Ankita
Member • Feb 15, 2011
Password retrieval in lost or stolen iPhones/iPads [Video Inside]
Scientists at the Fraunhofer Institute for Secure Information Technology (SIT) test laboratory in Germany have shown how someone who steals or finds an iPhone or iPad can use existing software to “jailbreak” the device and gain access to the command shell. A secure shell (SSH) server can then be installed to enable them to run their own software on the device. Both procedures can be carried out even if the device is locked.
The attackers can then upload a script to the device to use the device’s own tools to give them access to the keychain, which is Apple’s password management system. The keychain entries can then be downloaded to the attacker’s computer.
The attack is successful because in the current operating system in “i” devices (iOS) large parts of the file system are accessible even if the device is locked, and the cryptographic key is not protected by the passcode.
[video=youtube;uVGiNAs-QbY]https://www.youtube.com/watch?v=uVGiNAs-QbY[/video]
Information Source: physorg.com
The attackers can then upload a script to the device to use the device’s own tools to give them access to the keychain, which is Apple’s password management system. The keychain entries can then be downloaded to the attacker’s computer.
The attack is successful because in the current operating system in “i” devices (iOS) large parts of the file system are accessible even if the device is locked, and the cryptographic key is not protected by the passcode.
[video=youtube;uVGiNAs-QbY]https://www.youtube.com/watch?v=uVGiNAs-QbY[/video]
Information Source: physorg.com