DOJ Says iPhone Is So Secure They Can't Crack It 454
zacharye writes "In the five years since Apple launched the iPhone, the popular device has gone from a malicious hacker's dream to law enforcement's worst nightmare. As recounted by the Massachusetts Institute of Technology's Technology Review blog, a Justice Department official recently took the stage at the DFRWS computer forensics conference in Washington, D.C. and told attendees that the beefed up security in iOS is now so good that it has become a nightmare for law enforcement."
Government Computer Skillz (Score:5, Funny)
I've never been too impressed with government agencies and their knowledge of computing.
TWO WORDS (Score:5, Insightful)
iCloud Supoena.
So, the "remote control" is uncrackable? iCloud and Siri and "location awareness" with GSM, WiFi and GPS make the security of the actual device nearly an orthoganal proposition to any enforceable protection for the user or data.
When this is so clearly a form of misdirection, I can't help but wonder the purpose of a DOJ statement like his being made public. Which perception and behaviour are they trying to influence, and by whom?
Re:TWO WORDS (Score:5, Insightful)
When this is so clearly a form of misdirection, I can't help but wonder the purpose of a DOJ statement like his being made public
Setup for a false flag operation:
- DOJ publicly claims Device X is secure from their snooping
- Suckers fall for the ploy and migrate to Device X, assuming it's safe from prying gov't eyes
- DOJ forces Device X's manufacturer, via NSL or similar devious means, to turn over user information.
- Device X's user has no idea what's going on, thanks to draconian EULA and ToS, until jackbooted thugs kick in the door.
It's quite brilliant, really. Or, would be, if not so obvious.
Re:TWO WORDS (Score:5, Insightful)
Except what you're describing is not a false flag operation.
False flag (also known as black flag) operations are covert operations designed to deceive in such a way that the operations appear as though they are being carried out by other entities.
This may be a disinformation campaign but unless the DOJ is posing as someone else, it's not a false flag.
Re: (Score:3)
Of course, but "false flag" sounds so cool!
Re:TWO WORDS (Score:5, Funny)
I wish I could anything I wanted in broad daylight.
College would be so much more fun.
Scare tactics. (Score:4, Informative)
Okay, can't watch the youtube video(blocked due to limited bandwidth here), but it let me onto the infowars site.
750M rounds is 2.5 rounds per person in the USA, yes. However: Scare tactics are being used.
First, it's for training ammunition - my training/qualification for the year is at well over 500 rounds between pistol and rifle(~half each). I'm not DHS, but it should be a clue as to how many rounds it takes to train&qualify somebody. It's often an annual requirement.
Second - it's a 'purchase UP TO' order, up to 70M rounds/year, between all winning parties, for a 5 year contract. NOT 'planning to buy 750M rounds of ammo'. Going by the contract, that's a MAX of 350M. The minimum order in a year is 1 lot of 1k rounds. In these sorts of contracts they list the maximum possible they expect for each item - for example, a big purchase of .40S&W handguns, a shift to .357 Sig, whatever. .223 is well represented, though I wonder that they aren't shooting NATO 5.56 spec rifles(the difference is about a human hair; doesn't matter much in training I guess). Going by my figure, a max order of 70M rounds would let you dual-qualify ~140k people. Office types trained 'just in case' would use a bit less ammo, SWAT types far more. A quick search shows 160k [syr.edu] employees in DHS. Or maybe it's 188k employees AND 200k contractors [fcw.com]. Whatever. I doubt they're going to be qualifying EVERYONE anytime soon, and probably don't plan to short of some crazy doomsday scenarios.
Third - "including 357 mag rounds that are able to penetrate walls." - just about ANY handgun self defense caliber is fully capable of penetrating a wall while remaining potentially lethal. It's a simple fact that a human body, which self defense rounds generally have to be able to completely penetrate to be considered effective, is more difficult to penetrate than 2 sheets of drywall. You want to go back to yea old days - when the .357 was developed, the standard was actually penetrating a car windscreen with a maximum deflection such that you'd still hit the driver. 9mm, btw, is 'normally' powerful enough for this, though you might need 2 shots(not as big of a deal for a semi), but this was back when we were still issuing revolvers to police. While we're at it, the contract also lists rifle calibers - .223, .30-06, and .308; all far more powerful than .357.
