of apps from Apple that are included with the device. Does Apple's iOS provide for encryption of all user data? Or is it the case that the app's developer has to avail himself of an API to make this happen?

r00fus 15y ago
Correct, although Apple does provide an API to use the hardware encryption. Most apps do NOT use it. If you're paranoid, you can make most data reasonably secure by using the built-in apps and apps like StashPro (which does use the hardware crypto API). This includes putting a decent length password, which is also hard to use. Full-device encryption backed by hardware would be really great. IIRC, that's not possible on either iOS or Android right now (not sure about other platforms).

schmidp 15y ago

Will this also work if one has his iPhone set to delete its crypto keys after 10 failed attempts?

X-Istence 15y ago

I don't think that this is brute-forcing the passcode at all, rather I think it is brute-forcing another method to locking the iPhone, namely that of iTunes... iTunes has a special file on your computer that when you plug in your phone will allow it to start syncing data to and from your phone (including making backups) without requiring you to unlock it. What I believe they are doing is actually brute-forcing the required entry code for that. Once you get that code (and there is no limit to how many times you can try) you get full access to the phone, including that bit-for-bit copy they are talking about. Apparently the key space is small enough that it is easy enough to brute-force. In that case it doesn't matter what kind of protection you use, whether it is the pass code lock, or the alphanumeric that they introduced on the iPhone 4 (IIRC). Note that all of this is speculation, I have no inside knowledge, but that is how I would go about attacking the iPhone.

ritonlajoie 15y ago

Does it mean anything for the Ipad 2 Jailbreak ? I'm confused... It seems the encryption keys are in the chip in these Ipads, so I wonder if this article means that they could get the keys from the hardware ? If so, how is it related to an OS in particular ?