Slashdot Mirror
Cops Can Crack an iPhone In Under Two Minutes
Sparrowvsrevolution writes "Micro Systemation, a Stockholm-based company, has released a video showing that its software can easily bypass the iPhone's four-digit passcode in a matter of seconds. It can also crack Android phones, and is designed to dump the devices' data to a PC for easy browsing, including messages, GPS locations, web history, calls, contacts and keystroke logs. The company's director of marketing says it uses an undisclosed vulnerability in the devices it targets to run a program on the phone that brute-forces its passcode. He says the company's business is 'booming' and that it's sold the devices to law enforcement and military customers in 60 countries. He says Micro Systemation's biggest customer is the U.S. military."
undisclosed vulnerability
Maybe the delay between login attempts in only in the UI, and using API level access they can brute force the combinations without the delay from wrong passcodes, making it much quicker?
I can crack any smart phone in under 15 seconds.
With a sledgehammer...
"My brand of comfort isn't so much 'There-there' as it is 'There's a boot, pardon me while I connect it with your ass!'"
What happens when these vulnerabilities are fixed and the kits become useless? I assume our overlords will have to pay for a new version.
If the manufacturers (Apple and Google) were truly interested in patching these "undisclosed" vulnerabilities, they could purchase this software and run it on test/dev devices to see how it's done.
sig: sauer
Weren't we reading just two weeks ago about how the FBI utterly failed in cracking an Android phone's gesture lock, and had to go demanding Google to help them?
http://yro.slashdot.org/story/12/03/14/2222229/fbi-tries-to-force-google-to-unlock-users-android-phone
Um, why do these even exist on the phones in the first place?
iOS (and I guess Android) have another layer of passcode lock that's more secure than the 4-digit PIN, though it requires a bit more work. They're basically passwords (or pass phrases?) and while they're a pain, they are supposedly much stronger than the PIN.
How does this thing fix that?
Also - it seems if they can run a program using it, it's a perfect jailbreak hole. Because the standard kernels now in iOS don't allow running unsigned programs. So either the dongle has to inject code into the kernel or other already-running process (if you can do that, it's a jailbreak avenue) in order to disable the signature check functionality, or they're running some sort of secret signed code ...
Unclear from the article is whether this hack would get anything if the 10-wrong rule for wiping everything is in effect.
The process is identical to what you do to jailbreak an iPhone - which makes sense. In both cases, the device would need to be put in DFU (eg, the "help, I'm broken, iTunes please fix me") mode. You have to wonder if these guys actually do the R&D for the iPhone, or just take the work that's already been done by others like the iPhone Dev Team.
Since this is pretty much a guaranteed vulnerability anyway (at least, every iOS up to now can be jailbroken with a tether), a much more interesting question is how much harder is a longer/more complicated password to break? If this is literally a bruteforce enumeration, a reasonable password (that could be used for a computer) would be fairly safe.
The iPhone. The summary even explains that... The article and video demonstrate even more. It loads alternative firmware onto the device and uses that to crack the passcode stored on the device. Most of the time is spent loading the code onto the device, not cracking the code.
I wonder how well it works with a complex iPhone passcode though (if at all?) - I confess to not watching all of the video or reading the article properly.
Does it actually wipe it, or merely disable your ability to unlock it without help from Apple?
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
The attack boots an alternative firmware onto the device. I doubt an unsuccessful attempt lock is much use...
Err... the iPhone's "slow ass" computer?
isn't this a violation of the (grossly over-broad) DMCA, in "bypassing a protective measure"?
I mean, technically, aren't they hacking it and selling an exploit?
It would be refreshin to see that law used to protect some of the public for once.
I work for the Department of Redundancy Department.
I'm curious how they managed to crack the Android phones. All of the rooting methods that I know of involve manually enabling Debug mode on the phone and then rooting around on the command line. If you have a screenlock enabled and have not left debug mode enabled, then I don't see any simple way to get access to the phone to even start to mess with exploits.
Then there's the question of how this relates to the FBI publicly having to go beg Google for help to get into some low-level criminal's Android phone that had the pattern lock enabled, which some have previously complained wasn't really all that secure. Are these guys blowing smoke about how easy it is to crack Android? Were the FBI guys working on this particular case just not on the ball? Has the Government decided not to break out their coolest tricks to solve a relatively minor crime? Did this guy have some particular model that's much harder to crack?
I don't reply to ACs
Apple needs to implement a common blocking scheme. Maybe 10 wrong then wipe is too extreme for some users, but even Mac OSX respects 3 wrong then hide the input box for a delay.
They do.
Android 4.x includes the option to encrypt the filesystem.
Certainly. Even an iPhone allows you to set any password of any length that you like. The 4 digit passcode is the default but you don't have to use it. I always set at least an 8 character code.
