Home Another iPhone Vulnerability: Access iOS Backups Data with iPhone Password Breaker (Updated)

Another iPhone Vulnerability: Access iOS Backups Data with iPhone Password Breaker (Updated)

Russian computer forensics software company ElcomSoft offers a product called iPhone Password Breaker that enables uses to access backup data from iOS devices. Today the company announced an update to the software that enables users to crack iOS 4 keychains – which may include e-mail and other passwords – without altering the phone’s content. ElcomSoft claims to be the first company to be able to crack keychain passwords. According to the company’s press release, “Prior to the release of the updated iPhone Password Breaker, the keychains were considered impossible to obtain.”

iOS 3 devices used hardware encryption unique to each individual device to encrypt keychains, even when the keychains were exported to an external device. Apparently, this is not the case in iOS4. The keychains can be unlocked with only the backup password, which iPhone Password Breaker can recover. If an online backup has not been performed, the keychains aren’t accessible.

Enterprises using iPhones may wish to avoid the use of offline backups until Apple fixes the issue.

iPhone Password Breaker uses ATI and NVIDIA video acceleration hardware to recover backup passwords faster than traditional CPU-only approaches.

ElcomSoft uses the same technology in its other products for recovering passwords from a variety of software, but does not offer any other products specifically designed for recovering smart phone passwords. According to ElcomSoft, the company’s tools are used by most of the Fortune 500, various branches of the military and many governments.

Update: ElcomSoft CEO Vladimir Katalov wrote us to say:

To be honest, I would not call that a “vulnerability”. If Apple wants to have an ability to restore from backup to another/new device, there is no solution, i.e. keychain cannot be encrypted based on hardware keys anymore. So we have to choose between security and usability, as always 🙂 The only recommendation is to select long and complex passwords to backups.

About ReadWrite’s Editorial Process

The ReadWrite Editorial policy involves closely monitoring the tech industry for major developments, new product launches, AI breakthroughs, video game releases and other newsworthy events. Editors assign relevant stories to staff writers or freelance contributors with expertise in each particular topic area. Before publication, articles go through a rigorous round of editing for accuracy, clarity, and to ensure adherence to ReadWrite's style guidelines.

Get the biggest tech headlines of the day delivered to your inbox

    By signing up, you agree to our Terms and Privacy Policy. Unsubscribe anytime.

    Tech News

    Explore the latest in tech with our Tech News. We cut through the noise for concise, relevant updates, keeping you informed about the rapidly evolving tech landscape with curated content that separates signal from noise.

    In-Depth Tech Stories

    Explore tech impact in In-Depth Stories. Narrative data journalism offers comprehensive analyses, revealing stories behind data. Understand industry trends for a deeper perspective on tech's intricate relationships with society.

    Expert Reviews

    Empower decisions with Expert Reviews, merging industry expertise and insightful analysis. Delve into tech intricacies, get the best deals, and stay ahead with our trustworthy guide to navigating the ever-changing tech market.