iPhone's PIN-Based Security Transparent To Ubuntu 264
ndogg writes "Security experts found that the iPhone 3GS has very little security, even with a PIN set up. They plugged one into Ubuntu 10.04, and it was automounted with almost all of the iPhone's data exposed. This has been reported to Apple, but the company seems to be having difficulty reproducing the problem."
Sounds like a feature (Score:5, Insightful)
Re:Sounds like a feature (Score:5, Funny)
Re:Sounds like a feature (Score:5, Informative)
They're not a block device, so you can't mount their filesystem as such. Instead, they're effectively network drives: the proprietary AFC file transfer protocol tunneled over a hugely mutilated version of TCP stuffed into USB packets. Which you can mount under Linux, using FUSE and the appropriate apps (usbmuxd, libimobiledevice, and ifuse). I maintain usbmuxd.
Apparently Apple relies on security through obscurity here (only their apps are usually able to talk to an iDevice), and the actual protocols aren't secured.
Incidentally, this is where the term "jailbreaking" comes from: breaking out of the AFC filesystem jail (which is usually limited to the user's data partition). Jailbreaking's original feature was to introduce a secondary AFC share with root privileges on the root directory, and jailbreaks to this day still do. You can use ifuse --root under Linux to mount this secondary share.
Re:Sounds like a feature (Score:5, Interesting)
Which you can mount under Linux, using FUSE and the appropriate apps (usbmuxd, libimobiledevice, and ifuse). I maintain usbmuxd.
In fact, when you plug an iPhone into a Mac, you can see in the process list that usbmuxd is what Mac OS is using to talk to the device.
Re:Sounds like a feature (Score:5, Informative)
Correct. I wrote most of the usbmuxd implementation that we use on Linux as a clone of Apple's version. In fact, you should (as of yesterday) be able to compile libusbmuxd and libimobiledevice and maybe even ifuse (with macFUSE?) and use them together with Apple's usbmuxd on OSX to pull off this hack there. Heck, I think at least libusbmuxd and libimobiledevice should even build on Windows these days (Apple provides a Windows version of usbmuxd with iTunes).
Re:Sounds like a feature (Score:5, Interesting)
Either they simply didn't feel the need to make the PIN actually do much more than lock the screen(arguably fairly misleading), or next to no testing was done, or (even worse), setting the PIN also sets some sort of "politely ignore the data you could easily access" flag, that iTunes obeys and the third-party implementations don't.
Re: (Score:2)
or (even worse), setting the PIN also sets some sort of "politely ignore the data you could easily access" flag, that iTunes obeys and the third-party implementations don't.
This would be my guess.
I suppose Apple didn't expect to see a third party implementation developed, so they took the cheapo obscurity route. They should probably quit betting against hackers, especially if they want fascist control of "their" devices... That just gives people incentive.
Re: (Score:3)
Even if plugged into a mac or PC running iTunes, the data should be equally accessible.
What do other phones do? Connect a blackberry to a PC with blackberry desktop for example..
Does iTunes ask for the PIN each time it syncs an PIN locked iPhone? I must be missing something.
Does this trick allow use of the SIM card without entering its PIN? Could someone who has both phones elaborate?
I don't ever remember having to enter a PIN to pair a blackberry other than the random one for pairing bluetooth devices which is responsible only for encrypting the wireless transmission.
I know "access data l
Re: (Score:3, Informative)
Can't speak to Blackberries and such, but on my Symbian-based phone (Samsung i8510) if I connect it to USB while it's PIN-locked all it does is recharge. I did this on my work PC while watching /var/log/dmesg and all it registered was a USB HUB being connected. No access to the phone memory at all. After I entered the PIN, the phone's internal storage and the SD card I have in were suddenly available.
Of course, if you have physical access to my phone you can pull out the SD card, which doesn't have any prot
Re: (Score:3, Funny)
The "S" stands for "crappy failed security-through-obscurity DRM that absolutely no one actually uses in the real world". It has nothing to do with actual security.
