iPhone's PIN-Based Security Transparent To Ubuntu

ndogg writes "Security experts found that the iPhone 3GS has very little security, even with a PIN set up. They plugged one into Ubuntu 10.04, and it was automounted with almost all of the iPhone's data exposed. This has been reported to Apple, but the company seems to be having difficulty reproducing the problem."

Comments

Sounds like a feature

[kthreadd]

So the problem is that the memory of the iPhone is mounted and that the data is exposed? I may not understand this exactly but hasn't the argument been for many years now that iPods couldn't be directly mounted like that?

Re:Sounds like a feature

[stagg]

Critical bug! Product too versatile -- works with non-Apple operating systems.

Re:Sounds like a feature

[marcansoft]

They're not a block device, so you can't mount their filesystem as such. Instead, they're effectively network drives: the proprietary AFC file transfer protocol tunneled over a hugely mutilated version of TCP stuffed into USB packets. Which you can mount under Linux, using FUSE and the appropriate apps (usbmuxd, libimobiledevice, and ifuse). I maintain usbmuxd.

Apparently Apple relies on security through obscurity here (only their apps are usually able to talk to an iDevice), and the actual protocols aren't secured.

Incidentally, this is where the term "jailbreaking" comes from: breaking out of the AFC filesystem jail (which is usually limited to the user's data partition). Jailbreaking's original feature was to introduce a secondary AFC share with root privileges on the root directory, and jailbreaks to this day still do. You can use ifuse --root under Linux to mount this secondary share.

Re:Sounds like a feature

[flooey]

Which you can mount under Linux, using FUSE and the appropriate apps (usbmuxd, libimobiledevice, and ifuse). I maintain usbmuxd.

In fact, when you plug an iPhone into a Mac, you can see in the process list that usbmuxd is what Mac OS is using to talk to the device.

Re:Sounds like a feature

[fuzzyfuzzyfungus]

I have to wonder what sort of testing Apple(didn't) do here. If it is possible for a linux machine to mount the filesystem, then setting a PIN clearly has no effect at all on the device's access control of that filesystem. Even if plugged into a mac or PC running iTunes, the data should be equally accessible.

Either they simply didn't feel the need to make the PIN actually do much more than lock the screen(arguably fairly misleading), or next to no testing was done, or (even worse), setting the PIN also sets some sort of "politely ignore the data you could easily access" flag, that iTunes obeys and the third-party implementations don't.

Re:Sounds like a feature

[marcansoft]

Correct. I wrote most of the usbmuxd implementation that we use on Linux as a clone of Apple's version. In fact, you should (as of yesterday) be able to compile libusbmuxd and libimobiledevice and maybe even ifuse (with macFUSE?) and use them together with Apple's usbmuxd on OSX to pull off this hack there. Heck, I think at least libusbmuxd and libimobiledevice should even build on Windows these days (Apple provides a Windows version of usbmuxd with iTunes).

Re:Sounds like a feature

[greatica]

Breaking into an Apple device: "it just works."

Re:Sounds like a feature

[marcansoft]

The iPhone 3GS supposedly uses whole-disk encryption. This does squat when your USB comms protocol doesn't request authentication though, since you can pull the data off through the iPhone kernel's transparent decryption layer.

In other words, this hack has nothing to do with encryption and everything to do with an insecure protocol that makes no attempt to actually request PIN authentication before handing over all your data. Nobody expected your PIN to actually act as key for encryption anyway; that's impossible, as the iPhone has to be able to access your data even while locked.

Re:Sounds like a feature

[Mike Buddha]

The filesystem IS encrypted, but the OS happily decrypts everything for you without any form of authentication. That's the story here.

Re:Sounds like a feature

[Nerdfest]

This does squat when your USB comms protocol doesn't request authentication though, since you can pull the data off through the iPhone kernel's transparent decryption layer.

It just works ... even when it shouldn't.

Re:Sounds like a feature

[marcansoft]

OK, upon further testing (I don't use a passcode myself so I never even looked into this) and getting some information from others, it looks like this isn't a total oversight on Apple's part, but it is a real bug that requires a specific sequence to trigger.

Here's how it's supposed to work:

• The first time you connect an iPhone to a specific computer, the iPhone will "pair" with the computer. This happens behind the scenes.
• This pairing process is disabled while the phone is locked with a passcode.
• Once paired, that computer will always be able to talk to that phone, even while locked.

