Hacker News Reader

Comment by yzzxy | Hacker News Reader

From a Feb. 2014 Apple Security whitepaper[0]:

"The passcode is “tangled” with the device’s UID, so brute-force attempts must be per-formed on the device under attack. A large iteration count is used to make each attempt slower. The iteration count is calibrated so that one attempt takes approximately 80 milliseconds. This means it would take more than 5½ years to try all combinations of a six-character alphanumeric passcode with lowercase letters and numbers."

There's more info on the file encryption in the paper, around page 8.

[0] http://www.apple.com/ipad/business/docs/iOS_Security_Feb14.p...

View on HN

How were the iCloud accounts then attacked if they didn't have physical access to the device?

The passcode is “tangled” with the device’s UID, so brute-force attempts must be per-formed on the device under attack

Even with the password you need the device, which they didn't.

I think the "Cloud" may have been involved.

I think a lot of it was social engineering and bad passwords. If you are using multiple services and one is compromised you can pretty much give up access to everything if you use the same password all around.

Guesses based on known properties of the (well-known, high-exposure) targets.

iCloud backups aren't encrypted with the same key as on device storage.

Social engineering was used to get the answers to the users security questions.

You can restore from iCloud backup to any device (which is presumably how elcomsoft software works). The only thing that you need original device for is the keychain, but I am not sure if this has changed since keychain in the cloud

Isn't that 5.5 years of sequential trying? This is a parallelizable problem. There's also no restriction on how fast a cracking machine is allowed to be, so I doubt 80ms is the lower limit.

Did you not RTFA? The file system keys are stored in the SoC secure storage area and there are no facilities for retrieving them, meaning you must perform the decryption attempts with the phone's own SoC.

Of course an iCloud backup file is another matter... At least they are turning on two factor auth for that, but it's a difficult problem if someone has your password and the keys are on a phone that you no longer have.

That's assuming you can't clone it, and try on 1000 devices at the same time, correct?

Reply on news.ycombinator.com