5

Unfortunately today my iPhone 6 Plus was stolen from my pocket on the streets of Sao Paulo. I did not have cellular data turned on. I had Touch ID and a 4 digit number lock in place.

How much data can an attacker get off the device? Presumably with access to the hardware he can pull off everything, but I understand it is encrypted?

In particular I am concerned about cached emails in the GMail app, and the Apple Keychain, which retains some credit card information and many passwords for internet sites.

About one hour after the phone was stolen, I received numerous password reset requests on my Facebook account. I have changed my master email password and Facebook login.

The iPhone never showed up on "Find my iPhone" and although I have requested a remote erase, I suspect that isn't going to happen.

Improve this question
2
  • The first thing to do is reset your Apple ID password IMMEDIATELY! Then call Apple and your carrier and have the iPhone and the IMEI (or ESN) that belongs to it blacklisted. Also, it'd be good to reset your passwords just about everywhere just to be safe.
    – RedEagle2000
    Sep 2, 2015 at 0:12
  • @RedEagle2000 I don't think Apple blocks devices, except for the lock facility in "Find my iPhone". They give no hint that they would (or could) do such a thing. As for the IMEI—I have it written down in a desk drawer about 8000 miles from me ... :(
    – Calchas
    Sep 2, 2015 at 2:17

3 Answers 3

Reset to default
2

Actually, the data on your iPhone 6 is encrypted at rest and furthermore no data comes off the device even if it is connected to a computer. Someone would need to brute force the PIN and then press Trust to trust a computer which would then be able to transfer off data or sync the device.

It's suspicious you got password resets. Perhaps the lock screen was configured to allow them to reply to messages or dial phone numbers or otherwise look at incoming mail. That would of course mean that the phone had WiFi or data connection - so in that case, the remote wipe is a good possibility.

I hope you get a response to the wipe, but you are in a fairly good situation all things considered.

Here are Apple's documents on how data is protected and what to do in the case your device is lost or stolen:

Improve this answer
4
  • 1
    But the device could be jailbroken, in principle, and then the data copied off, no?
    – Calchas
    Sep 2, 2015 at 2:15
  • It seems that actually bypassing the PIN/password/activation lock is trivial using a tool called "doulci" :( youtube.com/watch?v=_krgSUxkmHE
    – Calchas
    Sep 2, 2015 at 5:16
  • Presumably the stuff in the keychain is still encrypted, but I doubt my email archive can be considered safe.
    – Calchas
    Sep 2, 2015 at 5:23
  • 1
    Update, I think doulci is a hoax. However, there are quite a few workarounds to the PIN lock that grant limited access to contacts and messages, often via Siri; and through a bug in the control centre that will get you into already running apps. iPhone still not been wiped. I think the Facebook password resets were initiated by using my phone number to request the password reset, which only requires physical access to the SIM card.
    – Calchas
    Sep 3, 2015 at 15:10
0

I have a partial answer:

There is a tool called "doucli" that purports to unlock any iPhone, even with the iCloud Activation Lock in place. It appears to have worked once, but may be a hoax now. Although there are many YouTube videos showing it work, largely uncommented videos seems to be the extent of its publicity.

Jailbroken phones can be completely unlocked without difficulty by deleting the appropriate files from the /var directory. (My phone was not jailbroken.)

There are numerous bugs that enable access to already running apps without a PIN by clever exploitation of the Control Centre (the panel appears by swiping upwards). Disabling the Control Centre from running on the lock screen is a work around.

There are also "features" in Siri that will grant access to contacts, recent messages, parts of Facebook and Twitter and notes by carefully phrased commands. Disabling Siri on the lock screen would prevent this.

I suspect the Facebook password resets were initiated by using my phone number to request the password reset, and then receive a text message for verification; this only requires physical access to the SIM card and not access to the unlocked phone.

On the negative side, I still have not received notification that my phone has been wiped.

Improve this answer
-1

Two situations: Situation 1: If Find My iPhone is enabled on your missing device

You can use Find My iPhone to find your device and take additional actions that can help you recover it and keep your data safe. Sign in to icloud.com/find on a Mac or PC, or use the Find My iPhone app on another iPhone, iPad, or iPod touch. Find your device. Open Find My iPhone, and select a device to view its location on a map. If the device is nearby, you can have it play a sound to help you or someone nearby find it. Turn on Lost Mode. Using Lost Mode, you can remotely lock your device with a four-digit passcode, display a custom message with your phone number on your missing device's Lock screen, and keep track of your device's location. If you added credit or debit cards to Apple Pay, the ability to make payments using Apple Pay on the device will be suspended when you put your device in Lost Mode. Report your lost or stolen device to local law enforcement. Law enforcement might request the serial number of your device. Find your serial number: On the original box or receipt. On My Support Profile (supportprofile.apple.com) if you registered your device with your Apple ID. Erase your device. To prevent anyone else from accessing the data on your missing device, you can erase it remotely. When you erase your device, all of your information (including credit or debit cards for Apple Pay) will be deleted from the device, and you won't be able to find it using Find My iPhone. After you erase a device, you can't track it. If you remove the device from your account after you erase it, Activation Lock will be turned off. This allows another person to activate and use your device.

Situation 2: If Find My iPhone isn't enabled on your missing device

If you didn't turn on Find My iPhone before your device was lost or stolen, you can't use it to locate your device. However, you can use these steps to help protect your data: Change your Apple ID password. By changing your Apple ID password you can prevent anyone from accessing your iCloud data or using other services (such as iMessage or iTunes) from your missing device. Change the passwords for other internet accounts on your device. This could include email accounts, Facebook, or Twitter. Report your lost or stolen device to local law enforcement. Law enforcement might request the serial number of your device. Find your serial number: On the original box or receipt. On My Support Profile if you registered your device with your Apple ID. Report your lost or stolen device to your wireless carrier. Your carrier can disable the account, preventing phone calls, texts, and data use.

Improve this answer
1
  • Thanks for your reply, but, as I mentioned in the question, find my iPhone was on but apple has been unable to contact my phone. I requested the wipe nearly 10 days ago but it hasn't happened yet. Since this happened in a foreign country, IMEI blocking is not effective, and Brazilian police did not ask for the serial number (I think they know there is zero chance of it being recovered). I am more concerned that any data on the phone might have been extracted using an unpatched security vulnerability.
    – Calchas
    Sep 9, 2015 at 9:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .