Few days ago we have updated our iOS Forensic Toolkit to version 1.15 which includes some bugfixes and improvements and, most notably, supports passcode recovery on the new iPad (also known as iPad 3). There are no significant changes from the practical point of view (i.e. the process of passcode recovery is still exactly the same), but there is something new under the hood. So if you’re interested in iOS security and how stuff works, please read on.
Posts Tagged ‘passcode’
Today, we released an updated version of iOS Forensic Toolkit. It’s not as much of an update to make big news shout, but the number of improvements here and there warrants a blog post, and is definitely worth upgrading to if you’re dealing with multiple iPhones on a daily basis.
The newly updated Elcomsoft iOS Forensic Toolkit now supports iOS 5.1 and adds a number of small and not-so-small enhancements to the already sound package. The ability to try top 100 most common passcodes gives a chance to recover a passcode in a matter of minutes. There’s one more thing new with the updated iOS Forensic Toolkit: an iPhone booted with iOS Forensic Toolkit now displays a small ElcomSoft logo instead of the default one.
Top 100 Passcodes
We’ve seen lots of iPhones. Most are locked with simple, easy to remember passcodes. We were able to compile a list of most commonly used passcodes. There are the obvious ones like 1111, 2222, 1234, 5555, vertical raw 2580, and there are many ‘convenience’ passcodes that are just easier to remember or enter on the iPhone’s screen. There’s a whole range of passcodes representing possible dates significant to iPhone owners; these passcodes range from early 1930 to 2020. The updated iOS Forensic Toolkit will now try these passcodes before launching a brute-force attack.
How good are the chances? A recent study demonstrated that as many as 15% of all passcode sets are represented by only 10 different passcodes (out of 10,000 possible combinations). That’s 1 in 7 iPhones unlocked within minutes or even seconds.
iPhones booted by iOS Forensic Toolkit will now display ElcomSoft logo when loading. Not a big deal, but a nice and pleasant for us visual effect
We also added a few other improvements and enhancements here and there, making the new version a recommended update.
SANS Information Security Reading Room has recently publicized a whitepaper about iOS security where they mentioned our software – Elcomsoft iOS Forensic Toolkit – in a section about encryption. Kiel Thomas, the author of the whitepaper, explained one more time the main principles of iOS 4 encryption, which became stronger in comparison with iOS 3.x and how our toolkit can bypass new strong algorithms.
In its next part about iTunes Backups Kiel touches upon Elcomsoft Phone Password Breaker which virtually crunches backup passwords at speed of 35000 passwords per second (with AMD Radeon HD 5970) using both brute force and dictionary attacks, here are some benchmarks.
It seems the paper does not miss out on any nuance about iOS 4 and provides practical advice to either avoid or prevent from the depressing outcomes, such as loss of data. Closer to the end of the paper you will also find several sagacious tips for using the devices within organizations, including passcode management, a so called “first line of defense” which according Kiel’s view “can be matched to existing password policies”, however he inclines to use passwords instead of 4 digit passcodes.
And in conclusion the author discovers that smartphone and tablet security measurements resemble the ones of laptops, because they all belong to mobile devices. Find out more details in the source itself: http://www.sans.org/reading_room/whitepapers/pda/security-implications-ios_33724