Re:Sounds like a feature (Score:5, Informative)
OK, upon further testing (I don't use a passcode myself so I never even looked into this) and getting some information from others, it looks like this isn't a total oversight on Apple's part, but it is a real bug that requires a specific sequence to trigger.
Here's how it's supposed to work:
The actual bug is that there's a race condition during boot. There's a window during which the lock code setting hasn't been read, during which the phone will accept pairing requests even though it shouldn't.
If you want to try it on Linux, do this:
Notice how the "slide to unlock" SpringBoard screen will not have yet appeared when this works. Once it does, the passcode has been configured and pairing will no longer work. On the latest version of ubuntu it tries to automount as soon as it sees the device, which makes this bug a lot more obvious.
Re:Sounds like a feature (Score:4, Interesting)
I just want to say thanks for all your work. This was a big thing in getting the last windows pc in my house to linux.
Re: (Score:2)
When I tried to plug my iPhone in under Ubuntu 9.10, it caused a kernel panic. I suspected that may have been intentional on Apple's part.
Re: (Score:2)
Re: (Score:2)
I think the problem is that the data is supposed to be protected. Sounds like you engage protection on the phone, but it doesn't actually protect the data. Now contrast this to a Blackberry, which uses strong encryption to protect its data when engaged. You can also directly mount a BB, but you can't get the data if the encryption is turned on (you can if it is off which is default).
This is a worry if your phone has some confidential information. You rely on putting protection on it, in case it gets stolen.
Re:Sounds like a feature (Score:5, Informative)
The iPhone 3GS supposedly uses whole-disk encryption. This does squat when your USB comms protocol doesn't request authentication though, since you can pull the data off through the iPhone kernel's transparent decryption layer.
In other words, this hack has nothing to do with encryption and everything to do with an insecure protocol that makes no attempt to actually request PIN authentication before handing over all your data. Nobody expected your PIN to actually act as key for encryption anyway; that's impossible, as the iPhone has to be able to access your data even while locked.
Re: (Score:2)
I don't think the PIN has anything to do with this. The PIN probably just locks the UI in the phone. That would be like pulling a hard drive out of one computer and adding to another and expecting the usernames and passwords to still work. You'll be able to mount the drive and access every part of the file system because the OS that governs access to that filesystem is not running. The drive is just being viewed by another computer.
If the filesystem was encrypted, I imagine you'd could still mount the d
Re: (Score:2)
If the _filesystem_ is encrypted, then you can't mount it without the key. If the files are encrypted, then you can't make sense of their contents without the key(s).
Re:Sounds like a feature (Score:5, Informative)
The filesystem IS encrypted, but the OS happily decrypts everything for you without any form of authentication. That's the story here.
Re: (Score:3, Interesting)
And it always will. The purpose of the encryption is to allow remote-wipe (and even local-wipe, I suppose) to be nearly instantaneous. Wipe the key, and the data is unreadable, as opposed to having to spend time wiping the entire contents of the flash memory.
The encryption isn't meant to be used day-to-day. It's meant to be transparent until you need to destroy your data.
Re: (Score:2)
On many phones the PIN or keycode just unlocks the keypad, or in a touchscreen's case the UI. This does diddly to stop the USB connected phone's memory from being used as a storage device.
The primary function of the "security" code here is to keep you from butt/pocket/purse dialing unintenationally. The Security code is not to lock down the confidential info on the phone and keep folks from copying all your data.
Re: (Score:2, Informative)
No, the keylock with a well known generic opening mechanism is what protects against pocket dialing. In the iphone case I believe that's implemented as a finger slide. The additional PIN code is obviously there to prevent people from using your phone or seeing your data -- and it failed.
Re: (Score:2)
And honestly, how long would it take a computer to bruteforce a 4-digit numeric password???
Re:Sounds like a feature (Score:4, Funny)
And honestly, how long would it take a computer to bruteforce a 4-digit numeric password???
Forever! There must be like a million possible combinations!