In other words, it's a big hoopla over just about nothing.
Re:TWO WORDS (Score:5, Informative)
I can't help but wonder the purpose of a DOJ statement like his being made public.
It was a higher-up in the DoJ (specifically, Ovie Carroll) discussing challenges in digital forensics (at a conference on digital forensics). It was a brief mention in a larger talk and a fact that does not surprise anyone in the field. It's well-known that pulling data off of an iPhone can be a real pain in the ass. (IMO, I would consider Android worse, as there is not yet a reliable technique that can pull data off of an unrooted phone without modifying the phone's data, and data modification -- even when justified and documented -- is a big problem in some jurisdictions.)
Re:TWO WORDS (Score:4, Funny)
It's misdirection to misdirect you from the misdirected misdirect, and time passes more slowly at each level of misdirection until you spend a lifetime misdirected into Limbo! THAT'S WHEN THEY GET YOU! #theyareouttogetyou
Re:TWO WORDS (Score:5, Informative)
Isn't the iCloud stuff (specifically, the device backups) also AES encrypted with a key Apple doesn't have? I will have to dig up the article, but I'm pretty sure I saw that.
No. [arstechnica.com]
Re:TWO WORDS (Score:4, Insightful)
Basically, Apple has the ability to decrypt the data, and all the government needs is a court order to force them to do so. At the same time government officials are deploring their ability to access the data. Three possibilities that I see:
1. The government is attempting to deceive people into storing data where government officials can access it with a court order.
2. Some government officials do not have a problem admitting that they would love to access personal data without a court order, i.e. without probable cause.
3. Some government officials do not mind to supplement their income by advertising for Apple.
I frankly would have no problem with 1), would not be surprised by 3) but suspect the answer is 2)
Re:TWO WORDS (Score:5, Insightful)
You forgot possibility #4...
An Apple fanboy writes an article praising the iphone using out of context quotes from the CEO of Paraben (not the DoJ) saying there have been cases where Paraben couldn't defeat iPhone encryption and a a DoJ official talking about hard drives (not the iPhone) saying that "if you pull the power on a drive that is whole-disk encrypted you have lost any chance of recovering that data" (which isn't true, btw). Then a second fanboy reads said article and translates it to "iPhone is the DOJ's worst nightmare" and submits it to Slashdot where samzenpus demonstrates the usual lack of even the barest hint off fact-checking and gives us a headline like this one.
Re: (Score:3)
Thankyou... for the voice of reason
I used to think slashdot was supposed to spare you from the usual pointless waffle that fills tech mags because the journalists were scraping the bottom of the barrel for something to write about. Unfortunately...
Re: (Score:3, Insightful)
I'm not sure how those things are relevant. The article talks about device security, not cloud security. Lest everyone forget, the same subpoena can get the same data from Google, Microsoft, RIM, etc.
If you decide to not use the cloud and the police get your device, it's currently more secure on Apple's phone. Must every article turn into a religious war?
Re:TWO WORDS (Score:5, Informative)
FYI, this is the source of the summary quotes (adhoc as they are) and also addresses other questions regarding device security as opposed to iCloud security which has nothing to do with the linked articles.
It also notes the key here, that while the device is powered on, it is still possible to obtain the key from memory, but once the device is turned off, the key is lost. It also notes that the decryption key itself is encrypted by the device pin, meaning an easy pin is an easily decrypted device. This is true for any mobile device, and a good reason to enable a strong ping instead of the default 4 char code seen on most devices.
What I found curious about the article is that they didn't emphasize this point. Video's of police decrypting a device due to a weak 4 pin character lock within a matter of seconds are available for any number of devices. I am curious how much additional computing power is needed to decrypt a device for each character added to the unlock sequence.
Re: (Score:3)
Ah, the other link provides that info...