From TFA:
In short, longer passwords tougher to crack by brute force and potentially not worth the time. Seriously this is a non-story other than the fact that there should be a warning on all mobile phones that a 4 digit pin is this decades WEP.
iOS has "full drive encryption" in iOS 4 and later.
It's just protected by a 4 digit pin which can be easily brute forced by default.
You can use a stronger passcode, but you have to type it on every unlock so few do.
Blessed are the pessimists, for they have made backups.
How to make phone operating systems more secure:
1. Remove the mechanism by which a forgotten password can be bypassed. Forgot your password? Tough shit. Now that you've bricked your phone, maybe you won't be so forgetful next time.
2. No USB access of any kind when the phone is locked. It's a huge vulnerability.
3. Full disk encryption. Granted, the phone spends most of its time operating with the key in memory, but...
4. Phone turns off when you remove the back cover or otherwise try to get inside of it. Not hard to do.
An extremely dedicated attacker could potentially bypass these measures, but not your average traffic cop or border patrol agent on a fishing expedition.
Instead, phones are designed to make it inconvenient for John to pick up Suzie's phone and read her text messages, and to make sure Suzie can easily reset her password so her carrier doesn't have to deal with a whiny tech support call.
What you can do, however, if you have a reasonably user-serviceable phone, is cut the data lines going to the USB jack. It'll charge slower (500mA limit), but plugging in a USB cable won't grant a casual snoop any access. File transfer can be handled via wi-fi.
If you can brute force the passcode because it is only a 4 digit number it's not much use to have secure encryption.
While if you have a 40 character passphrase you have enter everytime you want to unlock it, its not terribly useful as a mobile phone.
Not really sure what the solution is. Some sort of balanced approach... 4 digits to unlock the basic functionality... place and answer calls... use preselected apps...
full passphrase to get deeper in...
with some user options to control where exactly the boundary is...
but this is of course "complicated" which disqualifies it from being ideal too... so I'm not really sure what the solution is.
My password is one, two, three, four, five.
Remember when they only cracked your skull?
"Flyin' in just a sweet place,
Never been known to fail..."
I thought it was 10 attempts for the iPhone?
You got 5 tries, then had to wait a minute for the 6th, five minutes for the 7th, 15 minutes for the 8th, 30 minutes for the 9th, and an hour for the final (10th) attempt. If that fails then you can either have the phone lock itself until connected to its home iTunes account OR the option to go full nuclear and wipe the device.
?
Biometric auth perhaps? .. Not perfect of course..
// MD_Update(&m,buf,j);
On a decent device, the PIN should be stored in specialized hardware. When you get it right, it releases the encryption keys to your data. If you guess wrong several times, the key (and therefore your data) should be destroyed. If the OS internally has easy-access to all the data without your PIN, we can expect data to be easily compromised using the vulnerability of the day. A secure design would use full-disk encryption to facilitate fast remote-wipe operations. But to protect the data when a wipe hasn't happened, the user data should be encrypted with the PIN as I described initially. The encryption key could be available to encrypt income mail and data while the handset is locked. Then, when unlocked, the phone can finish merging the new data into the email/whatever database. As soon as you lock your phone, it shouldn't be possible to brute force the PIN to access your mail due to the max number of guesses enforced by hardware.
But in addition to this, if the device doesn't require a PIN to unlock the full-disk encryption on boot, it's vulnerable to viruses being installed on the device. Then that could monitor the device and record any PIN entered by the user. I don't really know of any phones that actually implement a really good security scheme. Your best bet is to avoid having sensitive data on your phone. For example, you could use HTTPS to access gmail rather than adding the account to the phone itself. Of course, for most of us non-criminals, we don't really care. It's usually our employers who own the IP saved in our phone.
What do you define as "specialized hardware," exactly? The iPhone doesn't exactly keep the PIN on a USB drive...by definition it is specialized hardware, in and of itself. And what you describe as what should happen if the PIN is incorrectly entered enough times is already a native iPhone feature.
And of course the OS has to have access to your data without the PIN; how is it going to tell you that you got a new text, email or phone call? How will it tell you the name of who is calling based on their phone number? How will it let you know that you have that meeting coming up in 15 minutes, like you want it to do? And most of all...how will it know that the PIN you gave it is the right one? There are ways to make devices more secure against side-channel attacks, but what you're describing is infeasible, impractical and pretty much impossible anyways.
It doesn't matter where you keep the PIN, hardware-wise, in this case since the problem is software related. And you don't encrypt anything with a PIN; a PIN that any human could ever remember has WAY too short a length and too little entropy to be useful. The PIN is nothing more than an authentication factor.
And if you don't know of any phones that implement a really good security scheme, it's either because you don't know what a Blackberry is, or because you don't know how to build security around a mobile device. I'm betting on the latter...
For your security, this post has been encrypted with ROT-13, twice.
