4

All iOS devices from the iPhone 3GS have a hardware encryption chip, right?

When you erase an iOS device with the "Erase All Content and Settings" menu item or via Remote Wipe the encryption keys are deleted. However, the data is still present on the device in an encrypted state.

Does this mean that forensic experts or perhaps anyone with the right tools can retrieve the data and decrypt it by other means?

Has Apple left a backdoor of some kind for law enforcement and security professionals?

As an aside there is an app called iShredder that claims to use various military grade wipe algorithms that can wipe your iOS device, but I don't see how this is possible as all iOS apps are sandboxed.

UPDATE: I know understand what iShredder does after Jonathan Garber's and Lucas Kauffman's comments.

Improve this question
8
  • 4
    "Military Grade Wiping Algorithms" is a load of bull imo. There are a few shredding algorithms out there but nulling the address space where the file recided once, should be adequate.
    – Lucas Kauffman
    Commented Mar 30, 2013 at 16:28
  • @LucasKauffman but how can iShredder supposedly do any wiping outside of its sandbox? Has Apple given the developer special permissions or is the whole app a marketing ploy.
    – joshu
    Commented Mar 30, 2013 at 17:11
  • It has no special permissions. The site says that files to be shredded must be deleted before running the app. Essentially all it does is generate random data to overwrite free space on the device. That's not particularly special.
    – Jonathan Garber
    Commented Mar 30, 2013 at 17:23
  • @JonathanGarber so in other words it generates data within its own sandbox which uses whatever algorithm to make that data random and then once it has filled up the "empty space" it marks that data as deleted.
    – joshu
    Commented Mar 30, 2013 at 17:29
  • 2
    related: security.stackexchange.com/questions/29521/…
    – rook
    Commented Mar 31, 2013 at 4:39

1 Answer 1

Reset to default
5

When you do a remote whipe on your iphone, the encryption keys are deleted making the data unreadable. However, if you later find your iphone you can restore your data using mobileme to re-download the encryption keys. So the encryption keys are still stored on Apple servers.

Hence, it would make sense that law enforcement can certainly ask Apple for the encryption keys stored on their servers. Also, I am not sure what sort of encryption algorithm the iphone uses, it might not be so hard to intelligently brute force the encryption keys.

EDIT: by doing some googling, I cam across this: http://www.iosresearch.org/ and https://viaforensics.com/resources/white-papers/iphone-forensics/. However, it looks like Zdziarski method requires the hardware encryption keys to be present on the device.

Improve this answer
3
  • 1
    While it might be possible to brute-force a password on an encryption key, brute forcing a modern encryption key itself is impossible short of implementation failures or major scientific breakthroughs.
    – mgjk
    Commented Apr 5, 2013 at 14:19
  • Are you sure that the encryption keys are stored on Apple's servers?
    – joshu
    Commented Apr 10, 2013 at 21:11
  • Yes, because if you wipe your iPhone, and later find it, you can restore data from the mobileme website, and all that does is re-download the encryption key.
    – marcoo
    Commented Apr 11, 2013 at 13:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .