Slashdot Mirror
Private Data On iOS Devices Not So Private After All
theshowmecanuck (703852) writes with this excerpt from Reuters summarizing the upshot of a talk that Jonathan Zdziarski gave at last weekend's HOPE conference:
Personal data including text messages, contact lists and photos can be extracted from iPhones through previously unpublicized techniques by Apple Inc employees, the company acknowledged this week. The same techniques to circumvent backup encryption could be used by law enforcement or others with access to the 'trusted' computers to which the devices have been connected, according to the security expert who prompted Apple's admission. Users are not notified that the services are running and cannot disable them, Zdziarski said. There is no way for iPhone users to know what computers have previously been granted trusted status via the backup process or block future connections.
If you'd rather watch and listen, Zdziarski has posted a video showing how it's done.
These so-called "smart telephones" aren't telephones at all; they are computers. Computers that you cannot control. And if you aren't, who is?
Some folks thought Richard Stallman was crazy for saying no-one should run software or use hardware that is based on clandestine (proprietary, hidden) knowledge. This latest revelation is just one reason he was right all along.
If you store sensitive stuff on your iPhone, don't make backups from it onto an insecure/unencrypted computer.
And if you were making backups from anything secure onto anything insecure, it is time to revise your security policy.
Almost all the reports are getting the gist of the paper wrong -- any press summation that doesn't go into the paper to understand it will get it wrong. The paper goes into deep detail that Apple has several services that, while protected by several layers of security that could be bypassed, can transfer data in the clear. There are also several services that don't have any obvious connecting software.
It's a rather deep hacker-style dive into iOS.
A good video about this is by TWiT Network. At http://twit.tv/sn465 Security Now ep 465 has expert Steve Gibson explain the actual paper.
--
# Canmephians for a better Linux Kernel
$Stalag99{"URL"}="http://stalag99.net";
When did Apple admit to anything? They said the researcher was wrong and described the settings that he found and what they are used for! I would trust Apple over Google any day! Eric Schmidt has lied so many times along with his colleagues that the whole company isn't trustful!
http://support.apple.com/kb/HT6331
http://www.macrumors.com/2014/07/22/apple-ios-backdoors-support-document/
and yet /. folk cheer on the demise of BlackBerry.. the one phone that has a near flawless security record.
and yes, full disclosure, I own a z10. I also find it to be the best smart phone I've ever owned with battery life that my android friends can only dream about.
Trusted by whom? I don't think there's any requirement that the purchaser of the device trust the "trusted" data extractor. IIUC it could become trusted before the customer ever received the device, or anytime it's in for service.
Step 1: Plug iOS device into a Mac.
Step 2: Unlock iOS device.
Step 3: Click on YES when the iOS device asks if it should trust the computer.
The critical part is Step 2, which you can only perform if you know how to unlock the device. In other words, if you know the passcode. But if you know the passcode, then you can do _anything_ with the phone. That's what the passcode is there for.
So basically, this security "expert" found a way for a thief to enter my home through the backdoor, as long as the thief has the keys for my front door.