Iphone encryption 'broken'
AN INSECURITY EXPERT has warned that the Iphone's built-in encryption software, which has helped to make the posy device so popular with businesses, is about as useful as a chocolate teapot.
"I don't think any of us have ever seen encryption implemented so poorly before," Iphone developer and data recovery expert Jonathan Zdziarski told Wired.
Zdziarski reckons the encryption feature on the Iphone 3GS is simply "broken" and makes it easier to extract personal data from an Iphone 3GS than it was to obtain from its two predecessors which had no encryption utility.
Live data can be extracted in two minutes from a 3GS, and a full disk image can be transferred to a PC within about 45 minutes by installing a custom kernel on the phone using readily downloadable tools such as Purple Ra1n or Red Sn0w.
The remote kill feature can be circumvented simply by removing the SIM card to prevent the signal from being received.
The news will probably come as a shock to the many businesses that have been seduced into buying the pretty toy thinking it was safe for corporate applications.
When Apple's upbeat results were announced last Tuesday, Apple's chief operating officer, Tim Cook, was bragging that millions of Iphones have been bought by Fortune 100 companies, US Government departments and universities.
Perhaps they would like to form an orderly queue outside One Infinite Loop to ask for their money back. µ
Share this:
ShareBusiness Intelligence Software
Customer Relationship Management (CRM)
Enterprise Accounting Software
Enterprise Resource Planning (ERP)
Enterprise Systems Management
is this with PIN locked devices, in which case the article is valid, or ones without a PIN lock, in which case its a non story
If the iPhone's built-in encryption software really is insecure, that will be a Diziarski.
the inq articles are just not interesting anymore, i used to read almost all of them - now i cherry picked 6 of the current 45 and am still left disappointed by those - it's like a rock band on their 7th album who've just run out of steam
I'm saddened
It's not broken, you idiots, it's just really, really cool.
Now stop being jealous just because I have one and you don't (Mmmmmm, my iPhone is sooooooo lovely).
If you could afford one too then you wouldn't be bashing it with nonsense like this.
I think you wouldn't find much cash left on the bank account of people who spend that much money on telephones that become obsolete in a couple of months.
Therefore I wonder who'd be interested in sniffing the personal data of a typical iPhone owner. Too much trouble for nothing.
It's better to just steal the phone and try to sell it by, say, half the price of a new one. It's still a lot of money.
... more and more defects keep coming to light about this device... overheating, wifi issues, weak encryption, etc.
Apple sure needs to clean up their act if they hope to compete with RIM for corporate business.
I’m super confused. Doesn’t Jailbreaking require a restore of the iPhone and cannot be done using the “Upgrade” feature? Would that not WIPE the iPhone in the process? How exactly can you jailbreak a phone without getting at its data, and you cannot "back up" a PIN locked phone to iTunes. It will not allow it until you enter the unlock code.
Until they clarify this in their article (Wired) this is a non-issue. ANY device which you can access and replace the Kernel with a modified one can be opened to hacking. The question is whether you can replace the Kernel without wiping it clean first....
I posted this in the comments there and am awaiting clarification.
I found that with Firmware 2.0.x and QuikPwn you could jailbreak without a restore. Although I have seen no mention of this in a LONG time and see no such capability (yet) for 3.0 and the 3Gs. Still awaiting clarification...
Okay, I watched the video, and saw how it is being done. What is not clear is whether what he did resets the local data store. It would have been clearer if the narrator snapped the picture BEFORE removing the code…
The method does not require to you to wipe the device and a passcode offers no protection. It was demonstrated on a 3G or 3GS phone. The big news really is that it's trivial to get the iPhone to send its own disk image over USB after decrypting it for you. Oops.
You know... A funny thing comes to mind. When did we EVER hear of a security bug with ANY of the WinMo based phones or PDAs? I literally have no recollection of such an event.
Looks like the Jobian masses better start eating their humble pie...
Sad a RIM shill has to be the one, well he sure is worried if the blackberries don't sell well and if that happened he is out of a job. Pathetic..