Re:TWO WORDS (Score:4, Informative)
The same subpoena can't get the data out of RIM actually -- device to device communications are encrypted in such a way that RIM has no access to the contents.
Yeah, about that... [indiatimes.com]
Re:TWO WORDS (Score:5, Informative)
quite the opposite, apple holds the key - so all it takes is a gov't request to apple and they have the master key.
http://arstechnica.com/apple/2012/04/apple-holds-the-master-key-when-it-comes-to-icloud-security-privacy/ [arstechnica.com]
http://arstechnica.com/apple/2012/04/can-apple-give-police-a-key-to-your-encrypted-iphone-data-ars-investigates/ [arstechnica.com]
Given their policies regarding a number of things which are dinosaur-era, we don't have an answer to whether or not they will give it away or not. I don't know that an official statement has ever been made by apple. The question is - do you want to trust that information with apple? Specifically: 100% uncertainty? That's not a "apple is evil, apple is not evil".
Re: (Score:3)
Re:TWO WORDS (Score:5, Insightful)
Well, bummer. One more reason not to move stuff over to iCloud (besides the use case issues).
Mind you, it's the same reason to not move your data anywhere.
Re:TWO WORDS (Score:4, Informative)
Re:TWO WORDS (Score:5, Interesting)
OF COURSE they have a key. Any cloud-based data you can access through a web browser requires as much - whether it's with Apple, Amazon, Dropbox, Google...
And per one of your links, right after they say "of course Apple has a decryption key":
Still, vice president of products for cloud security firm Echoworx, Robby Gulri, noted that Apple is following best practices used throughout the industry. "Apple has taken the right steps to protect users' data and privacy as far as a widely public service like iCloud goes," he told Ars. "For example, data is transmitted using SSL, data is encrypted on disk using 128-bit keys, and Apple has stopped letting developers use individual UDIDs."
Re: (Score:3)
SSl (256 bit) using 128-bit keys has been cracked for years...
Citation, please?
a href="http://www.inet2000.com/public/encryption.htm">These sites [stackexchange.com] beg to differ.
mod TFS (Score:5, Insightful)
TFA and TFS should be modded +5 Funny.
One suspects that there are back doors all over the iPhone, in addition to the various apps that have access to remarkable amounts of stored material and regularly send it home (or elsewhere). Otherwise its alleged impenetrability would hardly be promoted by law enforcement. It's like Brer Rabbit pleading "please don't throw me in the briar patch".
What if they had said it was easily crackable? (Score:4, Interesting)
would that still be a misdirection?
Oh, I see, anything which is said in favor of iPhone security is "reverse psychology", anything critical of iPhone security is "speaking truth to power".
You guys crack me up.
Re:mod TFS (Score:5, Interesting)
This is purely anecdotal, but... I was recently on a flight next to a highway patrolman flying back from a conference for computer detectives (my words, not his; I don't remember what the actual job title was). He showed me the modified Ubuntu distro DVD they were passing out - "Look, it has a password cracker!" "Is that John the Ripper?" "You've heard of that?!?" - and we had a pretty nice chat.
During the conversation, I mentioned that iPhones are encrypted now. I asked, "OK, hypothetically, suppose I'm a mafia drug dealer and you get my encrypted cell phone. How screwed am I?" He said that they'd get a subpoena for my house, show up with a search warrant, and read the backup off my Mac's hard drive, "and then we run this app [opens it to show it to me] and have full access to all your data!" I told him that was pretty impressive, "but... what if I turn on FileVault and encrypt my whole hard drive?" He looked like I'd kicked his puppy and said that most criminals aren't smart enough to do that, but in that case, yeah, there was nothing he could do.
Feel free to take that with a grain of salt, but I had a detective tell me - in an unguarded two-geeks-talking moment with no apparent motive or visible sign of deceit - that the only way they could recover an encrypted iPhone's contents was through examining the unencrypted backup from an unencrypted hard drive. Now this was a state highway patrol guy and not an NSA analyst, and maybe the higher-up guys have access to emergency use stuff they're not talking about, but my takeaway was that the state-level police really don't have any way to defeat the encryption.
