The Tech Herald

New forensics kit offers near-instant access to iOS 5 data

by Steve Ragan - Nov 1 2011, 18:10

ElcomSoft has released an update to their iOS Forensics kit, which touts a faster recovery time for protected system dumps and other tasks. The update increases ElcomSoft’s abilities to crack and extract data from iOS version 3.x, 4.x, and 5, on any Apple device.

“There was no break-through in the iOS security model”, says Andrey Belenko, ElcomSoft leading developer.

“The architectural changes are more of an evolution of the existing model. However, we highly welcome these changes, as they present better security to the end user. In particular, the number of keychain items that can be decrypted without the passkey is now less than it used to be. Device passcode is one of the hallmarks of Apple’s security model, and they are expanding the use of it to cover more data than ever before.”

Apple did make one major change in iOS 5 however, by replacing the keychain encryption algorithm entirely, and making Escrow Keybagging useless by protecting escrow keys with the device passcode.

This means that before anything can be done, ElcomSoft will need to brute force the passcode from the device. After that, full data recovery and analysis from the keychain is only a matter of time.

The keychain contains tons of information that is highly valuable to investigators, including stored logins and passwords to various websites, Wi-Fi hotspots, email accounts, and applications.

But what of the other data? Apple’s iOS accumulates huge amounts of information.

Besides the obvious pieces such as pictures, email and SMS messages, Apple’s devices store advanced usage information such as historical geolocation data, viewed Google maps and routes, browsing history, call logs, and nearly everything typed on the iPhone.

Most of this data is stored in the backups produced by iTunes, but was nearly impossible to get at in some cases.

“I love challenges”, says Dmitry Sklyarov, ElcomSoft’s leading cryptanalysis specialist.

“The new system release presented a perfect case. When we just started, we didn’t even know if we have a chance to break it. There are all-new encryption algorithms, changed keychain protection, new data structures… the list goes on and on. We did most of it before at the time of iOS 4 release, but the new system presented some unexpected challenges.”

In the new release, ElcomSoft says they can recover all of the encrypted data stored in the backups in about 20 minutes on a 16GB iPhone, or 40 minutes for the 32GB version.

Around the Web

Comment on this Story

comments powered by Disqus

From Autosaur.com

Shelby GT350 Mustang Pictures

We have added a bunch of pictures of the all-new Shelby GT350 Mustang from Ford. The ne...

All-new Shelby GT350 Mustang

Ford have revealed details of the new Shelby GT350 Mustang. First introduced in 1965 the new...

Best Cars To Buy In 2015

Leading vehicle research company Kelley Blue Book has released its list of the best cars to ...

A.C. Milan Take On Audi R8

Five A.C. Milan stars take on an Audi R8 in a game of street soccer in a new ad for Toyo Tir...

Jaguar 2016 F-TYPE R Coupe All-Wheel-Drive

Jaguar has unveiled the 2016 F-TYPE R Coupe, the first to feature all-wheel-drive. The 2016 ...