Off-the-shelf forensics tool slurps iPhone data via iCloud ElcomSoft has updated its mobile forensics software to include the ability to retrieve online backups from Apple iCloud storage. The enhancement to Elcomsoft Phone Password Breaker adds the capability to retrieve user data associated with iPhones from Apple's iCloud online backup service. Backups to multiple devices registered …
Android simply forces you to use Google - a lot of the functions simply do not work without a Google account, so there is a nice audit trail of when you used a function (and possibly where you were at the time as parts of the Streetview WiFi sniffing now is done through Android as well).
With Apple, the iWiretap, sorry, iCloud and iMessage services are at least still optional - it also works if you do NOT want to use because you have such trivial things to worry about like client confidentiality (the bit they never mention about gov santioned intercept is that YOU still get to hold the can if any of that data leaks).
Also, Apple isn't really in the business of grabbing/stealing and sucking as much data from users as they can get away with (and even NOT get away with as long as they don't get caught) - that's Google's business model. Apple sells mainly kit and an ecosystem to go with it..
This post has been deleted by its author
Although that might not work if the user uses the 2 step Google authentication process. My Android phone had to be set up with an application specific password so that it could access my Google account, which could only be generated in my Google account, which requires the authenticator to access.
Although I don't know enough about how Google 2 step process works so there might be some flaws that could be used.
Maybe... I don't understand Google's 2-step authentication very well (specifically how it handles those application specific passwords, how do they know it's the same device/app?)
But that's another thing I never understood either, Google has complete control of the whole stack, so why can't they implement their own 2-factor authentication for Android?
The whole two factor thing with Google is a bit of a useless tech if you're only using it to stop strange logins from remote places, it will likely not someone close to you.... and nothing local. I can view the first few characters of a text message without even unlocking my One X, so I can see the entire code without needing to unlock the phone. Though, obviously they would know someone has requested an access (though, might dismiss it as someone remotely, not locally)
I'd really prefer a native Android client, if I was honest. I'm sure a native client could read the text message anyway, and take it away from the standard messaging interface making a login to the phone required to actually see the code.
I bought one the other day. To my surprise. Impulse perhaps; it was on offer. I still have my very old Symbian phone because I don't yet feel very impressed. However, Apple, who'd have thunk that people would buy a phone on which you can only store music/etcetera if you first send it to Apple's cloud, and that Apple would equip people with the means to snoop on users? There again, who'd have thought that Apple's computers/grope pads are now very insecure, as insecure as MS products in the 1990s. (Rhetorical Q, so please don't answer the musings of a man who will never buy Apple!)
I'm guessing that this isn't just read-only access that is achieved.
If this is the case then how trivial would it be for a bent copper (they do exist you know) to put a bit of incriminating info on the records of the suspected perp?
Surely this would eventually undermine evidencial(sp?) integrity when it comes to court? Especially if this software gets out into the wild.
That won't work.
The 'backup' copy will not match the live data almost immediately after the backup has occured. All it takes is the sending or receiving of 1 email (or any action that changes the data) to make them (and their MD5 checksums) different. Somebody could easily claim that the reason you don;t have a copy of the 'pedo' image they 'found' in your backup, on your phone is that you deleted it. How would you prove otherwise.
The only way this could be used as evidence is if Apple keep archived/read-only copies of the uploads - which I doubt they do.
Sir,
As allegedly bent copper, your (allegedly lazy/out of touch/chip on shoulder/Tory (add or delete as appropropriate)) Honour, I think he should get life for possessing an underage computer thing...
I agree, Your Honor, snipples in Barrister Dandus-Doublus-Names-Oxfordus (who being totally ignorant of the webby has used a journalist as his expertus witessus)..
as much as i dislike apple fanbois, falsifying or 'forgeting' evidence will happen - just read the Appeals Hearing that will be issued today about a murder case where the 24 yo was bailed yesterday after years in prison...
its getting too easy to set people up...
