Can malware read keychain entries on iOS devices?

Question

Keychain entries of a 3rd party app are protected according their 'protection class'. For example, assigning the class 'kSecAttrAccessibleWhenUnlocked' to a keychain entry means that the entry is only accessible when the device is unlocked.

Regarding this scenario, I have the following questions:

• Am I right in assuming that the sandbox principle within iOS ensures that each 3rd party app is only allowed to access keychain entries which were created by this app?

• Does iOS automatically decrypt all keychain entries with that protection class as soon as the device gets unlocked (i.e. without that the app that owns this entry actually asks for access)?

• If yes is the answer to the above questions, would this mean that on a jailbroken device, a malicious application (i.e. trojan) could read EVERY keychain entry while the device is unlocked? (No sandbox on a jailbroken device means access to every keychain entry and keychain entries are in plaintext when the device is unlocked).

Thanks in advance.

Answer 1

I saw this question and decided to do a bit of research into the topic. I'm actually an (ex)Apple Technical Support Senior Advisor for iOS, now working for FileMaker, Inc. which is a subsidiary of Apple. My iOS device is jailbroken. So I decided to do some sniffing around the filesystem with iFile to take a closer look at the keychain application, where is stores the keys and how it handles them.

Now, before I give my answer, I do want to make clear that 'malware' on an iOS device is nearly impossible. That said, your answer actually depends on whether you're using iOS 4.x (or later) or not and (get ready for this) whether you have a pass-code on your device or not.

When there is a pass-code on your device, the OS actually treats that as a second layer of security within the keychain. More specifically, it is an encryption key.

The answer is yes. But only in the scenario where you have a weak enough pass-code to decrypt.

Here is a link to the page that confirmed this:

https://stackoverflow.com/questions/3558252/ios-keychain-security

I would like to refer you to pepsi's answer to a very similar topic on this page. He provides links to a study that has been done and also explains the details of the topic.

Answer 2

Any chroot circumvention will leave you vulnerable, period.
Malware is far less likely on an iOS device but yes you are correct the pass is critical. Hope that helps, iceberg

Answer 3

Yes, there is iOS malware. There is no need for proof. Googling for 2 seconds will find plenty.

Yes, it is possible to completely bypass the passcode and/or keychain credentials remotely or physically with an iOS device.

The passcode will technically protect the data protection store (this is referred to as "iOS data protection" and is different than the keychain store), but only if it's a very large (14 characters or more) and very complex (numerous avalanches of numbers, symbols, plus upper and lower characters).

It is best to not store anything sensitive on the keychain, but instead to use it as a gimmick, much like the rest of the security features on the iOS platform.

Also try googlging for KeychainViewer and keychain-dumper.