Feeds

iOS 4 hardware encryption cracked

‘We don’t want this to fall into the wrong hands’

Secure remote control for conventional and virtual desktops

Russian security outfit ElcomSoft is shipping a toolset that cracks open the hardware encryption protecting iOS4-based iPhones – but it's only for spooks and law enforcement.

In an announcement that will have black-hats working to replicate its results, the company says its tool can “extract all relevant encryption keys from iPhones running iOS 4,” and can also use those keys to “decrypt iPhone file system dumps.”

Vladimir Katalov, ElcomSoft CEO, says the tool breaks “into the heart of iPhone data encryption”.

With access to the device (a prerequisite for ElcomSoft’s technique), the software uses its unique ID and escrow keys (which exist to allow remote devices to sync with the iPhone) to access data.

According to this H Online article, data can only be extracted from an iPhone that’s booted in Device Firmware Upgrade mode, which allows direct copying of data on the Flash drive. This breaks iOS’s protection of the keys themselves, which are not visible to applications running in normal mode.

However, breaking the keys is slow. When files are decrypted, two keys are required – the one generated by the user’s passcode, as well as the key created by iOS Data Protection. H Online said the demonstration given to it required 40 minutes to brute-force a four-digit passcode.

While it might also be feasible to brute-force the escrow key stored on a computer to which the iPhone syncs, that approach has both pros and cons: a PC offers a faster platform for guessing keys, but the escrow key is larger than a typical user’s passcode.

ElcomSoft promises to guard the tool closely, with Katalov saying “we made a firm decision to limit access to this functionality to law enforcement, forensic and intelligence organisations and select government agencies”.

ElcomSoft had already demonstrated password recovery from iPhone 4 devices, last year.

Whether or not you think the police are the ‘right hands’ for this technology probably depends on whether or not you’ve had a device wrongfully seized and presumably data-dumped by a plod suffering a rush of blood to his head. ®

The essential guide to IT transformation

More from The Register

next story
Apple's iWatch? They cannae do it ... they don't have the POWER
Analyst predicts fanbois will have to wait until next year
Barnes & Noble: Swallow a Samsung Nook tablet, please ... pretty please
Novelslab finally on sale with ($199 - $20) price tag
Apple to build WORLD'S BIGGEST iStore in Dubai
It's not the size of your shiny-shiny...
Just in case? Unverified 'supersize me' iPhone 6 pics in sneak leak peek
Is bigger necessarily better for the fruity firm's flagship phone?
Steve Jobs had BETTER BALLS than Atari, says Apple mouse designer
Xerox? Pff, not even in the same league as His Jobsiness
Apple analyst: fruity firm set to shift 75 million iPhones
We'll have some of whatever he's having please
TV transport tech, part 1: From server to sofa at the touch of a button
You won't believe how much goes into today's telly tech
The agony and ecstasy of SteamOS: WHERE ARE MY GAMES?
And yes it does need a fat HDD (or SSD, it's cool with either)
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
BYOD's dark side: Data protection
An endpoint data protection solution that adds value to the user and the organization so it can protect itself from data loss as well as leverage corporate data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?