Private Data On iOS Devices Not So Private After All

theshowmecanuck (703852) writes with this excerpt from Reuters summarizing the upshot of a talk that Jonathan Zdziarski gave at last weekend's HOPE conference: Personal data including text messages, contact lists and photos can be extracted from iPhones through previously unpublicized techniques by Apple Inc employees, the company acknowledged this week. The same techniques to circumvent backup encryption could be used by law enforcement or others with access to the 'trusted' computers to which the devices have been connected, according to the security expert who prompted Apple's admission. Users are not notified that the services are running and cannot disable them, Zdziarski said. There is no way for iPhone users to know what computers have previously been granted trusted status via the backup process or block future connections. If you'd rather watch and listen, Zdziarski has posted a video showing how it's done.

Comments

Stallman was right

[jabberw0k]

These so-called "smart telephones" aren't telephones at all; they are computers. Computers that you cannot control. And if you aren't, who is?

Some folks thought Richard Stallman was crazy for saying no-one should run software or use hardware that is based on clandestine (proprietary, hidden) knowledge. This latest revelation is just one reason he was right all along.

Re:Stallman was right

[Anonymous Coward]

Fortunately, if someone wants a "smartphone" that is under full control of the user, there are a few choices: Openmoko Neo Freerunner, OpenPhoenux GTA04 or latest device in development - Neo900 ( http://neo900.org/ )

The last one even goes further and implements monitoring over some unavoidably closed parts, like GSM modem (and all of them have proper modem isolation, so the modem cannot access the main RAM, possibly rendering any software encryption moot like on most of recent mainstream smartphones)

Re:Stallman was right

[HiThere]

Not sure about that particular case, but there are some legal requirements that, I believe, entail controls that are not user controlable. Things like frequency, signal encoding, etc. Those seem liike reasonable constraints, so long as we aren't using spread spectrum, which, IIUC, is illegal.

Given that, modem isolation is probably the just and reasonable approach to take.

it's the future

[Anonymous Coward]

The more we buy devices whose master is someone else, the more things of this very nature will become a problem.

Do not buy devices that you do not control after you buy them. You must be able to run any kernel and any userspace you want, you must be able to control the machine top to bottom. If you give this up in exchange for convenience, then you will be taken advantage of by companies that don't have your interests at heart.

Re:it's the future

[Anonymous Coward]

You got modded down by Apple fans for telling the truth.

Re:it's the future

[HiThere]

Unfortunately, no, I wouldn't "expect people to be more sensible than that, especially in the post-Snowden era", even though this actually isn't the post-Snowden era. He's still around, and still occasionally releasing new tid-bits.

I normally expect people to be short-sighted, and to have little memory of history. I regret that I'm rarely disappointed.

So...

[Sqr(twg)]

If you store sensitive stuff on your iPhone, don't make backups from it onto an insecure/unencrypted computer.

And if you were making backups from anything secure onto anything insecure, it is time to revise your security policy.

Article got it wrong

[strredwolf]

Almost all the reports are getting the gist of the paper wrong -- any press summation that doesn't go into the paper to understand it will get it wrong. The paper goes into deep detail that Apple has several services that, while protected by several layers of security that could be bypassed, can transfer data in the clear. There are also several services that don't have any obvious connecting software.

It's a rather deep hacker-style dive into iOS.

A good video about this is by TWiT Network. At http://twit.tv/sn465 Security Now ep 465 has expert Steve Gibson explain the actual paper.

Re:Article got it wrong

[c0d3g33k]

You lost me when you said "expert Steve Gibson". If by "expert" you mean "shameless selfpromoting security wannabe", then OK.

No. These are examples of shameless, self-promoting wannabes:

https://en.wikipedia.org/wiki/...
https://en.wikipedia.org/wiki/...

Steve Gibson at least provides genuinely useful information most of the time and from what I can see does a decent job of teaching non-technical folks to understand and implement good security practices. He's a little hard to take in large doses when I've seen him on This Week in Tech and his website hurts my eyes, but I wouldn't paint him with such a broad brush. He doesn't seem to be a charlatan as much as a well-meaning but occasionally bumbling 'little guy' trying to build a business in the technology/security realm.

Re:Yeah

[Anonymous Coward]

These *attacks* require the attacker to have the keys from a trusted computer. Is your linux secure if you give somebody the root pass? Is your house safe if you give a friend the keys? These "security" headlines are just clickbait.

FUD

[Anonymous Coward]

The it only works with a trusted device AND the device being unlocked.

If you gave your device PIN to someone, they already have your data and don't need to do this.