Re:mod TFS (Score:5, Interesting)
Now this was a state highway patrol guy and not an NSA analyst, and maybe the higher-up guys have access to emergency use stuff they're not talking about, but my takeaway was that the state-level police really don't have any way to defeat the encryption.
Without talking about bad implementation (e.g., weak passwords) or side channel attacks (keystroke loggers and the like) it seems exceedingly unlikely that any law enforcement agency would have the ability to defeat modern encryption algorithms. Even if the NSA has such an ability (the math geeks can comment on the likelihood of this) it would be far too valuable to waste on something as mundane as a criminal prosecution. National Security concerns trump the incarceration of child molesters, drug dealers, murderers, and other common criminals.
Far more interesting than the technical aspect will be the evolution of 5th amendment case law as it relates to encryption. There is no definitive legal precedent in the United States as to whether or not you can be compelled to disclose an encryption password. There have been a few cases that have danced around the edge of this question, but none have directly addressed it, nor have they made it to SCOTUS.
Re: (Score:3)
Exactly. He told me, basically, that the main (only?) side channel attack was getting the unencrypted backup. And yeah, I strongly suspect that if the NSA had the ability to crack AES, it would only be used for situations that you and I would never hear about. The instant it came out in even the most important of public trials, everyone would stop relying on AES about 30 seconds later.
Re: (Score:3)
Even if the NSA has such an ability (the math geeks can comment on the likelihood of this)
I don't personally count as such a math geek, but I know some who do, and the consensus is that, no, the NSA does not. Academic cryptographers who regularly collaborate with NSA cryptographers have the general impression that while it's likely that the NSA knows a number of tricks that academic cryptographers don't, that in many areas the NSA is learning a great deal from published work. In other words, the NSA may still be ahead, but not by that much.
With that in mind, put yourself in the shoes of the
Re:mod TFS (Score:4, Interesting)
"....most criminals aren't smart enough to do that"
I can't seem to help but read that as ".... criminals who are smart enough to do that will probably get away."
Re: (Score:3)
Or, you could, you know, just get the original. [amazon.com]
Re:mod TFS (Score:5, Insightful)
OT, but since song of the south was *banned* by disney, you could only get a copy if you went to where pirates hang out.
it was a great classic movie but disney capitulated to pressure (their own, in fact!) and banned the film.
uncle remus is not fit for modern audiences. it 'offends their sensibilities'. or something like that.
oh, btw, FUCK DISNEY.
Wrong, american audiences are offended. The rest of world is not offended by this B-series film.
And frankly speaking, if Song of the South is banned, then they should also ban Gone with the Wind and the Adventures of Tom Sawyer. Stupid country, unable to cope rationally with your past.
Political Correctness Censorship... (Score:5, Insightful)
Amen!
In the US, this is another example of political correctness gone overboard.
What the old saying about people not learning from mistakes in the past are bound to repeat them in the future?
Then again...look at Germany, banning most anything Nazi connected....I believe similar type bans happen in other EU countries too?
But seriously....this is a part of US history, and should not be suppressed. I remember seeing old Bugs Bunny cartoons...people got blown up into 'blackface'....if they even show these episodes on tv, these parts are usually edited...
Why? This is part of history, and people should know what attitudes were publicly held and presented to see how much we've changed over the years.
Re:Political Correctness Censorship... (Score:4, Interesting)
Why? This is part of history, and people should know what attitudes were publicly held and presented to see how much we've changed over the years.
We haven't changed over the years. Those attitudes are still common, but they are no longer publicized. So, by self-censoring itself in public, Disney is accurately reflecting racial attitudes in American society.
So, is Disney to teach us about history? Or the present?
Re: (Score:3)
Bugs Bunny cartoons are edited because blackface shouldn't be considered entertaining anymore.
Uh, let me get this straight. An explosion happens in a cartoon and instead of being injured, maimed, or killed the character has his face covered in soot. This is racist? How?
