Cracking software retrieves iPhone 4 passwords

Don't they just do a brute force attack?

Unless ElcomSoft have changed their software significantly, its approach to cracking the actual backup password (the 'iPhone Password Breaker') seemed to be that of a brute force attack (with a few attempts at shortcuts). This new feature just seems to then go on to decrypt the data that represents the on-device keychain (NB. 1Password uses its own data store. Though we have no real way of knowing if it's any more secure.)

My understanding of iPhone/iPod touch backups is this: If you apply a password to the backup of the phone (in iTunes, it's an option when the phone is plugged in) then this is used to encrypt the phone's in-built key (the one that is actually used for the encryption.) Further, the device does the encryption of the data on the way out when being backed up, and it only provides the key encrypted with the user's password from thereon (which is why you can't remove a password once you've set one, without wiping the phone with a full restore.)

I suspect, if you have a copy of the key on disk from before you set a backup password - e.g. in an earlier backup (from a restore point, or via TimeMachine maybe), then it's straightforward for ElcomSoft's 'iPhone Password Breaker' to decrypt your backup. Otherwise it has to crack it the hard way (still not too hard if you used a dictionary password or something a few "st3p5" away.)

None of this prevents just copying the data out of the device directly, per previous reports, if you actually have access to it (perhaps they've fixed that with iOS 4, and/or iPhone 4. There haven't been any attention-grabbing reports about it yet.)

Can any one corroborate, expand, or correct?

@Basic: Sorry to disappoint you.

Elcomsoft's software runs on a Mac or Windows box which has *backed-up* the iOS 4 keychain, rather than running anything on the iPhone itself. Apple could trivially change the encryption method used by updating iTunes, forcing Elcomsoft to modify their application, but it's a losing battle.

All any security system today does is make access *harder*. It cannot make it *impossible*, however: with enough power and brute force, pretty much any security system can be cracked, be it real or virtual. The trick is to raise the barriers so high, potential thieves simply won't bother trying. But you can never reduce the threat to zero.

Elcomsoft's other tools include PDF password crackers, internet password crackers, etc. They all use the same brute force algorithms though. Crackers have been using such techniques for ages, so this isn't new in itself. The GPU acceleration is Elcomsoft's primary selling point. It speeds up the process somewhat. Insecure passwords will usually be discovered within minutes, but a particularly complex passcode or pass-phrase can still take a very long time to hack. Many hours—even days—are not unheard of.

Smartphones generally don't lend themselves to complex pass-phrases and tricky passwords with symbols and numbers as well as letters, simply because most people find them difficult to type. The iPhone is no exception, so Elcomsoft's software should be no surprise to anybody. I don't know if Android phones have a similar "backup" feature, but if they do, expect a similar application for that to appear soon.

(Before anyone asks, Elcomsoft's cracking tools are only available for—drum-roll please!—Windows!)

Job's Mensis Horribilis just got extended

What started with Jobs sort of admission that not all was well with Lemon 4, his 'Mensis Horribilis' (horrible month) just got extended. He has no one but himself to blame as his arrogant high and mighty attitude is just right to incite people to take him down a notch or two (or 4).

He is learning that notwithstanding his glorious blue anechoic rooms and his talented engineers that he hasn't a monopoly on infallibility.

And if Jobs thinks it can't get any worse, just wait!

it's perfectly simple

if you store your passwords on a device they're not secure. It's a simple as that.

So you need physical access to the computer the phone has been backed up to?

There are few systems you can't break into if you have unlimited physical access to them though,

As security vulnerabilities go it's a bit of a non-story.

Fanbois, stop the justification

and just accept Apple is run by humans, not gods.

They are just as vulernable as the rest of us.

BANG goes the iPhone bubble for those who value more that looks.

No passwords

Apple don't store the passwords to email accounts in backups. That's why if you restore from one, you need to setup your email accounts again.