There are a lot of terrible news articles out there, and a lot of terrible “journalists” who have either over-hyped my research, or dismissed it entirely. After ZDNet’s utterly horrible diatribe about my research, I posted a proof-of-concept to help further clarify that was and wasn’t possible. Unfortunately, the FUD has continued, and so I thought it would make sense to help provide readers with some middle-of-the-road, and easy-to-understand technical links that would help make sense of everything.<\/p>\n
End users rely on backup encryption to protect the data on their phone in the event that someone either obtains physical access to an unlocked phone, or access to their computer. Enterprises rely heavily on the “force encrypted backups” MDM policy Apple provides to protect corporate trade secrets and other confidential information stored on employee phones. Having a backdoor to bypass this encryption can be very dangerous for both individuals and businesses. Additionally, the wireless component of this allows for remote and persistent monitoring, making this a potentially long term and stealth threat.<\/p>\n
Here’s a list of the technology articles I’ve found useful at explaining my talk and slides. While there may be a few slight technical inaccuracies here or there, these are all “good reads” that overall do a good job.<\/p>\n
New Backdoors Discovered in iOS? An Interview With iOS Developet and Digital Forensics Expert Jonathan Zdziarski<\/a> iOS Lockdown Diagnostic Services (TL;DR)<\/a> Surveillance Mechanisms in iOS Devices – Don’t Panic but… Do Read This<\/a> Apple iPhones allow extraction of deep personal data, researcher finds<\/a> Is Apple’s iOS Backdoor Not a Backdoor<\/a> iOS slurp ware brouhaha: It’s for diagnostics, honest, says Apple<\/a> Apple Snuck Backdoor Surveillance Tools Into Their (i.e. Your) iOS<\/a>* I’ve also recently posted a pastebin dump<\/a> of all the personal data I was able to wirelessly retrieve off of my personal iPhone running 7.1.2 using this service to bypass backup encryption, and with “iTunes Sync” turned off.<\/p>\n","protected":false},"excerpt":{"rendered":" There are a lot of terrible news articles out there, and a lot of terrible “journalists” who have either over-hyped my research, or dismissed it entirely. After ZDNet’s utterly horrible diatribe about my research, I posted a proof-of-concept to help further clarify that was and wasn’t possible. Unfortunately, the FUD has continued, and so I
\nKim Crawley, InfoSec Institute<\/p>\n
\nDino Dai Zovi, Co-Author “iOS Hacker’s Handbook”<\/p>\n
\nElissa Shevinsky, CEO of Glimpse<\/p>\n
\nReuters \/ Joseph Menn<\/p>\n
\nWall Street Cheat Sheet \/ Nathaniel Arnold<\/p>\n
\nThe Register \/ Iain Thomson<\/p>\n
\nMatthew Phelan, Gawker
\n* The headline is sensational, as per usual, but the article itself is quite balanced<\/p>\n