Slashdot Mirror
Researcher Finds Hidden Data-Dumping Services In iOS
Trailrunner7 writes There are a number of undocumented and hidden features and services in Apple iOS that can be used to bypass the backup encryption on iOS devices and remove large amounts of users' personal data. Several of these features began as benign services but have evolved in recent years to become powerful tools for acquiring user data.
Jonathan Zdziarski, a forensic scientist and researcher who has worked extensively with law enforcement and intelligence agencies, has spent quite a bit of time looking at the capabilities and services available in iOS for data acquisition and found that some of the services have no real reason to be on these devices and that several have the ability to bypass the iOS backup encryption. One of the services in iOS, called mobile file_relay, can be accessed remotely or through a USB connection can be used to bypass the backup encryption. If the device has not been rebooted since the last time the user entered the PIN, all of the data encrypted via data protection can be accessed, whether by an attacker or law enforcement, Zdziarski said. Update: 07/21 22:15 GMT by U L : Slides.
Jonathan Zdziarski, a forensic scientist and researcher who has worked extensively with law enforcement and intelligence agencies, has spent quite a bit of time looking at the capabilities and services available in iOS for data acquisition and found that some of the services have no real reason to be on these devices and that several have the ability to bypass the iOS backup encryption. One of the services in iOS, called mobile file_relay, can be accessed remotely or through a USB connection can be used to bypass the backup encryption. If the device has not been rebooted since the last time the user entered the PIN, all of the data encrypted via data protection can be accessed, whether by an attacker or law enforcement, Zdziarski said. Update: 07/21 22:15 GMT by U L : Slides.
Everyone else, every law-abiding citizen, may move on, nothing to see here...
1) Can this method be used to bypass iCloud?
2) Does anyone have a write-up of how it works? I've got a lost-to-pawn iPad that need wiped, and will likely have more come into the shop in the future.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
There is a huge caveat here:
You can only do this if you have the keys from a computer you have sync'd with previously. That only happens if you enter your passcode then see the "Trust this Computer" prompt on a computer that has iTunes installed and you click "Trust" at the prompt. That creates a set of sync keys that the iOS device will then accept to access the various services.
Some of the stuff he complains about is only enabled for devices used for development or if the device is enrolled in enterprise provisioning. As far as I'm aware, Apple requires that the company purchase the device on the company account to support over the air enrollment in this system so it wouldn't affect personal devices. Even for USB connected devices, you must enter the password/passcode to allow the device to be visible to MDM tools in the first place. Even enabling development mode requires entering the password/passcode.
The one main point he brings up (which I agree with) is Apple needs to provide a way to see the list of computers on your device and remove them.
There are some other more theoretical issues here that Apple should address, but no your iPhone is not running a packet sniffer and will not hand over files to anyone who connects. If your device isn't provisioned for enterprise and has never connected to a PC to sync (the vast majority of iOS devices these days) then as far as I can tell, none of the issues he found are of any use whatsoever.
Natural != (nontoxic || beneficial)
whether by an attacker or law enforcement
For those who are innocent, law enforcement IS the attacker.
This may be the backdoor known as DROPOUTJEEP, which was described in some Snowden-leaked documents last year.
Looks like Apple sold out, put in a backdoor, and then lied about it.
The summary seems to imply that law enforcement and being an attacker are mutually exclusive...
Does this mean I can back it up over USB without iTunes? That's not a bug, it's a feature!
Why link to a re-post and not to the source: http://www.zdziarski.com/blog/
There we find this:
Apple is often prone to adding capabilities without thinking through the security implications. But this researcher should do some more research into what constitutes legitimate engineering uses.
From TFA:
“Some of this data shouldn’t be on the phone. HFSMeta creates a disk image of everything that’s on the phone, not the content but the metadata,” Zdziarski said. “There’s not even an engineering use for that.”
I can imagine plenty of legitimate uses of just metadata. For example, the old iOS backup mechanism basically took a snapshot of everything and something like HFSMeta could be used to identify the files that have changed so only those files are backed up.
For people who lose/have their device stolen.
People want to read something like "The iPhone has a secret backdoor for the NSA!!!". Anything much longer than that will never be read or understood by most people.
It's hopeless. Ask 100 people who have heard of this and 95 of them will tell you that it is proven now that the iPhone has a secret backdoor for the NSA over which all data can just be read by them.
(And I'm not even saying that it has NO such backdoor. Maybe it has. But this isn't it. This just isn't designed for mass surveillance, it needs a cooperating user and individual access to a device the user has connected his iPhone to. Maybe it's a side door for law enforcement and/or forensics additionally to a debugging tool.)
The iDevice has to be jailbroken to get at these features.
Go whoosh yourself.
iOS iSpies on you.
Really, very much as after 9/11 people are actually training themselves into a deep trauma. As you should know avoiding a trauma means NOT to do that. Sadly if you leave people to do what they want (and have this amplified by the headline-addicted press and of course the Internet) they will do exactly that. They will over and over come back to what did hurt them, they will stare at it all day long and become more and more fascinated by it, until they can't think of anything else anymore. Feelings of intense anger that is targeted at often logically totally unrelated persons or things will be more and more common.
http://en.wikipedia.org/wiki/P...
To "get back to reality" isn't easy then.
That too is against the law in some states.
I frikken knew it. That's why China won't allow iPhones. I bet you 83% odds Windows has it too. Government backdoor is 99% the reason.
Is Apple beginning to get like M$?
You'll have to close this back door in iOS 8 and add a new one that's harder to find.
Is Apple beginning to get like M$?
It always was.
Smartphones could theoretically be perform the function of an unbreakable crypto endpoint, very much like a "SIGABA in your Pocket".
That would make their ears deaf. Billions of SIGABAs in the hand of civilians !!!
So they "broke" the crypto machine security by adding backdoors. Don't by the corporate colored glass beads, but roll your own crypto. Its not actually hard. A small controller, an LCD display and a keyboard will do.
Or to put it another way, they're the services used for syncing (or at least, don't offer any more access than the sync functionality).
Of course a computer set to sync data can access the fucking data.
Part of the protection against tyranny isn't the gun, but simply that certain law enforcement has certain costs. Part of it is red tape - a warrant sticks some glue in the process, slows it down. Part of it is monetary costs. In the 1970's wire taps cost a lot.
These costs force some filtering of resources. You can't just go after everyone, you need to be somewhat efficient with resources. It doesn't eliminate bad actors, but it makes the consequences more intense.
Part of what the NSA is doing, they can do because the surveillance is so cheap. If it cost them 1000 a person, then just in America it would cost them 350 Billion a year to spy. The world would cost 7 Trillion. We can't afford that, only that surveillance is (too) cheap does mass surveillance make sense.
Memo from Self : Like I was going to do that? After the last time I worked on a Mac?
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"