Image Capture can still download photos from a locked phone

Discussion in 'iOS 5 and earlier' started by ramuman, Mar 14, 2012.

  1. ramuman macrumors regular

    ramuman

    Joined:
    Mar 7, 2005
    #1
    This seems like a major security issue to me. On a locked iOS device, Image Capture can still be used with a USB/dock connector cable to download images from a locked iOS device.
     
  2. bmoorhouse macrumors regular

    Joined:
    Dec 13, 2003
    Location:
    Houston
    #2
    When connected to a Mac, IC sees the iPhone as a camera. If it is a security flaw for IC to be able to download images from an locked iPhone, then there is a security flaw in every digital camera ever made, probably none of which can be locked at all.

    Security is lost almost anytime someone has unsupervised, physical access to your device. At least with the iPhone, you can remotely wipe it if you lose it. No camera can do that either.
     
  3. Small White Car macrumors G4

    Small White Car

    Joined:
    Aug 29, 2006
    Location:
    Washington DC
    #3
    As the last poster said, this same "flaw" exists with every other single camera out there.

    If your camera gets stolen, they have your pictures.

    Would it be nice for the iPhone to have this extra feature over every other camera on earth? Yeah, sure. But should I expect it? I don't see why I should.
     
  4. gixxerfool macrumors 6502a

    gixxerfool

    Joined:
    Jun 7, 2008
    #4
    Just curious, is this with your phone and your computer? The reason I ask is because there are other programs that allow this as long as its already been synced to that machine. But once you go to an "unknown" machine it won't recognize the device or asks for a pass code.
     
  5. ramuman thread starter macrumors regular

    ramuman

    Joined:
    Mar 7, 2005
    #5
    It actually works across the board. I've just never thought of or tried it before. I tried it on computers at work and same situation. I just found it interesting in light of all the work that Android and iOS put into protecting photos on a stolen phone.

    I'd ideally think a locked phone should only be able to charge on the USB pinouts. That should be implementable in software pretty easily unlike with P&S cameras. I would've thought it was a benefit of not having a microSD slot.
     
  6. sub5pac3 macrumors newbie

    Joined:
    Jun 27, 2012
    #6
    Wow, I just confirmed this as well. This is terrible security! Apple makes no mention of this. If the phone was expected to act as most other cameras, it would have an SD card that could be ejected and stored in a safe place. I certainly have kept personally identifiable information in various photos, including license plates, potential trade secrets, etc. What else are they not telling us -- can any of the rest of the data be accessed in a similar manner?

    Why would anyone think a smart phone that advertises an encrypted storage system ever think the photos would be kept in some other unencrypted partition or volume? I was told the entire phone was encrypted. This is just stupid and sort of falls in line now with what I expect from the new Apple -- ignorance, arrogance, and without care for customer concerns of privacy and security. I'm most likely not going to bring them further business in any sense.
     
  7. soulsteelgray macrumors regular

    Joined:
    Mar 20, 2012
    #7
    If this has been how the iPhone has operated since day one, how is this an example of "the new Apple"? :confused:

    Personally, I don't see the issue. It's your own fault if you leave easily accessible confidential information lying around like that. If you're that paranoid about having your private photos accessed, then keep your phone on you at all times.
     
  8. gixxerfool macrumors 6502a

    gixxerfool

    Joined:
    Jun 7, 2008
    #8
    I can't seem to duplicate this. I have tried my 4S on the wife's machine and my friends 4 on mine and it still wants a passcode before doing anything.
     
  9. PNutts macrumors 601

    PNutts

    Joined:
    Jul 24, 2008
    Location:
    Pacific Northwest, US
    #9
    On Windows the iPhone appears in Windows Explorer and you can drill down to the photos / videos (camera roll).

    ----------

    It's an iPhone because it doesn't act like other "cameras" (and phones).

    No

    It is encrypted.

    That's fair.
     
  10. sub5pac3 macrumors newbie

    Joined:
    Jun 27, 2012
    #10
    "Lying around" like what? You think I would voluntarily leave my phone in insecure areas? I'm not being paranoid, either -- this is a very reasonable level of privacy to expect. Do you lock your car or house when you're not there? Do you expect people to be able to access your pictures in your desk drawer even thought the rest of the house is locked?

    Apple has advertised that the entire phone was encrypted and that user data was not accessible if it was lost or stolen. Personal info includes pictures, and so clearly their claim is false, and so this is a case of false advertising.

    So it's my own fault if I expect a device to actually be as secure as was advertised? Anyone who is satisfied with unencrypted storage (or encrypted, but with full decryption key present, like having a strong lock with a key dangling right beside it) deserves exactly what they get when their phone is lost or stolen.

    This is really stupid, and now I can see the reason Apple continues to make insecure products -- it is people like you who don't care that they were fed disinformation and still don't care that their pictures will not remain private if the phone is lost or stolen, and this somehow doesn't bother you. "Keep your phone on you at all times" -- wow, what terrific advice.

    Welcome to the wall of sheep. Prepare to get pwned with a security awareness like this. And, oh yeah, the Nigerian bank has made an error in your favor! All you need to collect the $5 million is provide your checking account number here in this forum.

    Ok, even personal beliefs aside, some people bought the iPhone, for among other reasons, because they thought they wouldn't have to bring a camera with them everywhere, and don't feel like worrying about what non-disclosure agreement violations they may be legally responsible for if they knowingly stored business related pictures on an unencrypted device. For those people, Apple had better provide a solution since they have claimed the iPhone was completely encrypted. It's easy to simply not use the camera at all, but that removes a key feature of the device, for which the original purchase may have been significantly influenced. These are grounds for which a class action can be initiated.
     
  11. ramuman thread starter macrumors regular

    ramuman

    Joined:
    Mar 7, 2005
    #11
    I hate that high-horse point of view. Mistakes happen even with care.
     
  12. BrianBaughn macrumors 601

    BrianBaughn

    Joined:
    Feb 13, 2011
    Location:
    Baltimore, Maryland
    #12
    There are several iPhone photo security apps, but I think they store the copied secured photos separate from the photo storage area. That would mean the secured photos wouldn't work with Photostream and probably wouldn't integrate with most other features of the phone.

    It seems like Apple could add an "Encrypt Photos" switch that could keep the sort of USB downloading discussed here from working while not affecting normal usage of the photos.

    Sounds like a jailbreak tweak opportunity.
     
  13. xtedx macrumors newbie

    Joined:
    Oct 18, 2009
    #13
    same here

    also with my iPhone 3g. it says: "please unlock iphone"

    I noticed the 'new behaviour' with iOS 6, my sister's iphone charged on my computer and Image Capture showed all her pictures even when the phone is locked.

    the old behaviour is definitely more secure.

     

Share This Page