iPhone 3G S: encrypted but not secure

The iPhone 3G S ecryption system was supposed to reassure users, in particular business users. The problem is that apparently only a couple of minutes are needed to break it and three quarters of an hour to copy an entire raw disk image.

Apple says on its iPhone 3GS presentation page that it offers a highly secure encryption that allows you to remote wipe, giving this as a choice sales argument for users whose phones may contain confidential information that shouldn't be allowed free circuation in the case of theft of a device.

This is a problem according to Jonathan Zdziarski, iPhone specialist, as the encryption is not secure. He says: "Apple may be technically correct that [the iPhone 3GS] has an encryption piece in it, but it's entirely useless toward security."

In a demo video that he has published, an iPhone 3GS is shown starting in restore mode and executing a modified kernel to recover an entire raw disk image and store it on a computer. You don’t even need to enter the PIN! An entire raw disk image can be obtained in 45 minutes.

The problem is that the image in question is not encrypted: the iPhone decrypts the data before sending it to the computer. This means all the phone's data is recovered as it stands – images, documents and even logs containing key entries…

As for the remote wipe function promoted by Apple, it is also limited: when the device is stolen it receives the wipe command remotely. In other words all a thief has to do is remove the SIM card to deactivate this function and take their time to retrieve any data.

The code PIN itself can be dealt with in less than ten minutes anyway, via readily available tools such as Jailbreak – once again Zdziarski has published a demo video to show how this is done.

According to Zdziarski, then, the iPhone shouldn’t be used in any context where data security is important. All the same, these problems only become so when your iPhone is actually stolen: you can’t gain access to data at a distance and control the device remotely. Your average user doesn’t in any case generally store any very valuable data in their phone: the problem is really only for business users.

The choice has to be made between what is an eminently useful device and data security: all companies that handle sensitive data know that no perfectly secure system exists and that it is prudent to have a system in place to deal with the theft of data.

> Buyer's Guides: Our Pick of The Best Products