“Properly configured, an iOS device is perhaps the most secure, general purpose communication device available,” Nicholas Weaver writes for Lawfare. “The iPod Touch in particular is my preferred communication device for those who need to operate in an extremely hostile network such as China or France, and for most users, iOS is vastly more secure than Android.”
“Despite this, ‘best’ does not mean ‘impregnable.’ The FBI claims that iPhones are ‘bricks’ containing no useful information and Apple claims that iMessage is ‘end-to-end’ secure. Neither is the case,” Weaver writes. “A suspect’s iPhone is hardly a brick, but rather a vast trove of information and iMessage, rather than being an impenetrable fortress, is actually metadata-friendly and seems designed to support a backdoor.”
“The IMEI on the back is enough information for the FBI to find the phone’s carrier and, with a simple warrant, gain a trove of information,” Weaver writes. “Smart phones continuously communicate on the cellphone network, and Apple’s Siri in particular will still use cellular connectivity even when on a WiFi network. This allows the FBI to discover the phone’s entire movement history as long as the phone was on. At a minimum, the cellular providers will provide tower-level information, localizing the phone within a few square kilometers on an effectively continuous basis.”
“But what about information stored on the phone itself, such as Joe Jihobbiest’s selfie with an ISIS flag? Unless the target knew how to set up his phone correctly, its actually straightforward to arrest someone with an iPhone,” Weaver writes. “Yes, an iPhone configured with a proper password has enough protection that, turned off, I’d be willing to hand mine over to the DGSE, NSA, or Chinese. But many (perhaps most) users don’t configure their phones right… Furthermore, most iPhones have a lurking security landmine enabled by default: iCloud backup. A simple warrant to Apple can obtain this backup, which includes all photographs (so there is the selfie) and all undeleted iMessages!”
“Finally, there is iMessage, whose ‘end-to-end’ nature, despite FBI complaints, contains some significant weaknesses and deserves scare-quotes. To start with, iMessage’s encryption does not obscure any metadata, and as the saying goes, ‘the Metadata is the Message,'” Weaver writes. “There are similar architectural vulnerabilities which enable tapping of ‘end-to-end secure’ FaceTime calls.”
Read more in the full article here.
MacDailyNews Take: It would be nice for Apple to issue an official statement addressing each of the points made in Weaver’s article, but we wouldn’t hold our breath waiting for it. We’d also like to see some independent security experts’ takes on these points.
SEE ALSO:
Edward Snowden supports Apple’s stance on customer privacy – June 17, 2015
U.S. Senate blocks measures to extend so-called Patriot Act; NSA’s bulk collection of phone records in jeopardy – May 23, 2015
Rand Paul commandeers U.S. Senate to protest so-called Patriot Act, government intrusion on Americans’ privacy – May 20, 2015
Apple, others urge Obama to reject any proposal for smartphone backdoors – May 19, 2015
U.S. appeals court rules NSA bulk collection of phone data illegal – May 7, 2015
In open letter to Obama, Apple, Google, others urge Patriot Act not be renewed – March 26, 2015
Apple’s iOS encryption has ‘petrified’ the U.S. administration, governments around the world – March 19, 2015
Obama criticizes China’s demands for U.S. tech firms to hand over encryption keys, install backdoors – March 3, 2015
Apple CEO Tim Cook advocates privacy, says terrorists should be ‘eliminated’ – February 27, 2015
Apple’s Tim Cook warns of ‘dire consequences’ of sacrificing privacy for security – February 13, 2015
DOJ warns Apple: iPhone encryption will lead to a child dying – November 19, 2014
Apple CEO Tim Cook ups privacy to new level, takes direct swipe at Google – September 18, 2014
A message from Tim Cook about Apple’s commitment to your privacy – September 18, 2014
Apple will no longer unlock most iPhones, iPads for police, even with search warrants – September 18, 2014
Apple, Google, others call for government surveillance reform – December 9, 2013
Why? MDN
By Apple responding to this bait, they give it more credence than it is worth.
