Existing users, 
iPhone Security Flaw Is the Tip of the Iceberg
Posted 28 August 2008 @ 7am in News, Security
We previoiusly reported on a security hole in the latest iPhone software exposes e-mail, text, and voice messages to whoever gets a hold of the device despite it being password-protected. Basically, clicking emergency call and double-clicking the “home” button brings up the favorites on iPhone 2.0.2. In actuality, however, passcodes can actually be cracked in every version of iPhone software to-date. While the method utilizing emergency calls is likely to disappear in the next version of the firmware, other security bypasses are readily accessible.
Per our friend Jonathan Zdziarski:
“Those interested in data security should still be quite concerned about the iPhone. The alternative methods for cracking the passcode - namely, the ones I’ve documented in the book - are by and far more sustainable techniques, which take advantage of flaws in the iPhone’s design itself. Until hardware changes are made to the iPhone, it is very likely going to continue to be very easy to break into one.
“The iPhone is a computer, just like a desktop computer, and so it can easily be booted in such a way that one can mount the disk and delete or modify the device’s configuration - including the passcode configuration. Cracking the iPhone’s passcode is about as complex as changing the root password on a desktop machine, given physical access.
“I’ve been making these techniques available to law enforcement for several months now. I’ve found even the most novice cop-geeks have been able to crack the iPhone’s passcode and install my forensics toolkit on the device. Agencies ranging from local po-dunk sheriffs to federal and international agencies have used these techniques to conduct lawful, warranted forensic investigation of iPhone devices since late 2007.”
The bottom line: don’t allow physical access to your iPhone, even after the widely publicized emergency call bypass is fixed.
Print This Post
7 Comments
Posted by snapcridge--2008
28 August 2008 @ 9am
The first thing that I have found in this iPhone that absolutely pisses me off. However, your “friend” Jonathan Zdaziarski is a sad example of why things like this happen. How about helping us out with the information with book for free instead of making us pay $25 for the info that could protect our vital information?!
Posted by Aquia33
28 August 2008 @ 10am
Why the derogatory po-dunk? It lessens the impact of the article.
Posted by isights
28 August 2008 @ 10am
Funny how this book isn’t mentioned: Blackjacking: Security Threats to BlackBerry Devices, PDAs, and Cell Phones in the Enterprise…
Posted by jzdziarski
28 August 2008 @ 11am
The book doesn’t teach you how to protect your vital information, it teaches how to expose it. Only Apple can secure your vital information by deploying user encryption. If you’re looking for a free-bee from someone to fix your security worries, I’d look to Apple.
Posted by quantumd0tz
28 August 2008 @ 1pm
It’s not a security flaw - it’s a bug. A security flaw would be using Mocha VNC Lite with no SSH.
This is just a bug in the OS and not a big problem. As someone said in another forum, “You know, wallets have a huge security flaw, if you leave it on the table it can be stolen!”
Same basic principle.
Posted by bitterrotten
2 September 2008 @ 7am
Aren’t these security flaws the reason we’ve been able to have jailbroken phones this whole time? .. I’ll take the flaws, thanks.
Posted by Security Details: iTunes 8, QuickTime 7.5.5, and iPhone OS 2.1 - iPhone Atlas
9 September 2008 @ 6pm
[...] Many of the fixes for the iPod Touch will most likely as we said appear on the iPhone. Many of these address some of the security issues you may have heard about already. However there are still many other issues that need to be resolved in regards to protecting the contents of your phone. Hopefully Apple will address these soon as we previously reported. [...]