At the last Developer’s Conference in San Francisco, Apple talked about the security encryption in the new iPhone 3GS:
iPhone 3GS offers highly secure hardware encryption that enables instantaneous remote wipe. You can even encrypt your iTunes backups.
The term “Highly secure” doesn’t seem to justify itself though!
Jonathan Zdziarski, iPhone developer, hacker, forensics teacher, finder of the iPhone kill switch, creator of the AMBER alert app, said about the iPhone 3GS:
I don’t think any of us [developers] have seen encryption implemented so poorly before, which is why it’s hard to describe why it’s such a big threat to security.
It is kind of like storing all your secret messages right next to the secret decoder ring.
Apple also claimed that the new iPhone 3GS is more enterprise friendly. On the contrary, according to Zdziarski, the new iPhone 3GS encryption fails in protecting sensitive information such as credit card numbers and social-security digits. Infact, it is as easy to access illegal private information just as it was on iPhone 3G or iPhone – while both didn’t feature encryption. Live data can be extracted in hardly two minutes, while a complete raw disk image can be made in about 45 minutes.
Zdziarski says:
To steal an iPhone’s disk image, hackers can use popular jailbreaking tools such as Red Sn0w and Purple Ra1n to install a custom kernel on the phone. Then, the thief can install an Secure Shell (SSH) client to port the iPhone’s raw disk image across SSH onto a computer.
Now this was something to stop at. It reminds of the news of ‘Jailbreaking poses a security threat to iPhone’ – well that was in the context of the users own device. However, this is the use of jailbreaking to hack another device’s data. Long Live jailbreaking :P.
Zdziarski also added that it’s all upto the app developers to add security to their apps because the encryption is of no help here:
If they’re relying on Apple’s security, then their application is going to be terribly insecure,Apple may be technically correct that [the iPhone 3GS] has an encryption piece in it, but it’s entirely useless toward security.
With so many security issues highlighted and so many criticisms; its a blow on the face of Apple!
Will this harm the image of Apple? Will its users stop trusting it? Will you stop trusting Apple?
Lance Kidd, chief information officer of the Halton company said:
…Our culture is such that our general manager is saying, ‘I’m willing to take the risk for the value of the applications..
Are YOU willing to take this risk?
Does the fancy apps of the iPhone matter to you more than security of your personal information?