Wipes after sufficient failures should be an option that can be disabled, though. Anyone with kids who ever get their hands on their phone will likely prefer that. Hell, my son managed to dial emergency services once by mistake, WHILE MY PHONE WAS LOCKED, and I didn't know until they called me back, just by mashing buttons. (Apparently, holding down zero long enough would dial 911, even when locked. Not so cool when you manage to sit on the phone wrong, or the kid decides to hold your locked phone Just Right.)
When this sort of thing is actually designed for security, there is a dedicated crypto coprocessor with some memory that is write-only from the perspective of the rest of the system. You write the key to it once, and then it will encrypt or decrypt data that you pass to it. The decoder chip can be locked and you must supply the correct passcode to enable its access to the stored key. If you provide the wrong key a preset number of times, it deletes the internal copy of the key and the only way you can get at the data is by restoring the key from another device (typically a backup stored in a safe). Even if the entire OS is compromised, it can't get at the key unless it provides the correct passcode to the decryption chip (actually, it can't get at the key then either, but it can instruct the crypto chip to do it). Some ARM SoCs incorporate this functionality.
I am TheRaven on Soylent News
Android 4.x includes the option to encrypt the filesystem.
As does iOS if you enable it:
http://support.apple.com/kb/HT4175
http://images.apple.com/iphone/business/docs/iOS_Security.pdf
Generally speaking though, only Blackberrys (and much of the related software (BES)) has received any kind of certification for security. Specifically FIPS 140-2 and EAL 4+:
http://us.blackberry.com/ataglance/security/certifications.jsp
It is probably "good enough" for most businesses, but isn't rated for the 'real' security levels: Classified, Secret, and Top Secret.
I work someplace where we have a lot of personal health information, and the IT director (CISSP et al.) only allows Blackberrys for portable devices. He has an iPhone for his personal stuff, but carries a BB for work because iOS just isn't up to our needs yet when it comes to data security.
it's a matter of attempts. Blackberries and iPhones (don't know about Android) has the ability to erase all data after 10 failed attempts to log-in. So unless they can bypass the counter entirely, I'm not too concerned about the security level of 4 numbers (assuming you don't use 0000 1111 1234 or some other common ones).
Biometric auth perhaps? .. Not perfect of course..
You can't do much except finger print realistically on a phone... nobody is going to tolerate a retinal scan to make or answer text messages and phone calls.
And it would need to work reliably (low false accept rate / accepting photos of the finger, fingerprints lifted with gummy bears off the phone itself, etc.. or its not secure...with a near zero false reject rate or it would be unacceptable to users...
And to top it off it has to work to those tolerances under a wide range of temperatures and humidity levels and while at least moderately dirty...after all its a phone in your pocket... not a checkpoint in a well controlled environment.
A final nail in biometrics coffin for this sort of application is that you can very easily be coerced to unlock it... from criminals, to law enforcement, to the psycho you fell asleep next to on the plane... all just need to touch your finger to the handset to unlock it...
Getting a pass phrase out of you runs from "we need a wrench" to "we need a judge willing to throw out the 5th" ... which is of course doable, but the bar is a bit higher... for now at least.
You could have a soft and hard lock. A soft lock could be done with a short simple pin. When you believe that you are in danger of having your device taken you put it in a hard lock that clears the decrypted encryption key from the memory and requires the full password to unlock. Not perfect but a compromise.
I'm not certain about Android, but iPhone offers the option (Settings -> General -> Passcode Lock) to wipe your phone after 10 attempts. This is the same area where you can disable the 'simple' passcode 4 number pin. I'm assuming this method of hardware brute force cracking the phone allows them to bypass that of course. Sufficient for casual folks trying to hack into your phone at least. I assume Android has similar options.
IIRC a long time ago (early 1980s?) an IBM Research Fellow published a paper about signature recognition (for the same essential purpose of authentication). He/she found that the actual strokes were not so important but the acceleration was. IOW, your actual signature varies quite a bit from one to another, but the series of accelerations are more similar.
So, I think this could be used. You could just 'sign' our phone. A reasonable 'signature' would have to my mind at least 50 data points of acceleration or deflection. Since we do vary the sig, some kind of fuzzy matching with the accepted vector would be required - say 90%. Then if it matches, the signature recognizer could use the correct data as the key to the decryption.
Thus, we would not need to remember a long key, just let our muscle memory do its thing.
It's easier to be a result of the past, but more fun to be a cause of the future! http://www.spacefinancegroup.com/
Like shutdown. Long code on power up. Short code on unlock.
The easiest workaround, if you are doing something questionable with your smartphone, is to carry a dumb phone, with an appropriate number of contacts: Mommy, a pastor, the local animal rescue shelter, etc. and hand that to the LEOs. They aren't going to ask "Is this the only phone?" They look, they see that you are Mr. Citizen of the Year and you're on your way...