Signed
The Paranopid Perspective
That's the problem with any of the RATs (remote access technologies) such as Trojans used by Law Enforcement. They all so far seem to have the 'plant a file' capability. As one of the last things that a RAT does is delete all traces that it was ever there, and as actual use of RATs are rather covert - one can see a fairly humongous loophole looming! There's to my untrained legal mind a large whiff of 'doubt' creeping into the world of f'rensics based on the rampant use of surveillance technology
yet again a brilliant technical idea, that is easy to install on Win/Mac, but who's holistic impact might not have been actually sociologically studied. How many sociologists live in Cheltenham?
thats what we want to know and we want to know now! /rant
Unless you don't have an iPhone, of course :-)
I think Apple should provide some way of encrypting the file (with a separate password) before it is uploaded - then store it as an encrypted file in iCloud. Being able to get at this data just knowing the apple logon is a bit poor - and I expect lots of phishing e-mails to result from this news.
Whilst not an i-phone user this weakness means that somebody may be able to get at information about me (and e-mails sent by/to me) on OTHER peoples i-phones - so it does affect me too.....sort it out apple.
> Being able to get at this data just knowing the apple logon is a bit poor
No. you need the login details AND you need to buy this expensive software which cracks the encryption using GPUs etc.
It's not suitable for mass usage like the phishing scenario you propose.
iCloud backups are encrypted anyways - http://support.apple.com/kb/HT4865
But if a dude manages to get hold of your User ID and password, your data is obtainable, as you might expect. Just like in a million other walks of life.
If that in itself worries you, and you have particularly sensitive stuff on your OS device, don't back it up to iCloud. You do have a choice.
"iPhones automatically connect to iCloud network and backup their content every time a docked device gets within reach of a Wi-Fi access point"
No they don't, in order to backup to iCloud, your device must be on a charger, on wifi, with the screen locked and off.
I know, because my wifi is being a bit flakey with devices going into power save, and my iphone keeps telling me it hasn't backed up to iCloud in N weeks, and under what circumstances it will backup to iCloud.
Exactly! How is this an article? If I can get your username and password I can get at your stuff. In other news, the Pope has been outed as a Catholic and scientists have discovered that bears sh*t in the woods.
Somebody suggested having encryption, with a separate password, as a solution. Trouble is that this is open to the same ingenious attack vector. If I have your encryption pass phrase I can unencrypt your data - we're all doomed.
If you consider the implications this is news because once they have access to your iCloud backup they can access a complete backup on the phone in your pocket.
Now since the phone backs up whever it finds a wifi network it can use if you're wandering close to somewhere with public wifi (most city centers) then they have close to real time access to call logs and text messages. All completely unknown to the "perp" / target.
"Can Burglariser really unlock any dwelling?"
"Yes, by simply utilising a dwellings access key that you have previously obtained, Burglariser will give you free reign to the contents of that dwelling. If you do not have an access key don't fret, they are very easy to locate, there is generally one hanging on a key hook inside the dwelling or you could simply use social engineering to recover the key, threatening the homeowner with a beating for example"
This is what happens if you stick all your stuff in one box, and you neither own the place nor have control of it.
You might as well ask a stranger who "appears the honest type" to look after your house keys.
I don't use iCloud myself anyway. Not just because of trust, but because I find it completely confusing; it does what with what? Sends it where? When? What???
The first and only time I tried to activate Backup via iCloud is proceeded to try and upload 6GB photos from my iPhone...before anything else. Obviously my photos are more important than my contacts and settings. Maybe I was doing it wrong, but asking Siri yielded no answers...
"With a valid Apple ID and a password, investigators can not only retrieve backups to seized devices, but access that information in real-time while the phone is still in the hands of a suspect."
If the phone is in the hands of a suspect it's not exactly sized is it ?
That said you could size their laptop "forget" about the iphone (knowing they use iCloud) and then you can extract and crack the password from the laptop itunes, access the iCloud backup and then tap into their calls & texts without ever touching the iphone.... genious !
I would hope that needs a warrant though.
Finally in any other circles this would be treated as an outragous hack and backdoor into your backed up data. But since it's only available to "security & law enforcement services" it's ok then ?
Law enforcement agencies do have access to email providers like hotmail, gmail etc. Google has a transparency list showing the number of requests per country. Typically 4-5 digit numbers with a 30% growth rate. Of course they have access to live phone calls as well. So what should prevent them from accessing the backups in the iCloud directly?
So such a tool is more of interest to groups which have no legal right to access the data. Among the data are certificates and keys. This is an attack vector for industrial espionage. Thinking about the use in parliaments this is also useful for classical espionage.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
