Tag Info

New answers tagged

3

This was just a comment... tl;dresearch: as far as I know the only threat in your scenario would *potentially* come from a cold boot attack if the attacker could freeze your phone and do nasty things to it. Full disk encryption stores the decrypted file to be accessed in volatile memory. Thus, if the power is disrupted by any means, disk is left encrypted ...


0

For awareness and to illustrate the ease with which some attacks against 4 digit PINs are... In (much) earlier versions of iOS it used to be possible to connect the device to a laptop and boot the device from custom code, which exploited a vulnerability in iOS's boot process. The code could be configured to automatically brute-force the PIN, when completed ...


2

TL;DR: By Apple's own admission, brute force of a 4-digit numeric passcode takes about 3 minutes. Upgrading your passcode to 8-digit alphanumeric increases the on-device brute-force time such that a successful attack would probably need to exfiltrate the UID from the secure enclave -- however long that takes. Disclaimer: I'm not very familiar with the ...


6

Theoretically, an iPhone can be configured to encrypt all the "user data" with a key that is ultimately derived from your passcode. However, that does not really save you: If the attacker limits itself to the unmodified iPhone and just enters some potential 4-digit passcodes on the screen, then the attacker has a probability 1/1000 of success (10 tries, ...


2

The attacker can perform a man-in-the-middle attack on him self. Basic steps are: Setup a proxy like SSLsplit or Charles Proxy on a computer. Install a custom SSL root certificate on the device (iPhone). Add the proxy in the device settings. Now the device will route all traffic over the proxy. Normally you could not decrypt this traffic but the proxy ...


4

The attacker could Man-In-The-Middle attack their own iPhone by creating a custom CA. SSL/TLS prevents third parties they don't trust from listening in. The attacker has no reason to distrust themselves and their iPhone allows them to make it trust whatever they want. The format won't be safe, and shouldn't be (be, not contain) sensitive information.



Top 50 recent answers are included