4

I was looking at a companies that to do repairs to iPhones to decide if I wanted to DIY or just pay someone to do it, and noticed one company that listed a service named "Remove Passcode". This was concerning to me since I assumed that the iOS passcode was secure; meaning for example that it was part of the boot/build, and without it correctly presented, the phone's data was not accessible. (Yes, I know, silly to think that would be the case.)

Anyway, at this point after quickly researching the topic, it appears it's possible to delete one file, turn the phone on, have complete access to it, replace the file, and no one would be the wiser.

Not asking for a how-to - just confirmation that the passcode is meaningless security-wise.

Improve this question
1
  • The security isn't meaningless - it just prevents casual unauthorized attempts to access your phone's data. As the other answers note, if the phone is outside of your physical control, anything can happen to it if the potential attacker is determined enough. It's similar to locks on doors - any door lock can be defeated, it's about making things difficult enough that casual thieves will be deterred.
    – JW8
    Jul 12, 2012 at 18:00

3 Answers 3

Reset to default
5

One a malicious individual has physical access to the hardware, any protection becomes meaningless, security-wise.

If an attacker had the time and resources, they could circumvent any UI-based security by removing (de-soldering) the flash from the logic board, connecting it to another system, and reading any data off them. Only full-disk encryption would block that, but, given physical access and/or time, that's defeatable, too.

Improve this answer
2
  • This is the first they taught us in networking class when I got my degree... the second is no matter how much security you have, it is never secure enough.
    – TheXed
    Jul 13, 2012 at 0:28
  • 2
    Security is a mindset, a process, a constant re-evaluating of how you take reasonable precautions and agreements on what risks are worth taking. It's not something you look up, or apply once in a while like a coat of paint.
    – bmike ♦
    Jul 18, 2012 at 22:36
3

Just as locks do not work to deter a trained safe-cracker with physical access to a safe, the passcode lock is sometimes amenable to cracking with the correct forensic tools.

Having a passcode lock makes it so much harder to break into a phone (beyond the obvious knowledge, time, tools) since you can't run arbitrary programs while the device is in a locked state and on all but the oldest devices, data protection makes it harder to read or write to the encrypted contents and bypass the OS protection.

Unless you are a target of government or corporate espionage - setting a passcode and instructing the device to wipe itself on repeated failed attempts is quite secure in practice. If you are a target - you better hope the rest of your tracks are as well covered as iOS is.

Improve this answer
2

Using the 4-digit standard numeric passcode on an iPhone can be cracked in 45 minutes or so. Adding an advanced passcode is a better, yet not fail proof option. Law enforcement has been doing this at an increased rate as of late. Software like Micro Systemation is often used to crack these 4 digit combinations. Or they may be relying on certain insecure, older versions of iOS to reset the password. It's also possible they just put the iPhone in DFU mode, restore it, and give it back without any data! :)

As stated above, given time and physical access, you can be hacked. Here are some links for food for thought:

https://securosis.com/blog/defending-ios-data-ios-security-and-data-protection

http://anthonyvance.com/blog/forensics/ios4_data_protection/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .