4 ms·

And don't forget Apple can decrypt iPhones at the request of law enforcement: http://news.cnet.com/8301-13578_3-57583843-38/apple-deluged-by-police-demands-to-d

And don't forget Apple can decrypt iPhones at the request of law enforcement: http://news.cnet.com/8301-13578_3-57583843-38/apple-deluged-by-police-demands-to-decrypt-iphones/ http://news.cnet.com/8301-13578_3-57583843-38/apple-deluged-...

nwh 13y ago
They can sign their own alternate ramdisks, and the default PIN is only 4 digits, so that's not surprising really. It's been possible to load similar forensic software on A4 devices by anybody for years now.
- quackerhacker 13y ago
  I hope for security sake, the users on here do not use 4 digit pins...or at least have the wipe feature enabled after x failed attempts.
  - nwh 13y ago
    The wipe after 10 attempts is moot anyway, we are talking about Apple loading new software into a ramdisk and brute forcing it. I've personally done this at an owners request.
    - rdl 13y ago
      Presumably not on a post-iPad2/iPhone4S, or without access to a previously-paired computer, right?
      - nwh 13y ago
        A normal user could do it on any device with the A4 chip or prior, vulnerable to the limera1n exploit. Apple could do it with any device, as they own the signing keys for the bootloader. There's even pre-built forensic ramdisks if you'd like to have a play around — https://code.google.com/p/iphone-dataprotection/ https://code.google.com/p/iphone-dataprotection/ I'm willing to bet that there's at least one private bootrom exploit, one of the jailbreak developers has hinted that he has found one.
  - smackfu 13y ago
    It's generally a requirement for most corporate profiles to use a alphanumeric pin. It's also pretty much considered the most annoying thing about those corporate profiles.
rdl 13y ago
We don't really know if they're brute forcing (which I can do) or if they have some secret backdoor. There are good arguments either way.
- WA 13y ago
  I worked as an IT security consultant before and one of my co-workers had the task of brute-forcing the encryption. Conclusion was that with a newer generation (was it the iPad 3 or iPhone 4S? I don't remember exactly), brute-forcing was very infeasible. It took forever. My bet is on the back door.
  - tlrobinson 13y ago
    How is locking/encryption actually implemented on the iPhone? If you use a 4 digit pin that seems incredibly easy to brute force, unless perhaps the actual encryption key is protected in hardware (and the "wipe after 10 failed attempts" policy is also enforced in hardware)
    - WA 13y ago
      To be honest, I don't remember exactly. I just talked to my colleague for a couple minutes and watched him using his brute forcer and I remember his conclusion that the old iPad could be easily brute forced, but the new one couldn't. Either because the iPad would be wiped after 10 attempts or because the hardware would allow re-entering a PIN only every few seconds. I remember that it was incredibly slow. Sorry ;(
      - rdl 13y ago
        iOS 3 was "instant bypass". iOS 4/5 on everything up to the iPad 2/iPhone 4S was still device-bound, at 4-10 tries/second, but the backoff and wipe logic could be bypassed. There are no public ways to extract from the newest devices on ios 5 or 6, except for a few corner-case bugs (which were limited, and patched). Plenty once you jailbreak the phone, or compromise a paired device. I believe the best practice among public attacks is to do that. There are probably various exploits in iOS itself which let you root phones remotely. Beyond that, either secret attacks or hardware attacks, or figuring out how to get the phone to boot from one ramdisk while talking to the security element from before (which is trivial if you can sign stuff as Apple, and may actually be possible otherwise.)

nwh 13y ago

They can sign their own alternate ramdisks, and the default PIN is only 4 digits, so that's not surprising really. It's been possible to load similar forensic software on A4 devices by anybody for years now.

quackerhacker 13y ago
I hope for security sake, the users on here do not use 4 digit pins...or at least have the wipe feature enabled after x failed attempts.
- nwh 13y ago
  The wipe after 10 attempts is moot anyway, we are talking about Apple loading new software into a ramdisk and brute forcing it. I've personally done this at an owners request.
  - rdl 13y ago
    Presumably not on a post-iPad2/iPhone4S, or without access to a previously-paired computer, right?
    - nwh 13y ago
      A normal user could do it on any device with the A4 chip or prior, vulnerable to the limera1n exploit. Apple could do it with any device, as they own the signing keys for the bootloader. There's even pre-built forensic ramdisks if you'd like to have a play around — https://code.google.com/p/iphone-dataprotection/ https://code.google.com/p/iphone-dataprotection/ I'm willing to bet that there's at least one private bootrom exploit, one of the jailbreak developers has hinted that he has found one.
- smackfu 13y ago
  It's generally a requirement for most corporate profiles to use a alphanumeric pin. It's also pretty much considered the most annoying thing about those corporate profiles.

rdl 13y ago

We don't really know if they're brute forcing (which I can do) or if they have some secret backdoor. There are good arguments either way.

WA 13y ago
I worked as an IT security consultant before and one of my co-workers had the task of brute-forcing the encryption. Conclusion was that with a newer generation (was it the iPad 3 or iPhone 4S? I don't remember exactly), brute-forcing was very infeasible. It took forever. My bet is on the back door.
- tlrobinson 13y ago
  How is locking/encryption actually implemented on the iPhone? If you use a 4 digit pin that seems incredibly easy to brute force, unless perhaps the actual encryption key is protected in hardware (and the "wipe after 10 failed attempts" policy is also enforced in hardware)
  - WA 13y ago
    To be honest, I don't remember exactly. I just talked to my colleague for a couple minutes and watched him using his brute forcer and I remember his conclusion that the old iPad could be easily brute forced, but the new one couldn't. Either because the iPad would be wiped after 10 attempts or because the hardware would allow re-entering a PIN only every few seconds. I remember that it was incredibly slow. Sorry ;(
    - rdl 13y ago
      iOS 3 was "instant bypass". iOS 4/5 on everything up to the iPad 2/iPhone 4S was still device-bound, at 4-10 tries/second, but the backoff and wipe logic could be bypassed. There are no public ways to extract from the newest devices on ios 5 or 6, except for a few corner-case bugs (which were limited, and patched). Plenty once you jailbreak the phone, or compromise a paired device. I believe the best practice among public attacks is to do that. There are probably various exploits in iOS itself which let you root phones remotely. Beyond that, either secret attacks or hardware attacks, or figuring out how to get the phone to boot from one ramdisk while talking to the security element from before (which is trivial if you can sign stuff as Apple, and may actually be possible otherwise.)