Researchers at the Fraunhofer Institute for Secure Information Technology (SIT) in Germany have found a way to steal passwords from Apple iPhones in six minutes.
The institute’s discovery could pose a security problem if phones are lost, as the attack requires physical access to the device. The researchers’ target was the “Keychain,” Apple’s password-management system. Rather than crack the 256-bit encryption to get to the passwords stored in the Keychain, the researchers explained in a paper (PDF), the institute exploited the fact that the underlying secret the password’s encryption is based on is stored in the device’s operating system.
This means the encryption is independent from the personal password that is supposed to protect access to the device, according to the researchers. As a result, the required key material can be created from data available within the device and therefore in possession of the attacker.
To launch the attack, the researchers used a jail-breaking tool and installed a SSH (Secure Shell) server on the device so that software could be run on the phone unrestricted. After that, the researchers ran a small script to access and decrypt the passwords found in the Keychain.
“The decryption is done with the help of functions provided by the operating system itself,” according to a paper on the situation. “Our script reveals the always unencrypted settings (e.g., user name, server, etc.) for all stored accounts.”
A video demonstration can be viewed here. In the current versions of iOS, the Keychain contains user accounts, including passwords such as e-mail, groupware, VPN, WiFi, Websites and often also passwords and certificates used in third-party applications, the researchers wrote.
According to the paper, the situation can be exploited on any device running iOS.
While many people think the smartphone encryption will provide sufficient security, this is a false assumption, the researchers said.
“This opinion we encountered even in companies’ security departments,” Jens Heider, technical manager of the Fraunhofer SIT security test lab, said in a statement. “Our demonstration proves that this is a false assumption. We were able to crack devices with high security settings within a very short time.”
Anyone whose phone is lost or stolen should immediately change their passwords as a precaution, the researchers recommended in the paper.