The Tech Herald

New forensics kit offers near-instant access to iOS 5 data

by Steve Ragan - Nov 1 2011, 18:10

ElcomSoft has released an update to their iOS Forensics kit, which touts a faster recovery time for protected system dumps and other tasks. The update increases ElcomSoft’s abilities to crack and extract data from iOS version 3.x, 4.x, and 5, on any Apple device.

“There was no break-through in the iOS security model”, says Andrey Belenko, ElcomSoft leading developer.

“The architectural changes are more of an evolution of the existing model. However, we highly welcome these changes, as they present better security to the end user. In particular, the number of keychain items that can be decrypted without the passkey is now less than it used to be. Device passcode is one of the hallmarks of Apple’s security model, and they are expanding the use of it to cover more data than ever before.”

Apple did make one major change in iOS 5 however, by replacing the keychain encryption algorithm entirely, and making Escrow Keybagging useless by protecting escrow keys with the device passcode.

This means that before anything can be done, ElcomSoft will need to brute force the passcode from the device. After that, full data recovery and analysis from the keychain is only a matter of time.

The keychain contains tons of information that is highly valuable to investigators, including stored logins and passwords to various websites, Wi-Fi hotspots, email accounts, and applications.

But what of the other data? Apple’s iOS accumulates huge amounts of information.

Besides the obvious pieces such as pictures, email and SMS messages, Apple’s devices store advanced usage information such as historical geolocation data, viewed Google maps and routes, browsing history, call logs, and nearly everything typed on the iPhone.

Most of this data is stored in the backups produced by iTunes, but was nearly impossible to get at in some cases.

“I love challenges”, says Dmitry Sklyarov, ElcomSoft’s leading cryptanalysis specialist.

“The new system release presented a perfect case. When we just started, we didn’t even know if we have a chance to break it. There are all-new encryption algorithms, changed keychain protection, new data structures… the list goes on and on. We did most of it before at the time of iOS 4 release, but the new system presented some unexpected challenges.”

In the new release, ElcomSoft says they can recover all of the encrypted data stored in the backups in about 20 minutes on a 16GB iPhone, or 40 minutes for the 32GB version.

Around the Web

Comment on this Story

comments powered by Disqus

From Autosaur.com

Car Games Update August 30th

We have added a few new games to the car games section of Autosaur. First up is the Car Eats...

2015 Toyota Tundra TRD Pro Prices

Toyota have announced prices for their 2015 Tundra TRD Pro, based on the Tundra it includes ...

2015 Toyota Tundra TRD Pro Pictures

Toyota recently announced prices for the 2015 Toyota Tundra TRD Pro. We have added some...

2015 Dodge Challenger Mopar Challenger Drag Pak Pictures

Mopar have been showing off their 2015 Mopar Challenger Drag Pak test vehicle at the Nationa...

Ford Customers Test 2015 F-150

Ford have selected four customers from the 15,000 who applied to be first to test the latest...