2

I understand that IOS 8 data can be encrypted when the phone is locked, and decrypted for use when the phone is unlocked.

But let's say the phone was unlocked (and thus the data is decrypted), and then immediately shut down (by, for instance, forcing a shutdown if the phone freezes). There will be no chance for the data to be encrypted, will there?

Is this security loophole?

3

This was just a comment...

tl;dresearch: as far as I know the only threat in your scenario would *potentially* come from a cold boot attack if the attacker could freeze your phone and do nasty things to it.

Full disk encryption stores the decrypted file to be accessed in volatile memory. Thus, if the power is disrupted by any means, disk is left encrypted and the decrypted files are gone. However, you may be able to do what is called a cold boot attack where you literally freeze the memory before power fails but I havent done the research to see if this is possible with a phone (I dont see why not) moreover, this requires the forensic examiner (malicious or otherwise) to freeze the memory before or very very soon after power is lost.

References:

More: (these are more apple specific, but still great)

2
  • Oh, thanks. If the file system is virtually implemented as volatile memory when decrypted, then it does not have vulnerability I describe. – prmph Nov 19 '14 at 1:26
  • As you described, not exactly unless the attacker can get to your phone quickly. Also, there are a few things that I should clear up. Apple just isnt your granny smith's apples... While they use FDE it's a secondary level and so your data may not be as protected as you think when the device is just locked. In fact, it is more secure when the power is off entirely. – Matthew Peters Nov 19 '14 at 2:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.