Naturally, hackers immediately pounced on the recently released iOS 10 to exploit possible vulnerabilities. One was not disappointed after finding serious weakness to an iTunes backup security that can possibly compromise the entire iOS device.
Elcomsoft, which calls itself an iOS forensics company, discovered that Apple may have severely compromised password security in iOS 10. This is blamed on the introduction of an alternative password verification mechanism, which allows a hacker to skip several security checks and proceed on attempting passwords up to 2,500 times faster. To put this in context, when Elcomsoft carried out an attack, the tool called Elcomsoft Phone Breaker experienced a 40 times performance boost in comparison to an attack on iOS 9.
The vulnerability in the iOS 10 backup security is purportedly critical. Today's iterations of the iOS 10 become increasingly difficult to jailbreak, particularly with the strength of Apple's decryption technology. This then renders the backup data as hacking alternative through a method called logical acquisition.
"Forcing an iPhone or iPad to produce an offline backup and analyzing resulting data is one of the very few acquisition options available for devices running iOS 10," Elcomsoft's Oleg Afonin said in a blog post. "If you are able to break the password, you'll be able to decrypt the entire content of the backup including the keychain."
Other experts confirm Elcomsoft's discovery. For instance, Per Thorsheim, a password security specialist, pointed to the manner by which Apple developed a weaker algorithm for backups stored on computers. This turns passwords into a "hash" or a string of numbers and letters. The simpler the algorithm, as is apparently the case in iOS 10, the easier it is to find password match.
In iOS 9, the algorithm used was PBKDF2, which requires a password run of about 10,000 times. The recent iOS 10 algorithm SHA256 only requires one iteration, which makes the password cracking process not just easier but also significantly faster.
Since the implementation works and Apple has introduced several iOS 10 beta versions prior to its public release, the current security weakness is not a mistake, according to Thorsheim.
Apple is now working on a fix as it moved to reassure users through a statement to Forbes.
"We are addressing this issue in an upcoming security update," the company said. "We recommend users ensure their Mac or PC are protected with strong passwords and can only be accessed by authorized users."
There is no word yet about the security fix release date. Users should take heart, however, on reports that indicate Apple is already beta testing iOS 10.1.
Photo: John Karakatsanis | Flickr
