Slashdot Mirror
iPhone's PIN-Based Security Transparent To Ubuntu
ndogg writes "Security experts found that the iPhone 3GS has very little security, even with a PIN set up. They plugged one into Ubuntu 10.04, and it was automounted with almost all of the iPhone's data exposed. This has been reported to Apple, but the company seems to be having difficulty reproducing the problem."
So the problem is that the memory of the iPhone is mounted and that the data is exposed? I may not understand this exactly but hasn't the argument been for many years now that iPods couldn't be directly mounted like that?
Apparently it's so hard to use that they can't even reproduce it at Apple.
All of its storage is flash memory soldered to the logic board. There is no way to remove the storage.
From TFA Apple could reproduce the described serious issue and believes to understand why this can happen but cannot provide timing or further details on the release of a fix.
I am Slashdot. Are you Slashdot as well?
Bernd Marienfeldt updated his blog saying Apple is now able to reproduce the problem and believes they know the cause, but no timing on fix release.
It is a security problem with Ubuntu and should be fixed by their dev team before they are sued for hacking. Afterall, the iPhone was not meant to be connected to anything other than Apple software.
You two have fun with that.
Will their fix consist of actually making the device more secure or will they just try to make it harder use it with Linux systems?
That joke is getting a bit old, with Apple selling 4-button mice with every iMac for 5 years now.
Would doing that wipe the flash?
It will if you use the Apple-standard soldering iron. Anything else is unsupported.
But that's exactly how Apple is advertising the 3GS: http://www.apple.com/iphone/business/integration/#securing
The GSM standard defines a PIN as an access number for your SIM card. It has nothing to do with your phone's contents. Most phones allow you to set up a security key, which is needed either to turn on the phone every time (even if you have your SIM set up not to need a PIN), or when you change the SIM.
I don't know if this is actually the same PIN defined by the GSM standard or if it's another, Apple-specific key; but when you're talking about phones, PIN is connected to the SIM, or to the phone line, not to the phone contents.
I plugged my iPhone 3GS into my Ubuntu box. While it's true that Ubuntu did automount the iPhone, the only thing I can find that was exposed was my music, photos and podcasts.
I wasn't able to access email, contact info, or anything else on the phone. I did see the Application Archives, PublicStaging, Purchases, and Safari folders but they're empty. I have lots of email and contact info on the device - but it appears to be inaccessible via this method.
From Apple:
Apple iPhone Security Overview [1]:
Data Protection:
Protecting data stored on iPhone is important for any environment with a high level of sensitive corporate or customer information. In addition to encrypting data in trans-mission, iPhone 3GS provides hardware encryption for data stored on the device.
Encryption:
iPhone 3GS offers hardware-based encryption. iPhone 3GS hardware encryption uses AES 256 bit encoding to protect all data on the device. Encryption is always enabled, and cannot be disabled by users.
I think that this is just ridiculous and just more evidence that Linux users are nothing but criminals and thieves and open source should just be outlawed. It is this "free" software that engenders this attitude of laissez-faire we can do whatever we like without paying for anything that is the direct cause of security breaches such as this with the iPhone. The fact that open sores can continue to exist despite the hundreds of intellectual thefts in the form of Microsoft's patents, Fraunhofer Institutes patents with the mp3 players, Unix copyright thefts.
Don't you freetards get it? If you want something, you have to pay for it. And 100 dollars for something as great as an OS isn't that much. Look at the great things Bill Gates has done with his Windows money. Furthermore, you can't just steal it and expect to always get away. How are developers supposed to be paid? How is the US economy supposed to grow if its greatest companies like MS, Apple, SCO, Oracle, IBM, etc. are brought down by this communist freeware? If I had my way, you'd all be hunted down and put under the jail.
Ya, one of the new features in iPhone OS 4.0 is "Data Protection". Specified files for applications are on the fly encrypted and decrypted. The phone has to be unlocked (valid pin entered) to access the data.
Seems like they already handled this issue, unless someone wants to test that on an iPhone with 4.0 running on it...
--- its to bad about the monkey, I kinda liked them
It's OK, Steve. It's OK. No need to start throwing chairs here.
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
You misunderstand, rocket surgeons operate with explosives..
Except I believe that the memory on the iPhone is composed of ball grid array chips. So then it becomes an issue of using a reflow gun or oven. Then, once you have removed those, you need to reball the chips or have a bga prototyping socket and then attach it a compatible controller chip. Then unless you have done this to all of the chips to dump their contents so you have a complete filesystem, or all you have is useless bits. So, while not impossible, it is not a 30 second procedure like hooking up a hard drive.
I say we send them to boot camp.
DRM: Terminator crops for your mind!
Read the advisory more carefully. You need to turn off your phone, connect it, then boot the phone while it's connected to the Lucid box.
The security check is bypassed at boot, probably assuming the phone needed to be recovered.
We certainly will. And thanks again for your support!
