A team of researchers at Johns Hopkins University has found a way to crack open files sent as encrypted instant messages in Apple’s iMessage app, according to news reports published Monday.
Although it took months to do, the researchers, led by Professor Matthew Green, were able to brute force a 64-bit encryption key, allowing them to unscramble an image file stored in Apple’s iCloud.
In order to intercept the transmission containing the key, they wrote software to mimic an Apple server. The transmission contained a link to a photo in Apple’s cloud and the encryption key.
Once in possession of the key, the researchers would change a letter or number in it and submit it to the target phone. When they made a correct guess, the phone would acknowledge it. By repeating the task thousands of times, they eventually cracked the key, and the target image decrypted.
Apple Responsiveness
Although the researchers targeted an iPhone with an older version of the iOS operating system, Green told The Washington Post that a modified version of the attack would work on newer versions of the operating system. However, Apple patched the vulnerability in an update, iOS 9.3, released Monday.
“Apple responded to us very quickly and took the issue seriously,” team member Ian Miers said.
“It took some time to patch because it affected more than just iMessage,” he told TechNewsWorld.
Tripwire has worked with Apple in the past and found it easy to work with, although delays between reporting a problem and fixing it are common, said Lamar Bailey, director of security research and development.
“Any large company that has very popular applications can take a long time to fix an app because there’s a lot of testing they have to do,” he told TechNewsWorld.
Bad Security Design
The flaw the researchers found was an implementation error, not a problem with Apple’s encryption algorithm, Bailey noted.
“Because it tells you when you get a digit right, it allows you to brute force the correct number,” he said. “It still takes forever and it has to be done for each and every item on the phone, but you can eventually get to them.”
Because of the effort it takes to exploit the flaw, it’s not considered a high-level risk.
“The risk is fairly low, as this does not appear to be something that is broadly useful,” said Lysa Myers, a security researcher with Eset.
“The risk of not using encryption at all is far greater than the risk of using encryption software in which a vulnerability is found and quickly patched,” she told TechNewsWorld.
“The risk for most iPhone users is relatively low,” noted Elad Yoran, executive chairman of KoolSpan.
“This was a very sophisticated attack that requires meaningful resources and expertise to perform,” he told TechNewsWorld.
Other Flaws Possible
Because the scope of an attack exploiting the flaw would be so narrow, its appeal would be limited.
“The only case that makes any sense is if someone were targeting a government official or a celebrity,” Tripwire’s Bailey said. “Even then, it would take months and a ton of equipment.”
However, the flaw could lead to more discoveries, noted Bailey’s colleague Tim Erlin, director of IT security and risk strategy.
“Often in cases where you find one vulnerability in an implementation, it causes security researchers to look for similar types of vulnerabilities in other implementations,” he told TechNewsWorld. “So we may see some follow-on consequences with some new vulnerabilities discovered.”
Myth of Encryption
In recent weeks, the FBI has hailed encryption on Apple’s phones and computers as impenetrable. The Johns Hopkins researchers appear to have thrown some cold water on that idea.
“The main takeaway is that encryption is hard, even if you know what you are doing,” Miers said.
“Apple has some of the best cryptographic engineers in the business, and yet they made a mistake. Imagine what would happen if they tried to do something more complex like adding a backdoor,” he continued.
“The same people in the government who are saying backdoors can be done safely,” Miers added, “said iMessage was completely secure.”
[SOURCE :-technewsworld]