10

When/if a Jailbreak becomes available for iOS 10.2, I am interested in installing it.

Since I use Apple Pay (on my watch only), I would like to know that my payment details are safe. Since you can see your credit card information in the Apple Watch app on iOS, this means that the data is synced across both devices.

Due to the data being on the watch and phone, would this make it possible for an hacker to get my card details? If so, would it just be the last four digits and my bank provider or all details?

  • 3
    You put yourself at a greater risk on a jailbroken device. – CJ Dana Dec 25 '16 at 2:09
  • Why do you want to jailbreak? And yes everything on your watch is also on your phone. – Tyson Dec 25 '16 at 3:11
  • 3
    Great question. I hope we can get some good answers for you. – bmike Dec 25 '16 at 5:01
  • @Tyson I am interested in doing it to see if there is still point in doing it now, as well as, just to see what you can do to it. I used to jailbreak <=iOS 6 and a small bit on iOS 7. I didn't do it for a long time since I found my phone to be unstable. Want to see if jailbreaking is more stable now. – iProgram Dec 25 '16 at 10:23
  • Just a note to let you know I've updated my answer to more directly respond to your question/situation. – Monomeeth Dec 28 '16 at 23:15
7

[EDIT] - This edit revises my answer to:

  • more specifically answer the OP's question for their exact scenario
  • reduce ambiguity by making clearer the parts of my answer that were more general in nature

1. Answer to OP's exact question/scenario

Yes, your payment details are 100% safe, as you've already set up Apple Pay on your devices prior to doing a jailbreak in future. This is because your card information is not saved to the device. In other words, since the data isn't on the device to begin with, there's no risk of it being accessed from your iPhone, even after doing a jailbreak. The information simply isn't there to steal!

2. Apple's own words re encryption and data protection on jailbroken devices

According to Apple

The secure boot chain, code signing, and runtime process security all help to ensure that only trusted code and apps can run on a device. iOS has additional encryption and data protection features to safeguard user data, even in cases where other parts of the security infrastructure have been compromised (for example, on a device with unauthorized modifications). This provides important benefits for both users and IT administrators, protecting personal and corporate information at all times and providing methods for instant and complete remote wipe in the case of device theft or loss.

Source: Apple's iOS Security White Paper, 2014, p8. NOTE: Bold emphasis mine, not Apple's.

As you can see, according to Apple, even jailbreaking a device will not result in non-trusted code or apps being able to access certain areas, such as the Secure Enclave.

More specifically, Apple states:

The Secure Enclave is a coprocessor fabricated in the Apple A7 chip. It utilizes its own secure boot and personalized software update separate from the application processor. It also provides all cryptographic operations for Data Protection key management and maintains the integrity of Data Protection even if the kernel has been compromised.

Source: Apple's iOS Security White Paper, 2014, p5. NOTE: Bold emphasis mine, not Apple's.

The Secure Enclave is part of Apple's A7 and later processors. This enclave is documented in Apple Patent Application 20130308838 and also has its own OS called SEP OS.

So, according to Apple, your data is safe.

3. General info about Apple Pay and security

The best way to enter your card information when setting up Apple Pay is to use your iPhone's camera. This is because doing so means your card information is never saved to the device or stored to the photo library. In other words, since the data isn't on the device to begin with, there's no risk of it being accessed from your iPhone.

Once you've set up your device for Apple Pay, your bank (or financial institution) creates a Device Account Number (DAN) which is unique to your device and is encrypted and sent to Apple so they can add it to what's called the Secure Element on your device. This element is totally isolated from iOS and watchOS, is never stored on Apple's servers, nor backed up to iCloud.

It's important to also note that the DAN is never actually decrypted by Apple, they merely perform the action of placing it on your device in its encrypted form.

If you have to manually enter your card information (i.e instead of using your iPhone's camera), this information is also encrypted and sent to Apple servers. Since the information is stored on your iPhone prior to encryption it is theoretically possible that a 3rd party could log this, but the risk of this happening on a non-jailbroken device is 0% because the data (i.e. your card info):

  • is stored in encrypted memory
  • only stored for a very short period (a few seconds at most)
  • is protected by AES key wrapping with both sides providing a random key that establishes the session key and uses AES-CCM transport encryption.

In summary, I don't think it is possible to absolutely 100% guarantee that a hacker could never retrieve your card details, but in reality the risk of this happening is actually from a hacker breaching your bank's systems instead, not from your iPhone.

4. Further reading:

  • If the phone is compromised, any photographed card can be sent to malicious parties just as any typed CC info can be sent. This is all before Apple Pay is even set up or any bank creates a DAN. – Constantino Tsarouhas Dec 26 '16 at 21:01
  • Actually, the camera isn't being used to photograph the card, it's being used to recognise the alphanumeric characters in the various 'fields' of the card. However, upon re-reading my answer I do feel I should revise it to remove any unintentional ambiguity in my response. The reality is that the risk is extremely low (almost impossible, but not impossible) regardless of whether the device is jailbroken or not. I'll update my answer later today when I've had a chance to dig out an Apple white paper that covers this topic, so I can quote directly from it. Thanks for your comment! :) – Monomeeth Dec 28 '16 at 0:46
  • I also meant photographs made by the malicious software. Nothing prevents running root-privileged software to sneakily take pics while the Apple Pay set-up just performs recognition. But that's malicious software for ya. ;-) – Constantino Tsarouhas Dec 28 '16 at 0:57
  • @RandyMarsh Just a note to let you know I've updated my answer to provide more detailed info/sources and to reduce any ambiguity in my wording. – Monomeeth Dec 28 '16 at 23:14
  • Thank you for providing an updated version of this information. Why is it that iOS shows the last four digits and the bank provider that I have, even though it is stored on my watch and not phone? Wouldn't that mean that some information is being transfered from one device to the other, leading to a man in the middle attack? – iProgram Dec 29 '16 at 12:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .