Everyone must comply with government requests to disclose information. How far should one go when disclosing such information? This is up to the company. In a recent trend, several big IT companies including Apple, Facebook, Google and Microsoft among others teamed up to propose a change in US legislatures concerning governments spying on its citizens. The reform would make government surveillance “consistent with established global norms of free expression and privacy and with the goals of ensuring that government law enforcement and intelligence efforts are rule-bound, narrowly tailored, transparent, and subject to oversight”.

The proposed legislative reform cited higher transparency at who, when and how would be able to spy on fellow citizens was voted down last year.

Regardless, the trend is clear: citizens are sick of governments spying on them, and even the “big and evil” corporations are tired of being forced to develop, implement and maintain backdoors for the government in their products. It seems Apple was the first to shut the door in front of government spies. This is their official statement (source: https://www.apple.com/privacy/government-information-requests/):

Government information requests are a consequence of doing business in the digital age. We believe in being as transparent as the law allows about what information is requested from us. In addition, Apple has never worked with any government agency from any country to create a “back door” in any of our products or services. We have also never allowed any government access to our servers. And we never will.

Sounds great, doesn’t it? However, it’s hard to believe the government not using all the backdoors available (or forced) in the products. Let’s have a look at information stored in Apple’s mobile devices:

On devices running iOS 8, your personal data such as photos, messages (including attachments), email, contacts, call history, iTunes content, notes, and reminders is placed under the protection of your passcode. Unlike our competitors, Apple cannot bypass your passcode and therefore cannot access this data. So it’s not technically feasible for us to respond to government warrants for the extraction of this data from devices in their possession running iOS 8.

Bingo! Apple designed its hardware so that even Apple themselves cannot access your information without knowing your passcode.

Or can they?

Let’s have a look at how information can be extracted from an Apple smartphone.

Why Physical Acquisition Works with Older Apple Devices

First and foremost, do note that Apple talks about their iOS 8 devices but not about their older devices. For older devices such as iPhone 4 and earlier, one can extract information without a problem. In order to do that, one needs to enter the DFU mode (Device Firmware Update) on the device. If one is using a tool such as Elcomsoft iOS Forensic Toolkit, the phone is sideloaded with a patched firmware file emulating an update. This file is not real firmware; instead, it contains code that can extract information from the device’s memory and storage. In particular, the code contains routines reading and extracting hardware decryption keys allowing the tool to decrypt data extracted from the phone’s storage. Interestingly, the device does not prompt for a passcode in DFU mode.

Of course, the actual implementation is not as simple as that. Apple implemented a certain level of protection, only allowing signed code to be used during the boot, which is enforced by read-only bootrom. One must work at Apple to be able to sign anything with their digital certificate, so this was not an option for Elcomsoft iOS Forensic Toolkit. Fortunately, a vulnerability was discovered by independent hackers, which allowed ElcomSoft to create an exploit that effectively skipped the check. Interestingly, as the bootrom is deliberately read-only, Apple was never able to patch this vulnerability in existing devices. All operations were performed in the device’s volatile memory, so all information was extracted intact.

With the release of iPhone 4S, Apple fixed the DFU vulnerability. However, if a jailbreak is installed, one can connect to the phone via SSH and upload acquisition tools. Of course, these tools are also not signed, but this is the thing with jailbroken devices: they can run unsigned code. These acquisition tools can effectively extract hardware decryption keys and acquire all information from the device.

As you can see, there are several major differences in acquisition support between older and newer devices. First, newer devices can only be acquired in jailbroken state. Second, acquisition tools are written to the device’s storage, inevitably leaving footprint in the file system and logs. As a result, this acquisition method is not as “clean” as the one available for older devices.

Before we move on to the more recent devices (and versions of iOS), let’s have a brief look at how Apple devices protect user data. iOS defines several protection classes. In an oversimplified manner, we can say that data can be encrypted with a hardware key alone (and decrypts immediately on device boot), or it can be additionally encrypted with a passcode-dependent key. The second type of protected data will only become available after the device is unlocked by either typing a passcode or scanning the fingerprint.