Re: (Score:3)
Any child that had seen an old minstrel show could connect the dots. I suspect the number of such children is in the dozens.
Re: (Score:3)
Re: (Score:3)
I don't see anything wrong with that type of humor....we all have stuff about us that is funny about us.
I suppose that it is only ok today..to make fun of white guys, I mean, they're the only ones portrayed as dufusses on commercials and sitcoms these days...
People..get over it...we all have stuff funny about us..Whites, Blacks, Orientals, Hispanics...etc...
Re: (Score:3)
Speak for yourself. The more ways we have to make fun of each other, the better, IMHO. As a person of color (pink),I don't find honkey jokes funny, but I wouldn't deny them to those who do.
Re: (Score:3)
The settlers discovered immortality? Hmm, so that's why everyone goes to Australia.
Re: (Score:3)
You know...myself and anyone my age..grew up with those cartoons...and somehow...we're not all damaged....why would todays kids be any different...are they more stupid now and need to
Re:Government Computer Skillz (Score:5, Insightful)
I was at this conference, the running joke was "If it's encrypted, forget about it!" Everyone knows this. FDE and utilities like TrueCrypt will always prevent data recovery, save for the human factor of giving up the password.
Also at the conference was the strong difference between American and British/Australian law. In the U.S., the 5th Amendment prevents someone from being required to turn over their password. The Brits and Aussies do not have this problem, as the 5th amendment doesn't exist for them.
Re:Government Computer Skillz (Score:4, Interesting)
Re:Government Computer Skillz (Score:5, Informative)
In the U.S., the 5th Amendment prevents someone from being required to turn over their password.
This is still unsettled. The 11th Circuit Court [wired.com] has ruled that passwords are protected under the 5th amendment. However the 10th Circuit [huffingtonpost.com] has chosen not to intervene in a lower court decision that forced a woman to decrypt her laptop.
This is going to have to go to the Supreme Court eventually, and I think you can guess how the fascist majority of justices will decide.
Re: (Score:3)
Re:Government Computer Skillz (Score:5, Informative)
The burden of proof is on you, not them, under UK law, provided they can prove you ever had access to the password.
Or to put it another way, you are responsible for maintaining accurate records of every encryption passphrase you ever use.
Enjoy your SSH session keys.
Re:Government Computer Skillz (Score:5, Interesting)
Re:Government Computer Skillz (Score:5, Informative)
Re:Government Computer Skillz (Score:5, Informative)
Wikipedia [wikipedia.org] sez:
Re:Government Computer Skillz (Score:5, Insightful)
(Well, technically, they'd have to turn you over to the military and have them shoot you...)
This is unlikely to happen in very many cases, however, even though it's legal.
Re: (Score:3)
Re: (Score:3)
It's simple. First you hack their Amazon account, then that gets you into Google, and from there breaking into the iPhone is easy enough for a 14 year old.
Re: (Score:3)
And all their non-administrative work has been contracted out years ago due to the small government initiative. So while folks (consultants) working at one or another of the facilities can be quite computer literate, the actual government employees might not be.
[John]
Welcome to my Nightmare (Score:5, Funny)
Gee. The government can't spy on you using your own hardware?
This is truly frightening.
Re: (Score:2)
Obligatory tinfoil-hat quote (Score:5, Funny)
Well, yes, that's what they'd like you to believe, isn't it?
sounds like a challenge (Score:5, Insightful)
(also article is a little too breathlessly enamored of apple: PR astroturf?)
Re:sounds like a challenge (Score:5, Funny)
Good. (Score:3)
It's a start.
Re: (Score:3)
And if you believe that... (Score:5, Insightful)
...I've got some "moon" rocks I'd like to sell you.
Honestly, this seems like a way to trick dumb criminals into thinking their information is secure just because they use an iPhone. If this were truly the case, and the DOJ does really have problems in dealing with iOS devices, I'd expect them to remain tight lipped about it.
Re: (Score:3)
If this were truly the case, and the DOJ does really have problems in dealing with iOS devices, I'd expect them to remain tight lipped about it.