The actual bug is that there's a race condition during boot. There's a window during which the lock code setting hasn't been read, during which the phone will accept pairing requests even though it shouldn't.

If you want to try it on Linux, do this:

• Delete ~/.config/{libiphone,libimobiledevice} to clear the pairing data
• Create a directory to mount the device on
• Configure a passcode on your device and shut it dow
• Have a syslog window open
• Plug it into USB and power it on
• As soon as you see your device enumerate with the USB subsystem, start spamming ifuse <mountpoint> on a terminal
• With any luck it will pair and mount. From now on you can unmount it and mount it as many times as you wish with this computer.

Notice how the "slide to unlock" SpringBoard screen will not have yet appeared when this works. Once it does, the passcode has been configured and pairing will no longer work. On the latest version of ubuntu it tries to automount as soon as it sees the device, which makes this bug a lot more obvious.

Updated story

[OzPeter]

From TFA Apple could reproduce the described serious issue and believes to understand why this can happen but cannot provide timing or further details on the release of a fix.

Apple can now reproduce

[KnownIssues]

Bernd Marienfeldt updated his blog saying Apple is now able to reproduce the problem and believes they know the cause, but no timing on fix release.

This is not Apple's problem.

[gimmebeer]

It is a security problem with Ubuntu and should be fixed by their dev team before they are sued for hacking. Afterall, the iPhone was not meant to be connected to anything other than Apple software.

Re:Attention Naysayers

[egcagrac0]

You two have fun with that.

And?

[lennier1]

Will their fix consist of actually making the device more secure or will they just try to make it harder use it with Linux systems?

Re:Physical Access = Root Access

[Elbart]

But that's exactly how Apple is advertising the 3GS: http://www.apple.com/iphone/business/integration/#securing

Attempted to duplicate - not quite what they say

[__aaaaxm1522]

I plugged my iPhone 3GS into my Ubuntu box. While it's true that Ubuntu did automount the iPhone, the only thing I can find that was exposed was my music, photos and podcasts.

I wasn't able to access email, contact info, or anything else on the phone. I did see the Application Archives, PublicStaging, Purchases, and Safari folders but they're empty. I have lots of email and contact info on the device - but it appears to be inaccessible via this method.

RTFA..

[Anonymous Coward]

From Apple:

Apple iPhone Security Overview [1]:

Data Protection:

Protecting data stored on iPhone is important for any environment with a high level of sensitive corporate or customer information. In addition to encrypting data in trans-mission, iPhone 3GS provides hardware encryption for data stored on the device.

Encryption:

iPhone 3GS offers hardware-based encryption. iPhone 3GS hardware encryption uses AES 256 bit encoding to protect all data on the device. Encryption is always enabled, and cannot be disabled by users.

Re:Wow.

[Anonymous Coward]

I think that this is just ridiculous and just more evidence that Linux users are nothing but criminals and thieves and open source should just be outlawed. It is this "free" software that engenders this attitude of laissez-faire we can do whatever we like without paying for anything that is the direct cause of security breaches such as this with the iPhone. The fact that open sores can continue to exist despite the hundreds of intellectual thefts in the form of Microsoft's patents, Fraunhofer Institutes patents with the mp3 players, Unix copyright thefts.

Don't you freetards get it? If you want something, you have to pay for it. And 100 dollars for something as great as an OS isn't that much. Look at the great things Bill Gates has done with his Windows money. Furthermore, you can't just steal it and expect to always get away. How are developers supposed to be paid? How is the US economy supposed to grow if its greatest companies like MS, Apple, SCO, Oracle, IBM, etc. are brought down by this communist freeware? If I had my way, you'd all be hunted down and put under the jail.

Already fixed in iPhone OS 4.0

[bic2k]

Ya, one of the new features in iPhone OS 4.0 is "Data Protection". Specified files for applications are on the fly encrypted and decrypted. The phone has to be unlocked (valid pin entered) to access the data.

Seems like they already handled this issue, unless someone wants to test that on an iPhone with 4.0 running on it...

Re:Wow.

[VGPowerlord]

It's OK, Steve. It's OK. No need to start throwing chairs here.

Re:Wow.

[spazdor]

I say we send them to boot camp.

Re:Hard drive

[Anonymous Coward]

Here you have gone from saying there is no way to remove the storage (+5 Informative, haha), to saying there is a viable way to remove the storage. Kudos to you, sir. Now, where's my +5 Informative?