Expectation of privacy

[markwillison]

Due to the great advances in technology and the continuing reduction in cost of these technologies, what were previously "dumb" devices are now extremely sophisticated computers doing specialized tasks but they are not limited to these specialized task or to being used in the manner they were conceived for. As such almost all modern device from cameras to mp3 players can be re-purposed as digital "snitches". This is often true even if the device was not design or envisioned to so from the beginning or had countermeasures to inhibit the use of the device in that way. Such sophisticated devices can be reprogrammed or "hacked". Just accept this as true and if you can't due the research and enlighten yourself. So the only practical recourse is accept it and be careful if you have a good reason to believe your data is incriminating to you. Assume all devices have vulnerabilities or use paper instead and hope everyone has forgotten how to read that way.

Re:Expectation of privacy

[NicBenjamin]

If you're doing something incriminating don't use paper either. Governments have spent literally centuries figuring out how to make a piece of paper spill it's secrets.

At this point expecting the government not to be able to get it's hands on your data if it really wants to is pretty damn naive. Folks who think that are like the mid-17th century folks who tried to skimp on telling the King their last names. They could make it work for the first few decades, but eventually the bureaucracy figured out the technique and it got to be really hard to tell the authorities in Lincoln you'd paid your taxes back home in Lancaster using the name Alan Smith, while telling the guys in Lancaster "Oh I took care of that in Lincoln, just ask them about Alan Jones and his taxes."

Your devices leave fingerprints everywhere. It isn't physically possible to force the wi-fi network on the Wendy's you just drove past to destroy the record it has of your cell phone trying to connect. Your phone probably left some evidence linking back to you, unless you bought a burner and you're just gonna throw the damn thing out. But a) that doesn't work very well for large groups because if everyone's always changing their number there are massive co-ordination issues ensuring everyone can still talk to everyone else, and b) since you're using your phone exactly like a drug lord does the local police need to have some record of you in their files. Even if it doesn't say anything beyond "this dude is fanatical about his privacy, so he should be a low-priority suspect when the system points out that he a) lives in the same apartment complex the known drug smuggler lives in, b) makes extensive use of burner cell phones, and c) takes a couple foreign trips a year for which he pays cash on the day of the flight;" it has to exist.

Apple's Admission?

[Anonymous Coward]

When did Apple admit to anything? They said the researcher was wrong and described the settings that he found and what they are used for! I would trust Apple over Google any day! Eric Schmidt has lied so many times along with his colleagues that the whole company isn't trustful!

http://support.apple.com/kb/HT6331

http://www.macrumors.com/2014/07/22/apple-ios-backdoors-support-document/

Nothing new here

[maccodemonkey]

iPhones have always been able to sync data out of their secure storage to the user's computer since launch. How did people think USB sync worked? Magical leprechauns that flew out of your phone carrying the data?

Heck, one of these is the developer daemon that runs on the phone to install apps from Xcode. Again, how exactly did people think Xcode did that?

These tools all require the phone be logged in, and that the right key exchange take place.

I can't tell if the "security researcher" here is just trolling, has never actually used an iPhone, it is just stupid.

BlackBerry...

[Rigel47]

and yet /. folk cheer on the demise of BlackBerry.. the one phone that has a near flawless security record.

and yes, full disclosure, I own a z10. I also find it to be the best smart phone I've ever owned with battery life that my android friends can only dream about.

Re:BlackBerry...

[Wovel]

Blackberry, the company that routinely gives access to customer's "secure" data to governments all over the world without the customer doing anything at all. Are you high? You must be high if you purchased a z10.

Re:Yeah

[Belial6]

Correct me if I am wrong, but this attack sounds like it would let your friend make a copy of the key, and even if you changed the locks on your house, his copy would still work.

Re:Horribly Inaccurate

[gnasher719]

Trusted by whom? I don't think there's any requirement that the purchaser of the device trust the "trusted" data extractor. IIUC it could become trusted before the customer ever received the device, or anytime it's in for service.

Step 1: Plug iOS device into a Mac.
Step 2: Unlock iOS device.
Step 3: Click on YES when the iOS device asks if it should trust the computer.

The critical part is Step 2, which you can only perform if you know how to unlock the device. In other words, if you know the passcode. But if you know the passcode, then you can do _anything_ with the phone. That's what the passcode is there for.

So basically, this security "expert" found a way for a thief to enter my home through the backdoor, as long as the thief has the keys for my front door.

Re:Yeah

[dos1]

It's enough to have a friend PC compromised, where you connected your iPhone once, a year ago, to recharge your battery and you don't even remember that now. When his computer is compromised, your phone becomes compromised as well and vulnerable to remote attacks.

That's a bit different story than what you described above.