No, they'd strong arm Apple into providing them with back doors and then remain tight lipped about it...
Re: (Score:3)
If in the first public trial it came to light that the DOJ of the government had a way to decrypt any iPhone, the secret would then become public knowledge. So far there has been no such trial.
Oblig xkcd (Score:2)
How long until they just resort to this [xkcd.com]?
Re:Oblig xkcd (Score:5, Informative)
Hitting people with wrenches is forbidden by the Bill of Rights.
Re: (Score:3)
Using evidence in court that was obtained by hitting you with wrenches is forbidden, nor can they use information derived from that information. (Fruit of the poisoned tree.)
Depending on the data, though, they may not be nearly as interested in prosecuting you.
Re:Oblig xkcd (Score:4, Insightful)
Hitting people with wrenches is forbidden by the Bill of Rights.
Your point being....?
Didn't stop them from hitting Padilla or Manning with metaphorical wrenches. A couple more direct examples: reporters [wikipedia.org] jailed (or threatened [nytimes.com] with jail) for not revealing their sources.
Re: (Score:3)
Which is why they just water board you, for extra Bill of Rights goodness they do that at a military base on a small island nation right off the coast.
Re:Oblig xkcd (Score:5, Informative)
Only if done as punishment. According to Scalia, as long as it's not punishment, torture is constitutional. [thinkprogress.org]
Re: (Score:3, Insightful)
"What is he punishing you for?"
Sadly the answer to that is so bloody obvious that it strains disbelief that Scalia wouldn't know it before he asked the question.
Quite simply, he's punishing you for not telling him what he wants to hear. That's all torture is good for anyway. If you torture someone long enough, they'll eventually figure out what you want to hear and start singing that tune like a canary. Note: What you want to hear has little, if anything, to do with the truth (except, perhaps, by coincid
Now you know for certain (Score:5, Interesting)
The iPhone sports a master encryption key and DOJ has access to it.
Umm.. what? (Score:5, Informative)
5 minutes ago I knew nothing of Apples full disk encryption. Now I find an article that states:
http://anthonyvance.com/blog/forensics/ios4_data_protection/ [anthonyvance.com]
So I'd say I'm just VERY skeptical that the DOJ can't crack something that wasn't really designed with any security in mind in the first place. Either that, or the DOJ has nobody with any skills whatsoever.
Re: (Score:3)
Or, they're cops and they don't want to have to go through the bother of getting a warrant when the phone is 'obviously in plain sight and thus immune to the regular rules of search and siezure'.
Re:Umm.. what? (Score:5, Informative)
Last time I checked, the government can't lie. It can only deny.
Sorry, incorrect. Go watch "Don't talk to police" on YouTube. Required viewing for US residency.
Link (Score:3)
Re: (Score:3)
I'm pretty sure the government can only lie. Maybe you are thinking of some government other than the U.S. government?
Re: (Score:3)
And you haven't exactly disputed the article either. Just because it's 2 years old doesn't mean it's not accurate.
I have several IOS devices, and the only "password" you can put into it is the simple 4 character unlock code. You should certainly know that all encryption is based on keeping something secret that's very difficult to guess. If the only secret you're keeping is a 4 digit key, you're completely hosed to brute force attacks.
Nicely done, but lacking in subtlety. (Score:5, Funny)
I look forward to Ovie Carroll's next few breathless announcements:
"Hooh, boy, that YouTube is soooo secure, a person could sign up for an account using their real name and home address, then post videos of them committing crimes online and law enforcement would never ever be able to track them! Honest!"
"You know where the safest place to hide stuff is? Underneath the welcome mat at 950 Pennsylvania Avenue, NW in Washington, DC. Really! We did a study and figured out that once that mat is pushed down on top of something, whether it's drugs, cash or big file folders full of industrial secrets, there's NO way that any one can get into it."
"My biggest nightmare is someone committing a crime, then emailing a detailed confession to ovie.carroll@usdoj.gov. Once something gets into those email tubes it's IMPOSSIBLE to get it back out and figure out what happened. Really. You can trust me. I'm with the government."
