Apple acknowledges iOS 10 security flaw that makes it easier to access protected iTunes backups

A new discovery by iOS forensics company Elcomsoft has revealed that encrypted iOS backups via iTunes are much easier to crack with iOS 10 than in past years. The change in security is apparently due to a new password verification method in iOS 10.

The discovery centers around the idea that the backup method used in iOS “skips certain security checks” that were present in past versions of iOS, thus allowing passwords to be attempted signficnatly faster than before. Interestingly, the new backup method works alongside the old back up method, meaning that for pre-iOS 10 backups, the old method is used.

When working on an iOS 10 update for Elcomsoft Phone Breaker, we discovered an alternative password verification mechanism added to iOS 10 backups. We looked into it, and found out that the new mechanism skips certain security checks, allowing us to try passwords approximately 2500 times faster compared to the old mechanism used in iOS 9 and older.

This new vector of attack is specific to password-protected local backups produced by iOS 10 devices. The attack itself is only available for iOS 10 backups. Interestingly, the ‘new’ password verification method exists in parallel with the ‘old’ method, which continues to work with the same slow speeds as before.

Essentially, this means that it’s much easier for someone to gain access to an iOS backup that they shouldn’t have access to. iOS backups store every piece of data from a phone, including Keychain passwords, phone numbers, and more. With the iOS 10 change, Elcomsoft’s tool is able to try 6 million password guesses per second and has an 80 percent to 90 percent chance of getting the correct password.

Apple has acknowledged the issue in a statement to Forbes, saying that it is working on a fix. The company also added that the issue doesn’t affect iCloud backups. Until the fix is implemented, though, Apple recommends that users ensure that their computers are protected with strong passwords.

“We’re aware of an issue that affects the encryption strength for backups of devices on iOS 10 when backing up to iTunes on the Mac or PC. We are addressing this issue in an upcoming security update. This does not affect iCloud backups,” an Apple spokesperson said. “We recommend users ensure their Mac or PC are protected with strong passwords and can only be accessed by authorized users. Additional security is also available with FileVault whole disk encryption.”

It’s unclear when Apple plans to implement a fix for the issue, but the company is currently beta testing iOS 10.1 and recently released iOS.0.2 to the public. The update will likely come sooner rather than later now that this issue is public, though.