Re:Sounds like a feature (Score:5, Funny)
This does squat when your USB comms protocol doesn't request authentication though, since you can pull the data off through the iPhone kernel's transparent decryption layer.
It just works ... even when it shouldn't.
Re: (Score:3, Informative)
Sorry but no. The encryption is enabled on all 3GS phones (and only 3GS, not 3G or prior) full time and can not be disabled.
The 3GS *has* functional security except for the number of holes that have been poked in it.
I don't know what rep you're talking to but he's misinformed and would otherwise be totally in violation of Apple's disclosure policy which reads something like 'if you tell anyone before Jobs does you're fired on the spot'.
We too are doing testing @ work but all the holes that hackers keep pok
Re:Sounds like a feature (Score:5, Funny)
Breaking into an Apple device: "it just works."
Re: (Score:2)
And when it was a music player that was a resonable argument to make. Why should you not have an easy way to copy files to a and from it. The data is not unique or personal.. I would still make the argument they should be mountable and apparently Apple agrees. What I find entertaing is that they don't have some sort of encrypted storage; where apps can write possibly private info into. A registry or something that is protected; even in the volume itself is open.
Re: (Score:2)
Seems not to do this on my older iPhone 3G.
All it sees is the camera via digicam.
So he either has some additional libraries on his Ubuntu or some hack-ness on his phone, or this bug was introduced on the 3Gs model.
Re: (Score:2)
Ubuntu 10.04 has newer libraries. Also make sure you're connecting the phone then turning it on.
Re: (Score:2)
You don't understand. It's a problem because can't say it is a "Walled Garden", they now will have to say "It's a walled garden. Unless you use open tools. Then it's kind of open. But Now we want better tools to do with it as we please, and Apple doesn't seem to be developing these on their dime and giving them away for free. Curses!"
Re: (Score:2)
The argument has been apple doesn't support it, and tries to obufscate the data.
There are several 3rd party tools that allow you to move data onto and off of iPods. I assume the same thing with the iPhone.
Re:Sounds like a feature (Score:4, Informative)
I read through both linked articles and it comes down to only this data is exposed:
This data protection flaw exposes music, photos, videos, podcasts, voice recordings, Google safe browsing database, game contents
Certainly not all of the data on the phone. Your e-mails, notes, application-specific data, address book, password keychain, and so on are still safely encrypted. Yes, this isn't a perfect situation but it's not as dire as it sounds. Most data that people expect to be secure is still secure.
Who says... (Score:2)
Re:Who says... (Score:4, Informative)
Apparently it's so hard to use that they can't even reproduce it at Apple.
Re: (Score:3, Informative)
Re: (Score:3, Interesting)
That joke is getting a bit old, with Apple selling 4-button mice with every iMac for 5 years now.
Nah. It's still good for many of us :) And besides, Apple can't quite get away from the one-button meme -- even with their multiple button mice, they try and hide the different buttons under one big button. (Something which I would have thought was the single worst interface design decision ever, incidentally ...)
Anyway, I'm not sure what's the big deal about being able to read a small portion of the iPhone drive in Ubuntu -- you still can't access any application data or any of the databases that store y
Re:Who says... (Score:4, Funny)
The i in "iMac" does not stand for the square root of minus one.
All Macs are in the real set.
Re: (Score:2)
Re: (Score:2)
Who says... Linux is hard to use?
Lots of people do, they're wrong of course, but somehow that doesn't seem to stop them from saying it.
Updated story (Score:5, Informative)
Re: (Score:2)
Shouldn't it just be a matter of requiring the user to allow the mount of the iPhone side? That is, I believe, how Android handles the problem. Nothing can be mounted until the user tells the phone to allow it, which must be done from the home screen, which cannot be accessed without the sign in pattern. Unless that is how it is supposed to work but for whatever reason isn't happening on Lucid Lynx?
Re: (Score:2)
From TFA Apple could reproduce the described serious issue and believes to understand why this can happen but cannot provide timing or further details on the release of a fix.
Who said it needs 'fixed'?
