Pierluigi Paganini March 21, 2016

A group of researchers found an iOS zero-day that would let a skilled attacker decrypt photos and videos that were sent as secure instant messages.

The bad news is that Matthew Green, a professor at Johns Hopkins University revealed that a zero-day vulnerability in iOS encryption allows skilled attackers to decrypt intercepted iMessages, the good news is that the flaw is very hard to exploit.

Green explains that he suspected the flaw when reading Apple documentation related to the encryption scheme implemented in its messaging system.

The popular expert Matthew Green hasn’t provided the details of the exploit to give the opportunity for Apple for fixing it. The expert also added that the flaw would not have helped the US government in the case of the San Bernardino shutter’s iPhone.

The hacking technique could be used by law enforcement only to access photos and videos sent by suspects using iMessage.

“This specific flaw in Apple’s iMessage platform likely would not have helped the FBI pull data from an iPhone recovered in December’s San Bernardino, Calif., terrorist attack, but it shatters the notion that strong commercial encryption has left no opening for law enforcement and hackers, said Matthew D. Green, a computer science professor at Johns Hopkins University who led the research team.” states The Washington Post that interviewed Green.

“Even Apple, with all their skills — and they have terrific cryptographers — wasn’t able to quite get this right,” said Green.“So it scares me that we’re having this conversation about adding back doors to encryption when we can’t even get basic encryption right.”

Green explained that with the support of his group of experts, composed of Ian Miers, Christina Garman, Gabriel Kaptchuk, and Michael Rushanan could guess the key that could be used to decrypt photos and videos stored in the iCloud.

The team of researchers wrote an application that emulated an Apple server and then targeted an encrypted photo stored on the iCloud. The software sent key digit guesses to an iPhone running an old version of iOS, which in turn indicated when each key of its 64 digits was correct.

Green highlighted that its attack technique could very dangerous if conducted by a persistent attacker, like a nation-state attacker.

The iOS 9.3 beta version seems to be unaffected and will be released as stable shortly.

Apple partially fixed the zero-day vulnerability with the iOS 9 release.

Pierluigi Paganini

(Security Affairs – iOS zero-day, hacking)