"If stupid things work...then they are not stupid."
Which does pretty much nothing once they're running under your credentials after having brute forced your passcode.
Violence is like duct tape. If it doesn't solve the problem, you didn't use enough.
Anyone with kids who ever get their hands on their phone will likely prefer that.
After 3 failed attempts, the phone starts imposing a waiting period before you can attempt the passcode again.
By the time you get to 6 failed attempts, you have to wait ~1 hour before trying again.
Your kid could do 10 attempts to wipe your phone, but only if you are so careless to leave the phone with them for an extended period. Besides, your phone gets backed up every time you sync it.
I would suggest having two methods: (1) Tap the power button 3 times or power off, to engage full lock manually. (2) an RFID or bluetooth "leash" concealed somewhere about your body; if the phone is within range and then suddenly taken more than a certain distance from your RFID transponder, the new distance will be calculated by the units, and when the threshold is exceeded, the "hard lock" engages automatically.
This way if you drop your phone, or someone steals it, the hard lock will engage.
The bluetooth leash could also have a remote lock button on it, and be designed to automatically signal a lock if the leash is removed from your body, or if a sufficient "sudden jolt motion" or downward motion is detected by an accelerometer on the leash (indicating that someone grabbed it real fast), or you were forced to drop it.
Dickman also noted that long passwords were easier to crack if the phone belongs to a Slashdot user, because the password always turned out to be "Natal13 Pr0tman"
Today's Sesame Street was brought to you by the number e.
You can also use a password (most secure), pattern unlock (not very secure, though new screens are less smudge prone), or face recognition (fun gimmick, not secure at all).
Though I cant imagine having to type hunter2 into my phone every time I unlock it.
PocketPermissions Android Permission Guide
Sorry, I meant most every smart phone currently on the shelves for purchase employs full-disk encryption. In most cases, manufactures implement it to allow corporate exchange email access. If the device supports exchange, it typically has full-disk encryption (early iphones were an ugly exception..). One of the exchange activesync requirements is that the device supports a secure remote-wipe. iphone 3GS and newer have full hardware encryption. Android 3.0+ devices use hardware encryption, and all WP7 devices use it. I'm sure blackberry does as well but I don't know their history very well. So the result is that these devices all support the remote wipe feature. That means if you enter the pin wrong a number of times or remotely trigger the wipe, the encryption key is deleted. That way, it doesn't take hours to securely delete all the data from the disk. The only thing that needs to be deleted is the encryption key. The flash always has some encryption key set. That's why setting up the remote-wipe or PIN-based wipe doesn't require you to spend an hour reformatting and encrypting your entire flash storage.
It basically wipes the decryption key from any memory on the device. The key is not stored with Apple and I doubt Apple has a 'universal collision key' on their encryption as they use RSA if I'm not mistaken which AFAIK doesn't have a universal collision key. Same goes for Android/Google and most encryption, encryption with spare keys is easy to detect and crack.
Custom electronics and digital signage for your business: www.evcircuits.com
Three:
One to crack the iPod, and one to confuse the issue.
"Flyin' in just a sweet place,
Never been known to fail..."
Android 4.x includes the option to encrypt the filesystem.
For obvious reasons, our goonware friends are a bit vague on how their mechanism works; but encryption only saves you if the attack is unable to get access to the phone as the user(since the filesystem has to be mounted and visible to you and your process as plaintext).
Encryption is excellent against the class of attacks where the attacker attempts to circumvent the OS's access control by obtaining direct access to the block device and using an OS they control to read it out. However, if the attack is directly against the OS's access control, it isn't nearly so useful, since things are usually set up to grant trivial plaintext access to the user.
There are 5040 4-digit pins, 151200 6-digit pins, 604800 7-digit pins, and 1814400 8-digit pins.
No, there are 10,000 4-digit PINs, 1,000,000 6-digit PINs, 10,000,000 7-digit PINs and 100,000,000 8-digit PINs. Unlike with patterns (as implemented by Android, at least), you're not restricted from re-using digits.
There are 362,880 9-dot patterns (use the whole pattern)
Not quite that many. You're assuming you can pick the nine dots in any sequence, but some patterns are impossible (or at least very difficult) because you can't get from one dot to the next in the pattern without touching a dot in between. It would be tedious, but not difficult, to enumerate the feasible set of patterns, and the likely set is even smaller, since people tend to choose connected sequences.
I'd say a longish pattern (6+ dots) is roughly equivalent to a four-digit PIN, but even a maximal-length pattern barely reaches the strength of a five-digit PIN.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
You might try actually reading your links. The iOS file system is always encrypted. All the links talk about is setting a pin to protect the encryption keys. There is no functional difference between BB and iOS encryption. You can easily force the use of pin codes as well.