Darthnull

Be forewarned that (to the best of my knowledge) they haven't, and likely don't intend, to document the sqlite structure. The contents in the sqlite file seems to mirror the api responses from their new rest apis, so their Burp analyzer (https://github.com/1Password/burp-1password-session-analyzer/blob/rele… may help matters, as will the absolutely essential reading (https://darthnull.org/inside-1password/) along with its code (https://github.com/dschuetz/1password#readme) and I just found this while digging up those other links: https://github.com/mickaelperrin/onepassword-local-search/blob/v1.1.4/…

Really interesting puzzle. The author also has an update on the other packet types: https://darthnull.org/noise-storm-update/

I don't think so. According to [0], the passcode is used to protect filesystem encryption keys, meaning that without the code, you cannot decrypt your files. I don't know if pictures are stored encrypted, but I would assume so. edit: apparently I might be wrong. [0] also says that for a while only Mail storage, was encrypted and the default changed in iOS 7. So if your iPhone is on iOS <= 6, you might be able to use that to gain access to the device and copy pictures. The tools at [1] might help. [1] https://code.google.com/archive/p/iphone-dataprotection/ [0] https://darthnull.org/ios-encryption/

“On iOS, there is no full-disk or full-volume encryption, only varying levels of file-based encryption...” I don't understand this claim. iOS had full disk encryption starting with iOS 3.0, in 2010. Or at least Apple (and other security experts) says it does: https://darthnull.org/security/2014/10/06/ios-encryption/ Am I missing something here?

Sorry about the slight OT, but what truth is there in this statement I was presented with? >Even if an iPhone is locked, all of that encrypted data can technically be read easily so long as the phone had at least been unlocked once since the time it was booted up. Obviously I think it's a nonsense, but I have no way of disproving it (even though the burden of proof is on the claimer, naturally). Edit: OK I found this http://www.darthnull.org/2014/10/06/ios-encryption so never mind, I guess...

I've been wondering this as well. Even with the key derivation function, I'd imagine the CPU also has some secure keys stored in it as well, and these keys are so long that it wouldn't be feasible to brute force it. I'm not sure if thats how the architecture works but thats what I'm thinking. EDIT: This seems like a pretty good primer on iOS full disc encryption. http://www.darthnull.org/2014/10/06/ios-encryption

It's much more complicated than that (which is why the FBI needs help). The encryption uses the PIN and a key that is in the phone. If you take the image and try all the PIN combinations you will fail because you don't have the embedded key. http://www.darthnull.org/2014/10/06/ios-encryption > The UID key is used to create a key called “key0x89b.” Key0x89b is used in encrypting the device’s flash disk. Because this key is unique to the device, and cannot be extracted from the device, it is impossible to remove the flash memory from one iPhone and transfer it to another, or to read it offline. (And when I say “Impossible,” what I really mean is “Really damned hard because you’d have to brute force a 256-bit AES key.”) Newer phones also include a secure enclave that introduces another key and hardware restrictions on timing. The FBI's request wouldn't make sense for a modern iPhone.

The iPhone uses AES encryption which would prevent cloning the flash storage [1]. There was an informative discussion of this over on AppleInsider - http://forums.appleinsider.com/discussion/191851 [1] http://www.darthnull.org/2014/10/06/ios-encryption

It does have some pretty fancy encryption hardware and Apple seems to have made it very difficult to do even with physical access. David Schultz wrote a pretty comprehensive article about it: http://www.darthnull.org/2014/10/06/ios-encryption

So are iOS devices that have a passcode and are running iOS 8, and with fingerprint scanning a lot more people have password locked devices. Good article on the subject is here: http://www.darthnull.org/2014/10/06/ios-encryption

There's a blog post that sort of summarizes the slides here (which'll have to do until I get the white paper written): http://darthnull.org/2015/01/23/shmoocon-ios-auth

I don't mean to engage in whataboutism here, but unless you're under the impression that no tech company is privacy conscious, what you're saying isn't true (though that'd be a reasonable impression, to be fair). It's absolutely a security failure and it's not acceptable. But it's not a matter of "allowing" it to happen so much as, "Which vulnerability will we be caught by?" And it actually is a pretty normal vulnerability. For example, Apple[1], GitHub[2] and Twitter[3] have been vulnerable to this exact issue in recent memory. I also don't mean to be defeatist. This kind of problem is preventable. But it's merely one dumb mistake in a universe of dumb mistakes that leads to serious security failures, all of which are easy to make. The most sophisticated and well-funded information security teams in the world - usually the FAANG teams - still miss things which look pretty silly in isolation. At this scale being privacy conscious is necessary but insufficient. You can't realistically conclude anything about a company's dedication to privacy based on whether or not it was impacted by this kind of vulnerability. Making a corporate policy to hash passwords in the the database instead of storing them in plaintext is easy to codify, easy to implement and easy to verify. A corporate policy to never log authentication credentials is not nearly as well-defined, even if it's equally as important. That means more mental overhead, disagreement and uncertainty in preventing it.…