Apple admits that iPhone iOS 10 has certain vulnerabilities that hackers can take advantage to lift sensitive user credentials. However, the tech giant is quick to assure that a fix is already in the pipeline.
To recall, digital forensic experts from Russian firm Elcomsoft tested iOS 10 for potential risks. What they found is a weak spot in the new Apple password system and the availability of alternative verification. Although the intent is added flexibility for forgetful iPhone users, it pays the price of vulnerable local backups.
Comparably, the previous iOS 9 uses solid password system with 10 thousand iterations to lock up credentials, making them secured as Fort Knox. The new Apple iOS 10 uses a different approach with 256-bit secure hash algorithm 2 or SHA2. This is still a solid defense but anyone with ample knowledge about brute-force hacking can break the code, Computer Weekly said.
What made Apple think twice about pushing with 256-bit protection for the new iOS 10 are claims from Elcomsoft that they cracked the shell of defense. The firm tried password combinations with CPU-only and GPU-assisted methods and both yielded alarming results. This attack can be executed at lightning-speed 2,500 faster in iOS 10 compared to predecessor iOS 9.
Meanwhile, developer Oleg Afonin wrote in Elcomsoft blog that physical iPhone is not an option anymore for hackers. This is mainly because Apple iPhone is a tough challenge and there is no known jailbreak for iOS 10 for now. However, a good trick is to force iOS 10-equipped iPhone or iPad to build an offline backup.
Theoretically, the first step is to break the iPhone password and then crawl through the backup. Anything is possible by then including keychain lifting and data stealing. Most vulnerable among these data are device credentials, credit card footprints left during apps or iTunes music purchase and login details.
