Hacker Says iPhone 3GS Encryption Is 'Useless' for Businesses

Hacker Says iPhone 3GS Encryption Is 'Useless' for Businesses

Hacker Says iPhone 3GS Encryption Is 'Useless' for Businesses




"It is kind of like storing all your secret messages right next to the secret decoder ring," said Jonathan Zdziarski, an iPhone developer and a hacker who teaches forensics courses on recovering data from iPhones. "I don't think any of us [developers] have ever seen encryption implemented so poorly before, which is why it's hard to describe why it's such a big threat to security."


But contrary to Apple's claim that the new iPhone 3GS is more enterprise friendly (for reference, see Apple's security overview for iPhone in business [pdf]), the new iPhone 3GS' encryption feature is "broken" when it comes to protecting sensitive information such as credit card numbers and social-security digits, Zdziarski said.



To steal an iPhone's disk image, hackers can use popular jailbreaking tools such as Red Sn0w and Purple Ra1n to install a custom kernel on the phone. Then, the thief can install a Secure Shell (SSH) client to port the iPhone's raw disk image across SSH onto a computer.

To demonstrate the technique, Zdziarski established a screenshare with Wired.com, and he was able to tap into an iPhone 3GS' data with a few easy steps. The encryption did not pose any hindrance.

Nonetheless, professionals using the iPhone for business don't seem to care, or know, about the device's encryption weakness.

"We're seeing growing interest with the release of iPhone 3.0 and the iPhone 3GS due in part to the new hardware encryption and improved security policies," Cook said during Apple's earnings call. "The phone is particularly doing well with small businesses and large organizations."


Several employees of Halton Company, an industrial equipment provider, are using iPhones for work, according to Lance Kidd, former chief information officer of the company. He said the large number of applications available for the iPhone make it worthy of risk-taking.

"Your organization has to be culturally ready to accept a certain degree of risk," Kidd said. "I can say we've secured everything as tight as a button, but that won't be true.... Our culture is such that our general manager is saying, 'I'm willing to take the risk for the value of the applications.'"



"It's like business continuity," Kidd said. "You prepare for disasters. You prepare for if there's an earthquake and the building breaks down, and you prepare for if there's a crack in [information] security."

But Zdziarski stands firm that the iPhone's software versatility isn't worth the risk for use in the workforce. He said sensitive information is bound to appear in e-mails or anything that can be contained on the iPhone's disk, which can be easily extracted by thieves thanks to the new handset's shoddy encryption.

https://www.youtube.com/watch?v=kHdNoKIZUCw Zdziarski said it's up to the app developers to add an extra level of security to their apps because Apple's encryption feature is so poor.

"If they're relying on Apple's security, then their application is going to be terribly insecure," he said. "Apple may be technically correct that [the iPhone 3GS] has an encryption piece in it, but it's entirely useless toward security."

He added that the ability for the iPhone to self-erase itself remotely using Apple's MobileMe service isn't very helpful, either: Any reasonably intelligent criminal would remove the SIM card to prevent the remote-wipe command from coming through. (In a past Wired.com report, Zdziarski said the iPhone's remote-wiping ability pales in comparison to Research In Motion's BlackBerry, which can self-delete automatically after the phone has been inactive on the network for a preset amount of time.)

https://www.youtube.com/watch?v=5wS3AMbXRLs On top of that, the iPhone isn't well protected in general usability, said John Casasanta, founder of iPhone development company Tap Tap Tap. He said though Apple's approval process scans for malicious code, a developer could easily tweak the app to send a user's personal data, such as his contacts list, over the network without his knowing.

"Apple can see if something is blatantly doing something malicious in the approval process, but it wouldn't be very hard to do something behind the scenes," Casasanta said.

Evidently, it isn't difficult to sneak unauthorized content into the App Store. In May, Wired.com reported on an exploit demonstrated by the iPhone app Lyrics. Apple initially rejected the app because it contained profane words, and then Lyrics' developer snuck the profanity into the app with a hidden Easter egg. Apple then approved the application.

Zdziarski added that there are other weaknesses with the iPhone: Pressing the Home button, and even zooming in on a screen, automatically creates a screenshot temporarily stored in the iPhone's memory, which can be accessed later. And then there's the keyboard cache: key strokes logged in a file on the phone, which can contain information such as credit card numbers or confidential messages typed in Safari. Cached keyboard text can be recovered from a device dating back a year or more, Zdziarski said.



"We're going to have to go with the old imperative of 'Trust no one,'" he said. "And unfortunately part of that is, don't trust Apple."

See Also:

Photo: Jon Snyder/Wired.com