Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

iOS 7 Security Flaw Leaves Stored Email Attachments Unencrypted [Updated]

I must have put a decimal point in the wrong place or something. ****! I always do that. I always mess up some mundane detail.
 
I don't care about vulnerabilities that require physical access to the device

in fact, i would prefer they exist, so the likelihood of a jailbreak being released increases :p
 
556fmjoe said:
Of course. This is why PGP should be the default, and it's mind boggling that it still isn't. But this particular problem is still a concern either way.
Click to expand...

Yes, it would be really nice if something like PGP was in wide spread use. It would not only fix this problem but avoid the difficulty of trying to work out when emails from banks etc are actually phishing attempts.
 
Omniver said:
You're missing the point. The risk isn't so much someone targeting you and trying to steal your phone to get the attachments, it's about being able to reasonably believe that the data is safe on lost/stolen phones.
Click to expand...

Correct. For the enterprise, the possibility that PII data can be stolen is much more important than whether it is likely to be stolen. Apple directly markets to corporate IT departments. If those companies' documented (and possibly audited) security controls claim encryption at rest, then yes... this is very important.
 
So is it safe to say that, with all of the major bugs coming up, that either Apple doesn't know what's going on in its software anymore, or they have been 'bought' by the NSA, or some other group(s)?

That 'goto' bug was a junior programmer mistake from what I could gather, and this one is something that you would at least think *someone* would have caught before it was incorporated into the final shipping version.

OR is this Apple having a meltdown over the increasingly short development times necessary to keep their shipping windows.

Either way, so much for Apple's stuff being 'secure'... It's like Microsoft, where everything they shipped should have been classified a 'public beta'...

Memories of a programming prof in college: 'Nothing tests like shipping it'...
 
Omniver said:
You're missing the point. The risk isn't so much someone targeting you and trying to steal your phone to get the attachments, it's about being able to reasonably believe that the data is safe on lost/stolen phones. Think about the huge number of corporate users who have attachments containing company information or personal information about their clients (maybe about you and me). Before this flaw, if a company phone was lost in a Taxi there was a very reasonable argument that the attachment data was protected by separate encryption keys requiring a physical unlock of the device to be able to access. With this flaw, it appears that this is no longer true and the data on a lost phone is recoverable without unlocking the phone. This potentially, depending on jurisdiction, equates to a reportable data breach every time a phone with NPPI is lost.

This is a big deal.
Click to expand...

You know, I can erase my phone remotely via any web browser. To say nothing of the fact that any email attachments I consider sensative are encrypted separately, since the much larger concern is that they be safe from prying eyes in transit.

Is this a problem? Sure. A big deal, though? I wouldn’t classify it as that. Apple should fix it, yeah, but it really should not be freaking people out a whole ton, and there’s probably other security holes that need to be patched first.
 
ghostface147 said:
The sky is falling!
Click to expand...

No, but the number, and types of bugs coming to light are troubling and *could* point to a systemic problem at Apple. The fact that they have all been security related could make one question why they weren't detected before now...

----------
SusanK said:
My iDevice running iOS 6.1.6 is the only one that leaves the house.
Click to expand...

Love your sig...
 
This needs to be fixed even though it would only affect a few people.
Anyone trying to send important documents via email though should think again.
 
BruiserB said:
I agree this shouldn't be blown out of proportion. The likelihood of an individual being affected is low.

With that being said, I'm guessing it's not just the physical phone that would be vulnerable....wouldn't backup files either on a PC/Mac or in iCloud also have the same unencrypted attachment issue? Or is the whole backup file encrypted again as it is archived?
Click to expand...

If they choose the option to encrypt their iPhone backup on their Mac then it will be encrypted. Otherwise it will be open as is all of the information from the iPhone (emails, texts, photos, location history, and much more).
 
