4 ms·

"On devices running iOS 8, your personal data such as photos, messages (including attachments), email, contacts, call history, iTunes content, notes, and remind

"On devices running iOS 8, your personal data such as photos, messages (including attachments), email, contacts, call history, iTunes content, notes, and reminders is placed under the protection of your passcode. Unlike our competitors, Apple cannot bypass your passcode and therefore cannot access this data. So it's not technically feasible for us to respond to government warrants for the extraction of this data from devices in their possession running iOS 8." But law enforcement can still brute force the encrypted image right?

TTPrograms 12y ago
I was also under the impression that some of the Snowden slides contradict this point.
yzzxy 12y ago
From a Feb. 2014 Apple Security whitepaper[0]: "The passcode is “tangled” with the device’s UID, so brute-force attempts must be per-formed on the device under attack. A large iteration count is used to make each attempt slower. The iteration count is calibrated so that one attempt takes approximately 80 milliseconds. This means it would take more than 5½ years to try all combinations of a six-character alphanumeric passcode with lowercase letters and numbers." There's more info on the file encryption in the paper, around page 8. [0] http://www.apple.com/ipad/business/docs/iOS_Security_Feb14.pdf http://www.apple.com/ipad/business/docs/iOS_Security_Feb14.p...
- readerrrr 12y ago
  How were the iCloud accounts then attacked if they didn't have physical access to the device? The passcode is “tangled” with the device’s UID, so brute-force attempts must be per-formed on the device under attack Even with the password you need the device, which they didn't.
  - yzzxy 12y ago
    I think the "Cloud" may have been involved.
  - penprog 12y ago
    I think a lot of it was social engineering and bad passwords. If you are using multiple services and one is compromised you can pretty much give up access to everything if you use the same password all around.
  - cpr 12y ago
    Guesses based on known properties of the (well-known, high-exposure) targets.
  - tedunangst 12y ago
    iCloud backups aren't encrypted with the same key as on device storage.
  - gress 12y ago
    Social engineering was used to get the answers to the users security questions.
  - dmishe 12y ago
    You can restore from iCloud backup to any device (which is presumably how elcomsoft software works). The only thing that you need original device for is the keychain, but I am not sure if this has changed since keychain in the cloud
- BCM43 12y ago
  That's assuming you can't clone it, and try on 1000 devices at the same time, correct?
- blake8086 12y ago
  Isn't that 5.5 years of sequential trying? This is a parallelizable problem. There's also no restriction on how fast a cracking machine is allowed to be, so I doubt 80ms is the lower limit.
  - xenadu02 12y ago
    Did you not RTFA? The file system keys are stored in the SoC secure storage area and there are no facilities for retrieving them, meaning you must perform the decryption attempts with the phone's own SoC. Of course an iCloud backup file is another matter... At least they are turning on two factor auth for that, but it's a difficult problem if someone has your password and the keys are on a phone that you no longer have.

TTPrograms 12y ago

I was also under the impression that some of the Snowden slides contradict this point.

yzzxy 12y ago

From a Feb. 2014 Apple Security whitepaper[0]: "The passcode is “tangled” with the device’s UID, so brute-force attempts must be per-formed on the device under attack. A large iteration count is used to make each attempt slower. The iteration count is calibrated so that one attempt takes approximately 80 milliseconds. This means it would take more than 5½ years to try all combinations of a six-character alphanumeric passcode with lowercase letters and numbers." There's more info on the file encryption in the paper, around page 8. [0] http://www.apple.com/ipad/business/docs/iOS_Security_Feb14.pdf http://www.apple.com/ipad/business/docs/iOS_Security_Feb14.p...

readerrrr 12y ago
How were the iCloud accounts then attacked if they didn't have physical access to the device? The passcode is “tangled” with the device’s UID, so brute-force attempts must be per-formed on the device under attack Even with the password you need the device, which they didn't.
- yzzxy 12y ago
  I think the "Cloud" may have been involved.
- penprog 12y ago
  I think a lot of it was social engineering and bad passwords. If you are using multiple services and one is compromised you can pretty much give up access to everything if you use the same password all around.
- cpr 12y ago
  Guesses based on known properties of the (well-known, high-exposure) targets.
- tedunangst 12y ago
  iCloud backups aren't encrypted with the same key as on device storage.
- gress 12y ago
  Social engineering was used to get the answers to the users security questions.
- dmishe 12y ago
  You can restore from iCloud backup to any device (which is presumably how elcomsoft software works). The only thing that you need original device for is the keychain, but I am not sure if this has changed since keychain in the cloud
BCM43 12y ago
That's assuming you can't clone it, and try on 1000 devices at the same time, correct?
blake8086 12y ago
Isn't that 5.5 years of sequential trying? This is a parallelizable problem. There's also no restriction on how fast a cracking machine is allowed to be, so I doubt 80ms is the lower limit.
- xenadu02 12y ago
  Did you not RTFA? The file system keys are stored in the SoC secure storage area and there are no facilities for retrieving them, meaning you must perform the decryption attempts with the phone's own SoC. Of course an iCloud backup file is another matter... At least they are turning on two factor auth for that, but it's a difficult problem if someone has your password and the keys are on a phone that you no longer have.