In May 2010, security and IT blogger Bernd Marienfeldt reported a “data protection vulnerability” in Apple’s iPhone 3GS, saying a four-digit PIN did not really protect the data on the phone. The finding appeared in an article he wrote about the iPhone’s business security framework.
What was reported
Marienfeldt worked with security expert Jim Herbeck. Together they reproduced the problem on at least three non-jailbroken iPhone 3GS handsets running different iPhone OS versions, including the latest. All of the test phones were protected with a four-digit PIN.
Marienfeldt said that connecting an up-to-date, PIN-protected, powered-off phone to a computer running Ubuntu Lucid Lynx exposed practically all of the user’s data. He listed music, photos, videos, podcasts, voice recordings and game contents. He said the access included read and write rights and left no trace.
The exposure was not limited to one operating system. Marienfeldt said that on other systems the unprotected mounting was limited to the camera (DCIM) folder. Ubuntu Lucid Lynx exposed far more content.
The defender’s view
Business users were the main concern. Marienfeldt noted that corporate users rely on the expectation that the whole content of the 3GS is protected by encryption, with passcode authentication needed to unlock it. Darknet, a security site, made a similar point about the sales pitch. It said large sales to corporates were made on the security, privacy and encryption features of the iPhone OS.
Not everyone saw it as a new category of risk. Darknet pointed out that the same is true of desktop and laptop computers: with physical access, the data is exposed. In practice, the PIN gave little protection for stored data if a device was lost or stolen, and organisations could not treat it as a substitute for encryption that actually worked.
Marienfeldt also warned of a further risk. He said the allowed write access could lead to triggering a buffer overflow, which might eventually let an attacker make phone calls. As far as was known then, an attacker could read the data but not make calls.
Apple’s response and later lock-screen bugs
At the time of the report, Apple had been notified but had not corrected the flaw or given a timeline. The search results do not say how or when Apple resolved this particular issue.
A different passcode weakness surfaced in October 2010. It affected the iPhone 4 and 3GS running iOS 4.1 and let a user get around the lock screen and reach user data. Apple said it was aware of the weakness and would fix it in a software update the following month.