It’s been almost two weeks since we have released updated version of Elcomsoft Phone Password Breaker that is capable of downloading backups from the iCloud and we have seen very diverse feedback ever since. Reading through some articles or forum threads it became quite evident that many just do not understand what we have actually done and what are the implications. So I am taking another try to clarify things.

One common trend is people asking “So we need Apple ID and password for this to work, so how is this program useful?”. Well, in case you haven’t noticed, there are no easy way to download device backups from the iCloud even if you know both Apple ID and password. Pretty much the only way is to restore iCloud backup onto new (or firmware restored) device and then do a backup. In my opinion this is far from convenient, let alone very slow.

Besides this, there are two major points that must be taken into account: absence of the backup encryption and total reliance on the Apple ID password. Let me explain in more detail.

No Backup Encryption

As I am sure many of our readers know there is an option to encrypt backups in the iTunes. Once you switch it on and specify the backup password, no data will leave the device unencrypted. This means, for example, that if some malicious person gains access to your (encrypted) backup then he (or she) will be required to crack backup password in order to decrypt data from the backup. And this may be far from trivial (and this depends on how complex the backup password you’ve set is).

Backup encryption is an example of a security engineering principle called “security in depth” or “layered protection”. You are not supposed to lose your device or to hand off offline backups to some malicious parties, but just in case something goes wrong there is that additional layer of protection protecting your sensitive data and making bad guys’ job harder.

So, are you ready? It turns out that this backup encryption setting does not apply for over-the-air (also known as iCloud) backups. Files from users’ devices are sent to storage servers effectively unencrypted (technically they are encrypted, but encryption keys are stored along with the encrypted files).

Another thing that confuses a lot of people with regard to encryption is SSL (Chris Foresman also speculated about it in his two articles – Apple holds the master decryption key when it comes to iCloud security, privacy and Ask Ars: how safe is my data stored in iCloud? just before the release of our utility). Well, all traffic to and from iCloud is SSLed, so everything is encrypted, right? Yes and no. SSL protects communication link, i.e. data in transit. The fact that server uses SSL for data transfer does not imply that data on the server (i.e. data at rest) is stored encrypted. Server can send all sorts of sensitive information over SSL and the data will be encrypted in transit of course; but the recipient will get it in cleartext, which is exactly the situation with iCloud backups.

Over-Reliance on Apple ID

Have you ever considered how many applications from Apple ecosystem, both mobile and desktop, require your Apple ID and password? Quite a bit, actually: iTunes, App Store, iChat, Facetime, Messages, iCloud, Find My Friends, Cards, etc. How many devices do you have linked to the same Apple ID? iPhone, iPad, MacBook?

More devices linked to and more applications requiring same Apple ID means increased exposure of Apple ID credentials, means it is easier to get them. I have just checked and my Apple ID credentials are present in both my iPhone and my MacBook keychains, in clear.

New iCloud feature in EPPB isn’t certainly a magic feature to extract data from any iPhone in the World, but some clearly overlook that Apple ID credentials are easier to get than it looks at the first sight. And only one device have to be compromised to get access to backups of all devices (linked to the same Apple ID) in the iCloud.

I actually think this new iCloud feature is perfectly reasonable and can be quite useful during an investigation or security evaluation or penetration test. At least until Apple fixes the iCloud backup encryption (which I don’t expect them to take too long).

In case you have any questions please do not hesitate to comment (yes, we do check and approve comments) or contact us at info@elcomsoft.com.