I use iOS7 with a 4-digit passcode that isn't on any top 10 lists. I have "Erase all data after 10 failed passcode attempts" turned on.
How hard would it be for someone who stole my phone to get access to my email?
5
-
4Your email is not the only thing at stake here. A 4 digit code isn't hard to exhaust. An attacker most likely won't care if your data is erased. If your passcode is anything related to you in some way I'd say 10 guesses isn't as much of a long shot as you might think, and they'd have access to everything on your phone. Not just your email. – RoraΖ Nov 14 '14 at 19:43
-
1Note that someone can seriously Denial of Service (DoS) attack you by just trying to access your iPhone 10 times and then it would erase all your data... – Jonathan Nov 14 '14 at 20:50
-
@raz email unlocks all the accounts you have on every site ever, so that is my main concern. – John Shedletsky Nov 14 '14 at 21:30
-
2@Jonathan I can seriously DoS your computer by hitting it with a hammer if I get physical access to it, so what is your point? – John Shedletsky Nov 14 '14 at 22:04
-
What does "access" mean? If you have email notifications enabled on the lock screen (I believe this is enabled by default) then anyone will be able to see the first parts of your most recent unread emails just by swiping down. – asmeurer Nov 14 '14 at 22:41
Add a comment
|
Theoretically, an iPhone can be configured to encrypt all the "user data" with a key that is ultimately derived from your passcode. However, that does not really save you:
If the attacker limits itself to the unmodified iPhone and just enters some potential 4-digit passcodes on the screen, then the attacker has a probability 1/1000 of success (10 tries, 10000 possible codes). That the data is encrypted is irrelevant here.
If the attacker opens the iPhone case and dumps the Flash chip contents, then he can try all possible 4-digit passcodes; there are only 10000 such codes and each try will need much less than one second on a basic PC, so he will be done within less than 3 hours. Since, in that scenario, the attacker works on the data dump, not with the phone itself, there is no automatic erasure. The encryption layer does not save you; at best, it delays a bit the attacker, but not by much (3 hours instead of immediate access). Note also that whether the encryption layer was done properly is questionable.
With a 4-digit passcode, your safety relies on how hard it is to physically open the case and access the data directly from the Flash chip. It will deter most phone thieves, who, after all, wanted the phone, not your data. However, a determined attacker will be able to do the dump. If your attack model includes such a determined attacker, then:
- you need to activate encryption;
- your passcode must have a lot more entropy than a 4-digit passcode (12 digits would be a minimum, more are better);
- you still have to pray that Apple did not goofed up with the encryption.
-
-
I am not sure it is documented, but it must run on the iPhone hardware within the severe time constraints of the user's patience. So it cannot be that expensive. – Tom Leek Nov 14 '14 at 20:55
-
I agree that it shouldn't be too expensive. I'm just curious as to how plausible it would be for someone to actually determine the scheme, then go through the trouble of stealing an iPhone, tearing it apart, and downloading the flash image. – RoraΖ Nov 14 '14 at 20:59
-
2The second bullet surmises that the key can be algorithmically derived from the passcode. It seems plausible that instead, while the device is locked, a high-entropy key is stored only in a "trusted" area of hardware (a la bitlocker PIN+TPM), and that key is unlocked with the passcode. The premise in that case is that the key is much more difficult to exfiltrate from the "trusted" area of hardware than brute-forcing the 4-digit password after dumping the plain-old flash. – alx9r Nov 14 '14 at 21:38
-
Interesting. It looks like a high-entropy key is derived algorithmically from, in part, the passcode. However, this is done in a separate chip containing and using a unique ID. This arrangement complicates performing an offline brute-force attack and limits the online attempt rate. See my answer for more details. – alx9r Nov 14 '14 at 23:25
TL;DR: By Apple's own admission, brute force of a 4-digit numeric passcode takes about 3 minutes. Upgrading your passcode to 8-digit alphanumeric increases the on-device brute-force time such that a successful attack would probably need to exfiltrate the UID from the secure enclave -- however long that takes.
Disclaimer: I'm not very familiar with the iOS security implementation. This answer is based on Apple's vague disclosures and various assumptions some of which may well be incorrect.
Passcode Brute Force Time without knowing UID
According to Apple's October 2014 iOS Security Whitepaper each brute force attempt of the passcode would take approximately 80 milliseconds.
The passcode is entangled with the device’s UID, so brute-force attempts must be performed on the device under attack. A large iteration count is used to make each attempt slower. The iteration count is calibrated so that one attempt takes approximately 80 milliseconds. This means it would take more than 5½ years to try all combinations of a six-character alphanumeric passcode with lowercase letters and numbers.
I don't know what definition of "entangle" Apple are using here, but I'm guessing they mean that a decryption key that protects your data is derived from the device's UID and the passcode.
UID Exfiltration
Apple asserts that "brute-force attempts must be performed on the device under attack" as opposed to some other device with much faster iteration speeds. I'm guessing Apple bases this assertion on the (unsubstantiated) assumption that the UID cannot be exfiltrated. Apple state that the UID is stored in their "Secure Enclave":
Each Secure Enclave is provisioned during fabrication with its own UID (Unique ID) that is not accessible to other parts of the system and is not known to Apple.
I did not find any information speaking to the feasibility of exfiltrating the UID from the "Secure Enclave". If the UID is exfiltrated, then an attacker should be able use other computing hardware to brute-force at a much higher speed than 80 ms per attempt. Exfiltration of the UID may even mean that the brute-force time becomes trivial.
How long will an attack take to succeed?
Assuming that
- your passcode really isn't easily guessed,
- Apple's whitepaper accurately describes the implementation, and
- Apple did not make any mistakes that weaken the protection beyond what is described in the whitepaper
then, roughly speaking, the amount of time an attacker requires to brute-force your passcode is the lesser of
a) on average, 40 ms * a^n where a is the number of possibilities for each digit, and n is the number of digits, and
b) the amount of time required to exfiltrate the UID from the "Secure Enclave".
How long should your passcode be?
A 4-digit numeric passcode would take an average of about 7 minutes for a suitably equipped attacker to brute-force, which is surely easier than exfiltrating the UID. Therefore, your security probably would benefit from upgrading to a 8-digit alphanumeric passcode which would take an average of about 7000 years to brute force. With a 8-digit alphanumeric passcode, it would probably be faster for an attacker to exfiltrate the UID.