If my phone is not jailbroken, and has password protection on it, and has Lost my iPhone enabled, and the phone is locked, is it still possible to access the filesystem without a fingerprint or password? I highly doubt it. If I lost my iPhone I would check where it is, if I don't recognize the location, I'll just wipe it. Problem solved.
 
spazzcat said:
When you email an attachment its not encrypted.
Click to expand...

Perfectly stated.

----------
00sjsl said:
I'm not sure why there would be encryption specific to emails / attachments. I always assumed that it would have whole disk encryption or none at all.
Click to expand...

It seems that the phone itself should be sort of "file vault" encrypted anyway. I know encryption slows down things, but I use FileVault on my rMBP to encrypt the disk and I've never had any issues. The thing I carry around the most (my phone) I really want locked down with whatever it takes.
 
I would LOVE to know how he 'verified' this on the 5S too because you can't do anything that he did on the iPhone 4 to the 5S :p
 
pogoyoyo said:
Apple needs it's software engineers to sit down, think of every single possible security feature/flaw, make sure it's in place and working, and then move on with whatever else they were working on.
Click to expand...

Listening to the audiobook "Exploding the Phone." A bunch of teenagers, including many blind teenagers actually, cracked the telephone infrastructure as early as the 50s, but by the early 60s, hundreds/thousands of kids were playing around hacking telephone lines/systems.

Anyway, engineers, when told of what these kids were doing, refused to believe it was possible at first. In their minds, the entire system worked as it should. However, as we know in today's work, people go and use systems not how they should be used, but rather trying to find exploits, bugs, etc.

The problem is, I think even today, too many companies create hardware/software for how it *should* be used by the masses, but in focusing on how it should be used, they neglect all the things that *can* be done and with enough curiosity, will be done.
 
NMBob said:
Go download a copy of iExplore. Poof -- your entire phone in basically a Finder window. It's not hard at all. I had to buy a copy to get all of the music off of an old iPod.
Click to expand...

iExplorer requires the device to be authenticated or trusted with the connected computer. If you find a device in a taxi that has a pass code on it, iExplorer cannot acces the device's contents because your computer is not trusted.

TantalizedMind said:
iOS 6: Stronger than you thought! My email attachments are secure! Booyah!!
Click to expand...

Not if they are download on an iOS 6.0-6.1.5 device. The https protocol is broken on those versions of iOS allowing complete download of the attachments and emails.
 
Traverse said:
I wonder if this vulnerability is present in OSX...
Click to expand...

First, it's OS X, with a space, and that's pronounced "Oh-Ess-Ten", not "Oh-Ess-Ex" like so many newbs to the Mac like to say. Secondly, OS X never encrypts mail attachments on disk. What would be the point of just encrypting this type of file? The way to achieve disk-level encryption is to use FileVault, which encrypts the entire disk, protecting all files, not just mail attachments.

I'm curious if Apple intentionally left this feature turned off with mail attachments as a battery-saving tradeoff. Encryption and decryption is expensive. Since most attachments are not secured anyway (ie. there's always at least two copies, one at the senders side, one at the receiving side), what would be the point of encrypting them on disk? If a document is that sensitive, it should be password-protected or never sent by email anyway.

----------
furi0usbee said:
Perfectly stated.

----------



It seems that the phone itself should be sort of "file vault" encrypted anyway. I know encryption slows down things, but I use FileVault on my rMBP to encrypt the disk and I've never had any issues. The thing I carry around the most (my phone) I really want locked down with whatever it takes.
Click to expand...

For the FileVault-like encryption to happen, it still happens on a per-file basis, just through an API. Applications are responsible for employing that API, and clearly the Mail engineers didn't use it for attachments. They used the normal non-encrypted API.
 
This security flaw is more of a concern for those who are high profile and may have sensitive data on their phone. Someone somehow steals their iPhone and they can gain access to confidential email attachments. Doing a simple query (e.g. ls *.pdf) will spit out only PDF files and I imagine most important/confidential documents are stored in PDF format and rarely lack any form of encryption.

So, for the average user, not a big deal, but for enterprise environments, a bit of a worry.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back