A team of researchers from Johns Hopkins University has discovered a flaw in iMessage on older versions of iOS which makes it possible for a third party to intercept and decrypt images and video.
A team led by Matthew D. Green believed that the encryption in iMessage could contain a weakness after studying the finer details of its security systems last year, reports the Washington Post. The team told Apple of its concerns but Apple didn’t act, so the researchers decided to demonstrate that the system could be exploited.
The attack saw the researchers write software that purported to be an Apple server which was then focused on messages that contained encrypted image or video. Those messages require a 64-digit code to decrypt, but the the team found that an iPhone accepted many thousands of guesses. That allowed them to brute force the encryption, as the phone accepted a correct digit at time, allowing them to guess one then move on to the next. Eventually they could decrypt the media file.
Apple apparently “partially” fixed the problem with iOS 9, though Green reckons that a modified version of his approach developed with the “hacking skills of a nation-state” could still crack it. Apple told the Post, though, that iOS 9.3 — released today — fully fixes the problem entirely. Better upgrade quickly later on, then.
It’s an embarrassing slip up for Apple, which is currently embroiled in a long and contentious battle with the FBI about introducing a backdoor in the San Bernadino iPhone. While this flaw wouldn’t help in that particular case, it’s a reminder that perfect security systems are incredibly difficult to create. Though there is, of course, a gulf between an accidental and intentional security backdoor.
Image by PROKārlis Dambrāns