iPhone 3GS - Two Minute Encryption Cracking

[RoyGBiv]

More brilliance from the folks at Apple ...

Apple claims that hundreds of thousands of iPhones are being used by corporations and government agencies. What it won’t tell you is that the supposedly enterprise-friendly encryption included with the iPhone 3GS is so weak it can be cracked in two minutes with a few pieces of readily available freeware.

“It is kind of like storing all your secret messages right next to the secret decoder ring,” said Jonathan Zdziarski, an iPhone developer and a hacker who teaches forensics courses on recovering data from iPhones. “I don’t think any of us have ever seen encryption implemented so poorly before, which is why it’s hard to describe why it’s such a big threat to security.”

With its easy-to-use interface and wealth of applications available for download, the iPhone may be the most attractive smartphone yet for business use. Many companies seem to agree: In Apple’s quarterly earnings conference call Tuesday, Apple chief operating officer Tim Cook said almost 20 percent of Fortune 100 companies have purchased 10,000 or more iPhones apiece; multiple corporations and government organizations have purchased 25,000 iPhones each; and the iPhone has been approved in more than 300 higher education institutions.

But contrary to Apple’s claim that the new iPhone 3GS is more enterprise friendly (for reference, see Apple’s security overview for iPhone in business ), the new iPhone 3GS’ encryption feature is “broken” when it comes to protecting sensitive information such as credit card numbers and social-security digits, Zdziarski said.


More ...

Microsoft's response: "See, this is why free software is dangerous."

Okay, I made that last bit up.

[charlie]

1. Encryption probably offends Jobs' aesthetic

The Reality Distortion Field still works as good as ever.

"Your organization has to be culturally ready to accept a certain degree of risk," Kidd said. "I can say we’ve secured everything as tight as a button, but that won't be true... Our culture is such that our general manager is saying, 'I'm willing to take the risk for the value of the applications.'"

I like how he offloads responsibility on the GM, in a national mag no less. The fingerpointing will be epic when they get their shit stolen :D

And what's this about silent screenshots and keylogging? WTF, Apple? Is Cupertino enjoying the new laxity in marijuana laws a bit too much?