Kuala Lumpur, Malaysia– The Russian researcher security Vladimir Katalov analyzed Apple's iCloud and discovered that the phone is not protected by two-factor authentication. But there are worse things. His data iCloud they can download the computer to anyone who has the skills, without the owner of the data ever learning it.
In “Cracking and Analyzing Apple's iCloud Protocols,” held in a packed room at the conference Hack In The Box last Thursday in Kuala Lump, Malaysia, Vladimir Katalov revealed that the data of Apple's iCloud users is not as safe as the company claims.
A malicious attacker only needs an Apple ID and password to get iCloud backups – without having to log in to device of the victim. The researcher explained that there is no way for a user to encrypt their iCloud data.
The data is already encrypted, he explained, but the keys are stored together with the data. Katalov added that Apple keeps the encryption keys.
The security researcher reported to ZDNet that when he found himself in front of the huge security gap he was shocked, after discovering that apart from all this, Apple's iCloud data is stored on Microsoft and Amazon servers.
During his presentation, Katalov pointed out that because Apple places its user data on third-party storage providers (Amazon and Microsoft), it could very well give this data to the Authorities.
In July, Apple announced (after revelations about the NSA PRISM surveillance program) that there are no backdoors in its systems and does not give access to government services.
When a user downloads his data from iCloud, he will receive an e-mail informing him that the process has been completed.
Katalov thus discovered that if someone downloaded their data by skipping Apple directly from the servers that they store, the owner does not receive any email notification.
Katalov's research is the first publicly released analysis for Apple's iCloud service.
The researcher analyzed Apple's iCloud service and Find My Phone by sniffing http traffic from jailbroken devices - although it does not have to be jailbroken to take advantage of vulnerabilities. The analysis of the traffic reported in the crowded room was not difficult.
In his analysis, Katalov found that the files stored in iCloud were the way Apple used to store them, ie as - plist and content - (plist and content).
However, the two-factor authentication of Apple, used with AppleID and a password, was not necessary for iCloud backups as well as for Find My Phone.
Katalov proved to the audience of Hack In The Box that in a very simple way he can access iCloud, retrieve data, backup IDs, and encryption keys. Then one can download the files stored in Windows Azure or Amazon AWS.
When asked if he had presented his findings to Apple, he explained that his findings were the Results of protocol analysis – and it's not a vulnerability issue. In other words, the iCloud security hole is a feature, not a bug!
Read the latest again "is a feature and not a bug”And think about who such a feature might serve.