Stick with the tried and tested method of not making a statement or reacting until an investigation has been done and the relevant issues identified and confirmed. Create a fix and upload it as an update and then make a statement to the effect of “Wot?! me worry??!!”
WOW, just so much STUFF to print in a blog. LOL
Can the NSA hack my phone? Sure. Sneak in at night, Find a way to get into my phone, even add a physical bug, and there you go. Wave your magic wand and suddenly ….. well, I am not sure what. LOL
I feel very safe sending my password to my son to use in a pinch, or put my credit card number (blue iPhone to iPhone). One whole lot better than using Android.
Is the iPhone perfect? Of Course not. but its the best thing out there, use it safely, and have fun.
“Can the NSA hack my phone? Sure. Sneak in at night..”
or they could just shoot you.
iMessage so seldom works that it doesn’t matter.
It works perfectly “kentd34”. From your post history, it would seem evident that most people, barring your family perhaps, and even then, probably just your mother, would never bother responding to you.
Maybe you’re just holding it wrong?
dmz
/s
What’s there to address? Apple can’t stop carriers from collecting information on you and the phone companies must know your location to provide you with cell service.
iCloud Backup has to work that way, after all it relies on you iCloud account password, but it’s easy to turn off and do local encrypted backups instead.
Finally iMessage, of course Apple has to see metadata, how else would they know where to send the message to? However the contents are encrypted which, while the author tries to dismiss, I think it’s still the most important.
Again this is an article that tries to distort simple facts into appearing more sinister.
Yeah, “metadata is the message” is a false assumption. It’s helpful, but it’s far from the message.
Turn off iCloud backup, disable all the usual suspects and load Signal for iOS- endorsed by Ed Snowden.
https://itunes.apple.com/us/app/signal-private-messenger/id874139669?mt=8
The EFF has posted a set up guide to get the full benefit of Signal
https://ssd.eff.org/en/module/how-use-signal-–-private-messenger
Wow. Never thought about iCloud backup.
Turning mine off, now. Backing up to my FileVault MacBook from now on.
Via Steve Gibson of GRC and the ‘Security Now’ podcast, we knew iMessage could actually be opened by Apple if they wanted. This is despite Apple’s claims to the contrary. No one ever said or expected iCloud Backup to be secure. And DUH if everyone doesn’t know any cell phone can be traced to at least a vague location via cell tower connections.
But FaceTime? He offers NO information about how FaceTime is hackable/tappable. I won’t believe him without data. I strongly suspect he is wrong about FaceTime. Even someone shoving a node inside the path of a FaceTime interaction would only see encryption noise. There is no known way that I’ve heard of to steal the encryption keys of either party. IOW: SHENANIGANS!
Please prove me wrong because I’d like to know.
So Apple! Fix iMessage and make it REALLY secure please. No baloney added this time.
Apple’s current iOS security document, for those interested. It covers iOS 8.3.
Click to access iOS_Security_Guide.pdf
you know a website is in need of traffic as more users use adblockers and Safari when they need to bait with this kind of nonsense, by posting this, MDN is must be hurting as well…essentially, the article is saying if you’re stupid, you will get hacked…duh…MDN, you need to evolve but giving nonsense an audience is the way to go…and your “takes” have been conspicuously lame lately…
BTW: I put ALL my personal data that I want kept secure into a 256-bit AES encrypted sparse bundle disk image. I created it using Apple’s Disk Utility. I have it set up to open as a volume every time I boot my Macs. I back it up via my space on Dropbox with no worries that Dropbox doesn’t offer encryption. I don’t care! The data is already encrypted.
My encrypted image is a couple GB in size, so you’d think it would be a big PITA every time Dropbox has to back up a newly updated version of the image. Nope! Because sparse bundles are multiple files in a ‘bundle’, only the changed file in the bundle has to be updated. I don’t even notice.
I have Dropbox on all my Macs, so I can access the latest shared update of my encrypted data anywhere. There are a few tutorials around the net about how to set up encrypted sparse bundle disk images, such as at MacWorld.com.