Easy (Score:5, Funny)
DOJ Says iPhone Is So Secure They Can't Crack It
I dropped mine off the balcony to the pavement below. It seems that it is very easy to crack an iPhone.
Re:Easy (Score:5, Funny)
encryption laws (Score:5, Interesting)
Can somebody explain how if the iPhone is so uncrackable/breakable that Apple can still export it? I seem to recall some kind of PGP problem where exporting something that was too secure was a violation of US laws. Or maybe I'm mixing reality with a bad Nicholas Cage movie, which is entirely possible.
Re: (Score:3)
Old news. They eased up on encryption export restrictions years ago. It was driving all the encryption R&D overseas where our gov't had even less control over it.
And also, they said they weren't lying. (Score:4, Funny)
So we know it's true.
Re:I don't believe it (Score:5, Informative)
Re: (Score:3)
It seems you are right. I'm impressed.
Re: (Score:3)
Re:I don't believe it (Score:4, Insightful)
If you don't have a passcode enabled on the device then there's not much point in encrypting it, is there?
Re:I don't believe it (Score:4, Interesting)
Re: (Score:2, Insightful)
There are companies selling suites of forensics tools that blow thur any iphone security in a heart beat.
Not to mention that every hacker can get into a stolen phone with any number of widely published tricks.
Re:I don't believe it (Score:5, Informative)
Wrong.
It uses full disk encryption. However, that can be circumvented quite easily with a jailbreak (if one exists).
However, there is a second encryption system. This system derives the keys from your passcode and a key that is stored within a secure element on the iPhone. Thus, you need to know the Passcode of the iPhone in order to decrypt those files. Since, the key derivation function is tied to the passcode and the key within the secure element you cannot offload the brute-force attack to external machines, you need to do it on the iPhone. This means that a brute-force attack on a 4-digit PIN takes about 20 minutes (ok, that's not much), but when you consider complex PINs with 5 or more characters you are soon at 50 days (don't have the exact numbers in my mind right now, but there is a good presentation on that).
Downturn: You must rely on the app developer to chose the right protection class for the files. If he doesn't then you are down to the rather insecure full-disk-encryption, and you need to chose a longer Passcode...
Re: (Score:3)
Er, no. It means you make a copy of the flash storage, and brute-force it on a "real" computer in a matter of milliseconds.
Re:I don't believe it (Score:4, Informative)
> "As far as I know the iphone doesn't use full disk encryption."
And because you don't know if it does that means it doesn't, right?
http://support.apple.com/kb/HT4175 [apple.com]
Full device encryption has been available since the 3GS, when they added in hardware encryption support to their iOS products.
Before speaking on a subject you know absolutely nothing about you should do a little research on it first.
Re:I don't believe it (Score:5, Informative)
That's because the password-protected encryption doesn't encrypt the whole disk. It encrypts individual files. There is a full-disk encryption key, but its purpose is to make wiping the device a single block write operation (overwrite the key) instead of a complete wipe of tens of gigabytes.
Re: (Score:3)
Re:I don't believe it (Score:5, Informative)
According to TFA, encryption and decryption is now available and built in in the hardware even. So it's become computationally cheap. The AES key is also burned in silicon, making it impossible to get to.
But as usual the weakest link is the user's password, in this case a PIN. A typical 4-digit PIN can be cracked (using special software to prevent phone from wiping itself after ten failed attempts) in a matter of minutes; one needs an 8-digit PIN to be reasonably secure (average 15 years for a brute-force attack).
Re:I don't believe it (Score:5, Funny)
Re: (Score:3)
Re:Completely false (Score:5, Insightful)
Re:It's BS. I can tell you how to crack iphone. (Score:4, Funny)
Yeah, totally. I hacked a Gibson with side channel "emmisions" once. I used a Pac-man virus.
Re:That's Odd (Score:4, Funny)
I thought all you had to do was use a little social engineering and you can do what you want with the data. /ducks
Worked for Tasha Yar, anyhow.