5 ms·

iOS security is trivial to break if you have physical access to the device. TouchID (and passcodes) should be considered little more than a convenience, not a s

by s_q_b 13y ago

iOS security is trivial to break if you have physical access to the device. TouchID (and passcodes) should be considered little more than a convenience, not a serious security measure.

lawnchair_larry 13y ago
Really, how do you trivially break a passcode on an iOS device? There is a way that I know about, and it is very much non-trivial.
- s_q_b 13y ago
  Just use brute force or dictionary attack over the wire. Given that most users use 4-digit pass codes, this can be done usually in minutes, almost always in less than an hour. Or, if your target is paranoid and uses a very long passcode, target the charger rather than the device itself. iOS assumes any physical device to which it is connected when unlocked is secure. Replace the usb brick with a small computer (e.g. Raspberry Pi) in a convincing looking Apple-esque case. Then wait until your target plugs in his iDevice and unlocks it. You can then dump the drive, or side load malicious code.
  - czhiddy 13y ago
    > Just use brute force or dictionary attack over the wire. Given that most users use 4-digit pass codes, this can be done usually in minutes, almost always in less than an hour. It's clear you've never actually attempted this. The timeout between passcode entries increases with the number of consecutive failures. Get 10 wrong in a row, and the device is wiped (if the user has chosen that option). > Or, if your target is paranoid and uses a very long passcode, target the charger rather than the device itself. iOS assumes any physical device to which it is connected when unlocked is secure. Replace the usb brick with a small computer (e.g. Raspberry Pi) in a convincing looking Apple-esque case. Then wait until your target plugs in his iDevice and unlocks it. You can then dump the drive, or side load malicious code. This no longer works on iOS 7. The user has to manually choose to trust the computer they're attached to prior to any communication going across the wire.
    - s_q_b 13y ago
      I'll ignore the needless snark. > The timeout between passcode entries increases with the number of consecutive failures. Get 10 wrong in a row, and the device is wiped (if the user has chosen that option). Only if you're typing in pass codes to the lock screen, which isn't how its done. An attacker would instead image the flash, grab the Dkey from effaceable storage, and decrypt the filesystem. Indeed this is exactly how professional iOS forensic analysis kits work. This will get you access to SMS, photos, and anything else that doesn't fall under Data Protection. Data Protection, a second level of encryption that uses your passcode to generate keys, is only used on the keychain block and emails by default. To crack Data Protection, use brute force on the copied data, not on the iDevice itself. >This no longer works on iOS 7. The user has to manually choose to trust the computer they're attached to prior to any communication going across the wire. Cool, I didn't know that. EDIT: Here's a good overview: http://mobappsectriathlon.blogspot.com/2012/09/how-do-you-protect-your-users-sensitive.html http://mobappsectriathlon.blogspot.com/2012/09/how-do-you-pr...
      - lawnchair_larry 13y ago
        "Only if you're typing in pass codes to the lock screen, which isn't how its done. An attacker would instead image the flash, grab the Dkey from effaceable storage, and decrypt the filesystem. Indeed this is exactly how professional iOS forensic analysis kits work. This will get you access to SMS, photos, and anything else that doesn't fall under Data Protection." Yep, as I suspected, you haven't done this ;) Please don't discuss how "simple" it is if you're getting your info from third parties. You can't image the flash. None of this works how you think it does, because the forensics toolkits left out a crucial detail in their marketing. The dirty secret? You need a 0day bootrom exploit. The professional kits use the limera1n exploit, which was patched years ago.
        s_q_b 13y ago
        I didn't say "simple." I said "trivial" :) Nope, I've never done this live. For this I'm reliant upon what I've read. Feel free to tell me what's wrong. Stating how it works, or pointing the way to an accurate source, is infinitely more helpful than saying "you're wrong", even if it might feel satisfying. Here's my understanding of how the initial loading works. BootROM uses a series of RSA validity checks on the chain of software components to load the RAMdisk (which is used for update in DFU mode.) To load your own RAMdisk, you need an exploit in bootROM (which are the same exploits used for jailbreaking, and thus of high value for the community to discover.)
  - jdthomas 13y ago
    On iOS 7 you have to explicitly trust a computer from the device before data is allowed over USB; before that it is in a charge only mode. To trust a computer you must unlock the device.
  - lawnchair_larry 13y ago
    Which "wire" allows you to brute force the passcode? Have you tried this, or are you repeating claims of others? Because I have a feeling that doesn't work like you think it does. Your latter attack is an entirely different threat model, and can't be used on a stolen device.
  - andreyf 13y ago
    > iOS assumes any physical device to which it is connected when unlocked is secure I thought this was fixed in iOS7?

