Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have a number of apps on my smartphone that store the passwords - facebook, mail, etc. So say the phone is lost or stolen and the finder decides he wants my passwords - what can he do to get them, and how safe is my data on the phone?
Is is doable to bruteforce the password given that the password is not super complex (say 6-digit) ?
Are there ways to find the password without bruteforcing?
Can a phone's (internal) memory be read without entering the password ? How hard is that ?
The answer to this question really depends on the phone in question. It may also depend upon when the passcode was created.
Most phones use the passcode for encrypting the data on a device (and of course decrypting when needed). With an iPhone, if you did not create a passcode originally and later decided to create 1 the data from prior to creating the passcode would remain in plain text on the device (unless the app maker encrypted the data themselves). Quite a bit of data on an iPhone is stored in sqlite databases which is essentially text files with a specific format.
With regards to the crackability of the passcode. Again this would depend upon the passcode. If you used the standard 4 number pin on an iPhone these are really quite trivial to brute force (a 6 digit number would be just as trivial). The difficulty in brute forcing a random password on the other hand would depend upon what characters were used and how long the password was.
There are other techniques that could be used. For example an indication on what is used for a password / passcode could be gained from fingerprints on the screen.
With the introduction of finger print technology on Android and Apple devices this also provides a different vector for gaining entry to the device. Taking a print of a users finger from a glass for example could give the person access (of course other work is necessary). Both Android and Apple devices were exploited fairly quickly when the finger print technology was introduced.
With regards to having access to the phone's memory without having the password. Yes this is certainly possible. Law enforcement do this quite regularly. A colleague of mine did his thesis on mobile security, he bought numerous phones off of eBay and used a device to connect to the phone. He was able to extract data from each without having access to the password.