Apple can now reproduce (Score:5, Informative)
Re:Apple can now reproduce (Score:4, Informative)
Attention Naysayers (Score:2)
Let us Ubuntu fanboiz have a moment to gloat before trashing our OS as a whole.
Thanks.
Re:Attention Naysayers (Score:5, Funny)
You two have fun with that.
Re: (Score:3, Funny)
Re: (Score:2)
This is not Apple's problem. (Score:5, Funny)
Re: (Score:2)
It's the user's problem, because an attacker won't feel any particular compulsion to be bound by Apple's intents and guidelines.
It's Apple's problem if they want their users to trust that Apple has their best interests in mind.
Re: (Score:2)
Hardly.
I'm just feeding the troll.
Apple vs Linux (Score:2, Funny)
And? (Score:5, Insightful)
Will their fix consist of actually making the device more secure or will they just try to make it harder use it with Linux systems?
iTunes (Score:2)
Wait a sec... if I plug in my phone, iTunes automatically makes a backup of everything on it.
This backup doesn't require a PIN either!
PIN != content access control (Score:4, Insightful)
The GSM standard defines a PIN as an access number for your SIM card. It has nothing to do with your phone's contents. Most phones allow you to set up a security key, which is needed either to turn on the phone every time (even if you have your SIM set up not to need a PIN), or when you change the SIM.
I don't know if this is actually the same PIN defined by the GSM standard or if it's another, Apple-specific key; but when you're talking about phones, PIN is connected to the SIM, or to the phone line, not to the phone contents.
Re: (Score:3, Insightful)
So, they're not talking about the PIN in the meaning you expect when discussing phones, but about a security code that has no connection with the GSM PIN. Or, in other words, you don't have to use that key when you put your iPhone's SIM in another phone.
Why can't people keep consistency? Calling a security code "PIN" when discussing cell phones is like calling a DVD "hard disc". It's not technically wrong (it's a "personal identification number", or a hard, disc-shaped object), but the word has a completely
Re: (Score:3, Funny)
I expected more from Slashdot. Yeah, I know, I must be new here.
Attempted to duplicate - not quite what they say (Score:5, Informative)
I plugged my iPhone 3GS into my Ubuntu box. While it's true that Ubuntu did automount the iPhone, the only thing I can find that was exposed was my music, photos and podcasts.
I wasn't able to access email, contact info, or anything else on the phone. I did see the Application Archives, PublicStaging, Purchases, and Safari folders but they're empty. I have lots of email and contact info on the device - but it appears to be inaccessible via this method.
Re:Attempted to duplicate - not quite what they sa (Score:2)
...and these things need to be accessible without PIN for compatibility with third party devices. Sounds like Apple just needs to clarify that iPod functions are not encrypted... or offer an option to encrypt them.
Wonder if remote wipe kills this content as well?
Re:Attempted to duplicate - not quite what they sa (Score:4, Informative)
Read the advisory more carefully. You need to turn off your phone, connect it, then boot the phone while it's connected to the Lucid box.
The security check is bypassed at boot, probably assuming the phone needed to be recovered.
Still a great thing (Score:2)
If it exposes your media, like the older iPods did, that's a great thing in its own right.
Apple has become a parody of itself. (Score:2)
This is just too funny.
The latest release of iTunes crashes in my XP VM.
The latest Ubuntu can read an iPhone like a regular iPod again.
So my Ubuntu VM is a better environment for dealing with my iPhone than my XP VM is.
What a hoot.
Re: (Score:2)
You probably want to try to diagnose your XP iTunes problem (it works fine when properly setup - I'm using it without issue).
The latest version of Ubuntu kinda sorta works with the iPod. If you like manually dragging and dropping files to and from the device then it works OK. If you want true syncing capability (rather than manual), or to manage apps on the device, then Windows still works better.
I'm fully expecting to move to a Droid phone within a few months though which should allow me to move over eve
Better not fix it. (Score:2)
Not being able to talk with Linux is one of the things that has kept me off iPods for years. I finally liked the features of the iPod touch and buckled, and used it in Virtualbox under windows/iTunes (so I didn't have to jailbreak it).