by s_q_b 13y ago

iOS security is trivial to break if you have physical access to the device. TouchID (and passcodes) should be considered little more than a convenience, not a serious security measure.

lawnchair_larry 13y ago

Really, how do you trivially break a passcode on an iOS device? There is a way that I know about, and it is very much non-trivial.

s_q_b 13y ago
Just use brute force or dictionary attack over the wire. Given that most users use 4-digit pass codes, this can be done usually in minutes, almost always in less than an hour. Or, if your target is paranoid and uses a very long passcode, target the charger rather than the device itself. iOS assumes any physical device to which it is connected when unlocked is secure. Replace the usb brick with a small computer (e.g. Raspberry Pi) in a convincing looking Apple-esque case. Then wait until your target plugs in his iDevice and unlocks it. You can then dump the drive, or side load malicious code.
- czhiddy 13y ago
  > Just use brute force or dictionary attack over the wire. Given that most users use 4-digit pass codes, this can be done usually in minutes, almost always in less than an hour. It's clear you've never actually attempted this. The timeout between passcode entries increases with the number of consecutive failures. Get 10 wrong in a row, and the device is wiped (if the user has chosen that option). > Or, if your target is paranoid and uses a very long passcode, target the charger rather than the device itself. iOS assumes any physical device to which it is connected when unlocked is secure. Replace the usb brick with a small computer (e.g. Raspberry Pi) in a convincing looking Apple-esque case. Then wait until your target plugs in his iDevice and unlocks it. You can then dump the drive, or side load malicious code. This no longer works on iOS 7. The user has to manually choose to trust the computer they're attached to prior to any communication going across the wire.
  - s_q_b 13y ago
    I'll ignore the needless snark. > The timeout between passcode entries increases with the number of consecutive failures. Get 10 wrong in a row, and the device is wiped (if the user has chosen that option). Only if you're typing in pass codes to the lock screen, which isn't how its done. An attacker would instead image the flash, grab the Dkey from effaceable storage, and decrypt the filesystem. Indeed this is exactly how professional iOS forensic analysis kits work. This will get you access to SMS, photos, and anything else that doesn't fall under Data Protection. Data Protection, a second level of encryption that uses your passcode to generate keys, is only used on the keychain block and emails by default. To crack Data Protection, use brute force on the copied data, not on the iDevice itself. >This no longer works on iOS 7. The user has to manually choose to trust the computer they're attached to prior to any communication going across the wire. Cool, I didn't know that. EDIT: Here's a good overview: http://mobappsectriathlon.blogspot.com/2012/09/how-do-you-protect-your-users-sensitive.html http://mobappsectriathlon.blogspot.com/2012/09/how-do-you-pr...
    - lawnchair_larry 13y ago
      "Only if you're typing in pass codes to the lock screen, which isn't how its done. An attacker would instead image the flash, grab the Dkey from effaceable storage, and decrypt the filesystem. Indeed this is exactly how professional iOS forensic analysis kits work. This will get you access to SMS, photos, and anything else that doesn't fall under Data Protection." Yep, as I suspected, you haven't done this ;) Please don't discuss how "simple" it is if you're getting your info from third parties. You can't image the flash. None of this works how you think it does, because the forensics toolkits left out a crucial detail in their marketing. The dirty secret? You need a 0day bootrom exploit. The professional kits use the limera1n exploit, which was patched years ago.
      - s_q_b 13y ago
        I didn't say "simple." I said "trivial" :) Nope, I've never done this live. For this I'm reliant upon what I've read. Feel free to tell me what's wrong. Stating how it works, or pointing the way to an accurate source, is infinitely more helpful than saying "you're wrong", even if it might feel satisfying. Here's my understanding of how the initial loading works. BootROM uses a series of RSA validity checks on the chain of software components to load the RAMdisk (which is used for update in DFU mode.) To load your own RAMdisk, you need an exploit in bootROM (which are the same exploits used for jailbreaking, and thus of high value for the community to discover.)
- jdthomas 13y ago
  On iOS 7 you have to explicitly trust a computer from the device before data is allowed over USB; before that it is in a charge only mode. To trust a computer you must unlock the device.
- lawnchair_larry 13y ago
  Which "wire" allows you to brute force the passcode? Have you tried this, or are you repeating claims of others? Because I have a feeling that doesn't work like you think it does. Your latter attack is an entirely different threat model, and can't be used on a stolen device.
- andreyf 13y ago
  > iOS assumes any physical device to which it is connected when unlocked is secure I thought this was fixed in iOS7?