The soylentnews experiment has been a dismal failure.
Here you have gone from saying there is no way to remove the storage (+5 Informative, haha), to saying there is a viable way to remove the storage. Kudos to you, sir. Now, where's my +5 Informative?
That's amazing, I have the same combination on my luggage!
There have been Linux tools for getting music on and off the iPod since about a week after the first iPod came out.
Yeah, Apple doesn't support it, but so what?
The Kruger Dunning explains most post on
Yes, you can get the raw data off without a PIN.
The original phones up until the 3Gs didn't encryption the data.
The 3GS and presumable 4.0 phones encrypted the data using a key that isnt (in theory) directly accessable to anyone outside the phone os and more specifically hardware.
So yes, there have been many ways to get data off 2g and 3g devices. 3Gs and 4.0 devices work in a different way so short of ripping apart a chip to get the key, the best you'll get is an encrypted memory dump which is more or less worthless unless you can get the key out of the hardware.
On older phones with newer OSes a remove wipe destroys the key. Updated versions of the software first destroy the key, then proceed to overwrite the encrypted data itself to make it useless even if you obtained the key somewhere else.
Basically, Apple realized this was studip 2 revisions of the hardware back and has such fixed the issue.
When you unlock the phone, you effectively add the key to the file system keystore so it can decrypt the files.
if you unlock your phone, you have ... unlocked your phone. Whats the difficulty in understanding this?
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
And only one of them has the strength to lift a chair, let alone throw it.
The i in "iMac" does not stand for the square root of minus one.
All Macs are in the real set.
That joke is getting a bit old, with Apple selling 4-button mice with every iMac for 5 years now.
Nah. It's still good for many of us :) And besides, Apple can't quite get away from the one-button meme -- even with their multiple button mice, they try and hide the different buttons under one big button. (Something which I would have thought was the single worst interface design decision ever, incidentally ...)
Anyway, I'm not sure what's the big deal about being able to read a small portion of the iPhone drive in Ubuntu -- you still can't access any application data or any of the databases that store your contacts/notes/whatevers. It does mean someone can copy your music ... but that's surely a good thing! And access to part of the file system isn't exactly unusual -- even without Ubuntu, you should be able to see the iPhone's DCIM photo folder when you plug the device into a computer.
If I had a magical land, there would be no ASSHOLES, so your post wouldn't be here to reply to.
And you'd just be full of shit.
This is a joke. Right? I mean how is this evidence for anything other then the fact that I paid for a phone that did not have proper security programmed into it in the first place? It took open source programmers who worked for free (I assume) to point out how the paid for product had dropped the ball and didn't have real security in the first place. Furthermore, Linux is free because the author didn't want to charge for it. Are you saying the OS is invalid because he didn't put a price tag on it? By the way, if you are not joking then you should know MS, Oracle and IBM (those are just the ones I am aware of in your list) provide open source freeware (MS working on both Silverlight/Moonlight through Novell and Active Directory with/through samba). Also if you are not joking, please tell me you are confined to a institution that makes sure a spork is the most dangerous thing you have access to. You sound like the last person that should own a gun.
If you think free software should be outlawed, all you are doing is mandating a law that says people have to charge for something even if they don't want to.
P.S. FOSS people are not known to steal anything, instead we create it from scratch and the iPhone code that Ubuntu 10.04 uses was built from scratch it was not taken from any code apple provided as apple has never provided that code to anyone AFAIK. MS has only ever made idle threats about patents without naming any identifiable aspect of it. What have we stolen from anyone. If I don't want to use Windows or OS X then you think you have the write to say I can't program productive software for it or do you honestly believe that we have somehow hacked into apple and stolen the source code for the iPhone.
P.P.S.: The post is true. I have been able to access my PIN protected iPhone 3G (not 3GS) from Ubuntu 10.04 since I installed it. The security aspect is a bit of a concern but then again, since I knew cops have been able to do this all along then I am not that surprised. The plus side is I can now upload songs to my iPhone from Linux without doing a Jail Break (I'm reluctant to Jail Break) and without having to run an app in Wine (since I hate Windows emulation) so kudos to Ubuntu for exposing a security vulnerability and at the same time making the iPhone more usable on Linux. Job well done.
You can't blame Apple for Ubuntu mis-implementing the API and skipping a step described as mandatory.
From Iphone3G API documentation...
7.4 Mounting the phone filesystem over USB
(...)
User authentication must be assured to mount encrypted filesystem. A call to validatePIN() method is a mandatory step before attempting to acquire the system key and mounting the filesystem. A typical scenario of mounting the filesystem goes like this:
IphoneSecurity& sec = Iphone::Security();
IphoneSecurity::EncKey key = NULL;
IphoneIO::Partition mp = NULL;
if(sec.validatePIN() == true) //error handling
{
key = sec.getEncKey();
mp = sec.mount(device,mountpoint,options,key);
}
else
{
}
it's a spoof, dummies
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2