Now, finally, Rhythmbox can seamlessly put music on my iPod. If they take that functionality away, then that oft-publicized letter that Jobs put forth touting open standards as an excuse for not supporting Flash is going to be exposed as pure and utter hogwash.
Two kinds of "fix" (Score:2)
There's "fix" as in completely remove the functionality, and "fix" as in allow the proper mounting after the PIN is supplied.
Re: (Score:3, Informative)
There have been Linux tools for getting music on and off the iPod since about a week after the first iPod came out.
Yeah, Apple doesn't support it, but so what?
Bad Bad Apple (Score:2)
Seriously, they don't encrypt the content of an iPhone by default? I mean, it's not the default on Blackberry, but it's there and Blackberry have been around for a long time. When making a new device, why not build encryption into the filesystem? Apple has all the components already from their desktop and it can't suck that much battery. Now Apple is offering encryption just for e-mail? Really, that isn't good enough. And while I'm at it, Google what's up with you doing the same bloody thing? Come on guys.
Re: (Score:2)
It's encrypted - but the communication protocol is decrypting it for you.
Already fixed in iPhone OS 4.0 (Score:5, Interesting)
Ya, one of the new features in iPhone OS 4.0 is "Data Protection". Specified files for applications are on the fly encrypted and decrypted. The phone has to be unlocked (valid pin entered) to access the data.
Seems like they already handled this issue, unless someone wants to test that on an iPhone with 4.0 running on it...
Re: (Score:2)
Indeed I just tried with my phone running 4.0 beta4 locked, and nothing mounted, then I unlocked it and retried and it automounted like a block device.
Old news ... (Score:3, Insightful)
Yes, you can get the raw data off without a PIN.
The original phones up until the 3Gs didn't encryption the data.
The 3GS and presumable 4.0 phones encrypted the data using a key that isnt (in theory) directly accessable to anyone outside the phone os and more specifically hardware.
So yes, there have been many ways to get data off 2g and 3g devices. 3Gs and 4.0 devices work in a different way so short of ripping apart a chip to get the key, the best you'll get is an encrypted memory dump which is more or less worthless unless you can get the key out of the hardware.
On older phones with newer OSes a remove wipe destroys the key. Updated versions of the software first destroy the key, then proceed to overwrite the encrypted data itself to make it useless even if you obtained the key somewhere else.
Basically, Apple realized this was studip 2 revisions of the hardware back and has such fixed the issue.
When you unlock the phone, you effectively add the key to the file system keystore so it can decrypt the files.
if you unlock your phone, you have ... unlocked your phone. Whats the difficulty in understanding this?
From Iphone3G API documentation... (Score:3, Insightful)
You can't blame Apple for Ubuntu mis-implementing the API and skipping a step described as mandatory.
From Iphone3G API documentation...
7.4 Mounting the phone filesystem over USB
(...)
User authentication must be assured to mount encrypted filesystem. A call to validatePIN() method is a mandatory step before attempting to acquire the system key and mounting the filesystem. A typical scenario of mounting the filesystem goes like this:
IphoneSecurity& sec = Iphone::Security();
IphoneSecurity::EncKey key = NULL;
IphoneIO::Partition mp = NULL;
if(sec.validatePIN() == true) //error handling
{
key = sec.getEncKey();
mp = sec.mount(device,mountpoint,options,key);
}
else
{
}
it's a spoof, dummies
Re: (Score:2, Informative)
Re: (Score:2)
All of its storage is flash memory soldered to the logic board. There is no way to remove the storage.
Except with a soldering iron. And I imagine it's fairly standard flash memory at that.
Or am I missing something? Would doing that wipe the flash?
Re: (Score:2, Funny)
Would doing that wipe the flash?
It will if you use the Apple-standard soldering iron. Anything else is unsupported.
Re: (Score:2)
Indeed, and the next update will cause the entire unit to melt if mods are not done with the iSolderingIron.
