Cracking software retrieves iPhone 4 passwords A Russian password-cracking company has released software it says can recover passwords stored on Apple's latest iPhone without modifying the device or any of the data stored on it. ElcomSoft of Moscow says the latest version of its iPhone Password Breaker will recover the encrypted keychains that the iPhone 4 uses to store …
... I'll leave the choice of which one fits your post best as an exercise for the reader.
Here, have some clue: iPhone backups are encrypted using AES128 encryption with a 256-bit key. This is an industry standard even the *US Government* uses for securing secret data.
The Elcomsoft application discussed in the article doesn't actually run on the iPhone: it's a *Windows* app. And note that they tout its GPU acceleration as a key selling point.
Yes, it'll run the usual cracking techniques, so the dictionary scan element will find a weak password in minutes. BUT... if you're using a strong, complex passcode or pass-phrase, even with their GPU acceleration, you're still going to be looking at a cracking time measured in hours, or, for seriously secure pass-phrases, days!
Why do you think they offer scalable versions of their tools designed to run on as many as *ten thousand* GPU-accelerated machines?
From the average smartphone luser, yeah right! How many even changed if from the default password do you think? And how many have a 14 digit-or-greater password as it's got to be that long before it takes any longer than a patient all nighter with a creaky old laptop (it's fun working with pen testers) to break.
IIRC Apple's device "security" has been described as worse than useless and as they get as big a MS this will start to hurt them.
Unless ElcomSoft have changed their software significantly, its approach to cracking the actual backup password (the 'iPhone Password Breaker') seemed to be that of a brute force attack (with a few attempts at shortcuts). This new feature just seems to then go on to decrypt the data that represents the on-device keychain (NB. 1Password uses its own data store. Though we have no real way of knowing if it's any more secure.)
My understanding of iPhone/iPod touch backups is this: If you apply a password to the backup of the phone (in iTunes, it's an option when the phone is plugged in) then this is used to encrypt the phone's in-built key (the one that is actually used for the encryption.) Further, the device does the encryption of the data on the way out when being backed up, and it only provides the key encrypted with the user's password from thereon (which is why you can't remove a password once you've set one, without wiping the phone with a full restore.)
I suspect, if you have a copy of the key on disk from before you set a backup password - e.g. in an earlier backup (from a restore point, or via TimeMachine maybe), then it's straightforward for ElcomSoft's 'iPhone Password Breaker' to decrypt your backup. Otherwise it has to crack it the hard way (still not too hard if you used a dictionary password or something a few "st3p5" away.)
None of this prevents just copying the data out of the device directly, per previous reports, if you actually have access to it (perhaps they've fixed that with iOS 4, and/or iPhone 4. There haven't been any attention-grabbing reports about it yet.)
Can any one corroborate, expand, or correct?
Elcomsoft's software runs on a Mac or Windows box which has *backed-up* the iOS 4 keychain, rather than running anything on the iPhone itself. Apple could trivially change the encryption method used by updating iTunes, forcing Elcomsoft to modify their application, but it's a losing battle.
All any security system today does is make access *harder*. It cannot make it *impossible*, however: with enough power and brute force, pretty much any security system can be cracked, be it real or virtual. The trick is to raise the barriers so high, potential thieves simply won't bother trying. But you can never reduce the threat to zero.
Elcomsoft's other tools include PDF password crackers, internet password crackers, etc. They all use the same brute force algorithms though. Crackers have been using such techniques for ages, so this isn't new in itself. The GPU acceleration is Elcomsoft's primary selling point. It speeds up the process somewhat. Insecure passwords will usually be discovered within minutes, but a particularly complex passcode or pass-phrase can still take a very long time to hack. Many hours—even days—are not unheard of.
Smartphones generally don't lend themselves to complex pass-phrases and tricky passwords with symbols and numbers as well as letters, simply because most people find them difficult to type. The iPhone is no exception, so Elcomsoft's software should be no surprise to anybody. I don't know if Android phones have a similar "backup" feature, but if they do, expect a similar application for that to appear soon.
(Before anyone asks, Elcomsoft's cracking tools are only available for—drum-roll please!—Windows!)
Can you clarify why it matters which OS runs the cracking software? Surely the whole point is that the passwords can be retrieved from the backups of the phone? Certainly it doesn't matter to me that I could (I don't know if you still can) recover Windows passwords from the SAM files using linux or Windows apps, what matters was that they could be recovered.
The issue here is one of securing the backup files, regardless of which OS you backup to. Also that it still keeps the iPhone out of the reach of serious business or Government, still leaving the Blackberry as the only secure option.
What started with Jobs sort of admission that not all was well with Lemon 4, his 'Mensis Horribilis' (horrible month) just got extended. He has no one but himself to blame as his arrogant high and mighty attitude is just right to incite people to take him down a notch or two (or 4).
He is learning that notwithstanding his glorious blue anechoic rooms and his talented engineers that he hasn't a monopoly on infallibility.
And if Jobs thinks it can't get any worse, just wait!
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
