Over the last few months a number of vulnerabilities have been found within the iOS platform that could potentially allow some ethically challenged individuals to gain access to certain parts of a user’s handset if it is lost or stolen, even if a passcode lock is enabled. The methods used have generally been long winded and allows access mainly to the device’s Camera Roll, recent call logs, as well as allowing the perpetrator to be able to make outgoing voice or FaceTime calls in some cases. Being able to circumvent the passcode lock and access that kind of minimal data is concerning, but on the grander scale of things hardly represents a massive breach.
Those little tricks and vulnerability hacks also seem to pale into insignificance after watching the attached video demonstration by Swedish security firm Micro Systemation. The company generally spend most of their time providing their services to police and military forces around the world, attempting to break through security systems on their behalf for whatever reason those forces may have. The tools provided by the company are purchased by governments to allow their forces to access possible sensitive data that can be found on the smartphones of suspected individuals or military prisoners.
One such tool, that Micro Systemation calls ‘XRY’, is demonstrated in the video and shows just how easy it can be to access a passcode locked iOS device using vulnerabilities and exploits similar to those which jailbreak dev teams take advantage of. The tool quickly bypasses any device security and then efficiently dumps device data such GPS data, call logs, contact data, text or email messages as well as a log of all keystrokes on the device.
Micro Systemnation products are available for sale in over sixty countries throughout the world, with market director Mike Dickinson claiming that the company supplies software to 98% of the United Kingdom’s police departments, as well as the Federal Bureau of Investigation in the United States. Probably unsurprisingly, Dickinson also elaborates on the fact that the United States military is their largest single customer.
The company constantly has to reverse engineer newly released firmware versions in an attempt to find security flaws in the software, rather than use any back-door vulnerabilities that may have been left by Apple or Google. Almost 50% of the company’s staff base is dedicated to this process, constantly looking for new bugs that they can use for their software. We mustn’t forget that there is genuinely a real world requirement for tools such as these, but considering the methods used are intrinsically linked to how we ultimately get our jailbreak software, it does paint a rather worrying picture about the security of our data.
(via Forbes)
You can follow us on Twitter, add us to your circle on Google+ or like our Facebook page to keep yourself updated on all the latest from Microsoft, Google, Apple and the web.