Re: (Score:2)
It is standard flash memory. Desoldering and reading the data is not hard at all.
I think making sense of the raw data is more of a challenge than then desoldering and reading.
Re: (Score:2)
Give me a solder sucker, a USB keydrive with a compatible flash chip controller, and I'll have it removed. Just because it's soldered on doesn't mean it's impossible to transfer the flash to something else, plug it in, and read it.
Re: (Score:2)
No safe, practical way. You can always cut it out, but soldering it back in may present issues.
Re: (Score:2)
You could use a heat gun, a reflow oven, hell a soldering iron and a solder sucker. Removing chips is not rocket surgery.
Re: (Score:2)
Depending on exactly how bad-block information and the like are stored, they may run into some trouble there; but only proper data encryption would actually stop them.
Re: (Score:2)
rocket surgeons? Do they operate on explosives or fuel?
Re: (Score:2, Funny)
You misunderstand, rocket surgeons operate with explosives..
Re: (Score:2)
In your magic land the heat gun has not been invented yet?
Re: (Score:2, Flamebait)
Re:Hard drive (Score:4, Informative)
Re:Hard drive (Score:5, Informative)
Here you have gone from saying there is no way to remove the storage (+5 Informative, haha), to saying there is a viable way to remove the storage. Kudos to you, sir. Now, where's my +5 Informative?
Re: (Score:2)
Hey, 1 2 3 4 might be obvious to you, but it wasn't for me!
Re: (Score:3, Funny)
That's amazing, I have the same combination on my luggage!
Re: (Score:2)
[citation needed]
So this is one of those "Hey, that's the combination on my luggage" things?
Re: (Score:2)
If you try three wrong PINs, your SIM card is locked; so probably they don't do this. Unless, of course, people are using PIN for something entirely different from what PIN means when discussing GSM phones.
Re:Physical Access = Root Access (Score:4, Informative)
RTFA.. (Score:5, Informative)
From Apple:
Apple iPhone Security Overview [1]:
Data Protection:
Protecting data stored on iPhone is important for any environment with a high level of sensitive corporate or customer information. In addition to encrypting data in trans-mission, iPhone 3GS provides hardware encryption for data stored on the device.
Encryption:
iPhone 3GS offers hardware-based encryption. iPhone 3GS hardware encryption uses AES 256 bit encoding to protect all data on the device. Encryption is always enabled, and cannot be disabled by users.
Re: (Score:3, Interesting)
Security by friendliness?
Re:Wow. (Score:5, Funny)
I think that this is just ridiculous and just more evidence that Linux users are nothing but criminals and thieves and open source should just be outlawed. It is this "free" software that engenders this attitude of laissez-faire we can do whatever we like without paying for anything that is the direct cause of security breaches such as this with the iPhone. The fact that open sores can continue to exist despite the hundreds of intellectual thefts in the form of Microsoft's patents, Fraunhofer Institutes patents with the mp3 players, Unix copyright thefts.
Don't you freetards get it? If you want something, you have to pay for it. And 100 dollars for something as great as an OS isn't that much. Look at the great things Bill Gates has done with his Windows money. Furthermore, you can't just steal it and expect to always get away. How are developers supposed to be paid? How is the US economy supposed to grow if its greatest companies like MS, Apple, SCO, Oracle, IBM, etc. are brought down by this communist freeware? If I had my way, you'd all be hunted down and put under the jail.
Re:Wow. (Score:5, Funny)
It's OK, Steve. It's OK. No need to start throwing chairs here.
Re:Wow. (Score:5, Funny)
I say we send them to boot camp.
Convenient dodge of the issue. (Score:2)
You're missing the point. The data is supposed to be encrypted. It is not. It's not even protected by the PIN.
Re: (Score:2)
You're missing the point. The data is supposed to be encrypted. It is not. It's not even protected by the PIN.
It's not that it wasn't encrypted. What appears to be happening here is the OS politely decrypting the contents and making available to the USB mass-storage interface.