The Golden Age of iOS Forensics: iOS 4 through 7

In iOS 7 and earlier, most files stored in the iPhone were only protected with the lower-grade protection class, with two exceptions:

• Keychain records (Wi-Fi passwords, tokens, email passwords etc.)
• Downloaded email messages

Keychains and email were the only two types of data protected with both hardware and passcode-dependent keys. This means that, by using the right tool (e.g. Elcomsoft iOS Forensic Toolkit), one could extract pretty much everything from the smartphone (sans keychain and downloaded email) even without knowing the passcode. However, in iPhone 4S and later only Apple themselves were able to access that data: they didn’t need an exploit to bypass the lock screen. When presented an iOS device and a search warrant, Apple would comply by extracting available information and handing it over to the corresponding agency. How did they do that? While we don’t know their exact routine, common sense suggests that they used a correctly signed image via the DFU mode to bypass the lock. It is known that Apple never bothered brute-forcing the passcode if one was unknown, delivering all information sans keychain and downloaded emails.

At the time, Elcomsoft iOS Forensic Toolkit was already able to brute-force the passcode to decrypt the keychain and email messages, so this tool returned more usable data than Apple themselves. Those were the golden days of iOS forensics. That was before iOS 8.

iOS 8: No Search Warrants Allowed

In iOS 8, Apple further improved security, assigning the highest protection class to nearly all information available in the smartphone. As a result, the company claims, even Apple themselves will be unable to extract any meaningful data from a passcode-protected device even if they are brought a device and presented a search warrant (unless they are also given the correct passcode). While Apple has all resources and could hypothetically brute-force the passcode and recover information, the company made an explicit statement they won’t do that.

What did the FBI say? They weren’t pleased at all. According to iOS 8 Adds Serious Security, Privacy Improvements:

In the past, Apple has complied with government investigations by turning over individual users’ data. But as of its latest privacy policy, Apple says it will no longer do so. In fact, the way iOS 8 encrypts data should ensure that Apple won’t have access to that data at all.
…
Even if Apple is served with a subpoena, search warrant or National Security Letter, it won’t be capable of complying (with iOS 8 data at least), since it will have no information to turn over to law enforcement.

But are Apple’s statements really true? Is it true that they really cannot extract anything out of an iOS 8 device protected with a passcode?

Reality Steps In

In reality, it is simply not possible to keep everything on the phone encrypted with the user’s passcode. Some types of information must remain accessible even when the phone is locked. We analyzed behavior of iOS devices, and discovered that the following types of data are indeed accessible under screen lock:

• Call log that includes all incoming and outgoing calls (including FaceTime)
• Voicemail
• All settings and options
• List of installed apps
• Many log files including download and update histories, service launch logs and many other system and application logs
• Various temporary files

The call log database must remain accessible (or, more precisely, encrypted with hardware key only) in order for the device to be able to store a new record into the database if a call is received while the device is locked. Interestingly, incoming calls received while device is locked will be displayed as phone number only as the address book is encrypted with a stronger protection that requires a passcode! This small detail demonstrates how Apple thinks through its security concept. Similarly, voicemail messages are not encrypted to allow the phone recording new messages while locked.

The app list, logs and history files remain unprotected to allow background activities (e.g. application updates) to carry on while the device is locked.

As you can see, in reality at least some data is accessible, even if Apple claims they cannot extract anything out of a locked iOS 8 device. Call logs, for example, are essential for investigations, and they remain accessible under lock. Now let’s read this paragraph again:

“On devices running iOS 8, your personal data such as photos, messages (including attachments), email, contacts, call history, iTunes content, notes, and reminders is placed under the protection of your passcode. Unlike our competitors, Apple cannot bypass your passcode and therefore cannot access this data. So it’s not technically feasible for us to respond to government warrants for the extraction of this data from devices in their possession running iOS 8.” (source: https://www.apple.com/privacy/government-information-requests/)

Quite obviously, someone is not telling the whole story here.