An article review.
New Device automates iOS Pin Hacking
Many companies have Bring Your Own Device policies in place, where employees are allowed to bring their own PCs or mobile devices into the workplace or have business utilities, like email, setup on their personal devices. They also usually have extensive policies allowing remote wiping, etc. should the device be compromised. But what if you don’t know a device has been compromised?
A new device can effectively hack older iPhones and iPads, bypassing Apple safeguards and the user’s pin! British security firm, MDsec, was able to purchase one of these devices for around $300. They found that any 4 digit pin could be brute forced in about 4.5 days.
Dominic Chell, director at MDSec, said, “It’s always been known that having a 4-digit PIN on your phone is inherently insecure however the ‘erase data after 10 invalid attempts’ configuration setting was seen as somewhat of a mitigation in many circles. We believe that the device is able to evade this constraint by aggressively powering off the iPhone after each PIN entry attempt is made, but before the failure has been committed to flash memory – it does this by directly powering the iPhone itself.”
The good news is that Apple has addressed this vulnerability with iOS 8, but any device that hasn’t been updated remains vulnerable. This includes original iPads, iPhone 4, and iPod 4G which are not iOS 8 compatible.
Hopefully, a user would know that their device was missing within 4 to 5 days. But would they know to notify IT? When was the last time you reminded your employees to make sure their devices were up-to-date? Did you turn off Exchange ActiveSync’s ability to enforce this? Does your MDM application enforce this?
Click Here To Read the Full Article
The above is what we call an “Article Review.” It is part of our attempt to help our readers find excellent reading materials to back up important technology risk management concepts. We try not to include articles that are merely news or additional news about mainstream issues. Instead, we try to highlight articles that our “typical clients” should be sure to read, or that are about concepts “outside the mainstream media.” infotex does not intend to endorse views represented by the writers of the articles we review, nor do we try to keep our Clients aware of EVERYTHING. For example, if a particular story concept is being reported upon in many different media sources, infotex usually chooses to ignore the story concept altogether, unless we can find a “unique take” on the story concept.
Original article by Thomas Fox-Brewster of Forbes.
