[ad_1]
The main difference between Full Protection and AFU is how quickly and easily applications can access keys to decrypt data. When the data is in the fully protected state, the keys to decrypt it are stored deep within the operating system and themselves encrypted. But after you unlock your device the first time after restarting, many encryption keys start to be stored in the quick access memory even when the phone is locked. At this point, an attacker could find and exploit certain types of security vulnerabilities in iOS to recover encryption keys accessible in memory and decrypt large chunks of data from the phone.
Based on reports available on smartphone access tools, like those from Israeli police contractor Cellebrite and American forensic access company Grayshift, the researchers realized that this is how nearly all smartphone access tools work today. It’s true that you need a specific type of operating system vulnerability to recover the keys – and Apple and Google patch as many of these flaws as possible – but if you can find them, the keys are also available.
Researchers found that Android had a similar setup to iOS with one crucial difference. Android has a version of “Full Protection” which applies before the first unlock. After that, the phone data is basically in AFU state. But where Apple gives developers the option of keeping certain data under the tighter full protection locks all the time – a banking app, for example, could use it – Android doesn’t have that mechanism after the first unlock. Forensic tools exploiting the right vulnerability can grab even more decryption keys, and ultimately access even more data, on an Android phone.
Tushar Jois, another Johns Hopkins doctoral candidate who led the Android analysis, notes that the Android situation is even more complex due to the many device makers and Android implementations in the ecosystem. There are more versions and configurations to defend, and overall users are less likely to get the latest security fixes than iOS users.
“Google has done a lot of work to improve this, but the fact remains that many devices don’t get any updates,” Jois says. “Also, different vendors have different components that they put in their final product, so on Android you can not only attack the operating system level, but also other layers of software that can be vulnerable in different ways. and increasingly give attackers access to data. . This creates an additional attack surface, which means there is more stuff that can be broken. “
The researchers shared their findings with the Android and iOS teams ahead of publication. Google declined to comment for this story. An Apple spokesperson told WIRED that the company’s security work focuses on protecting users from hackers, thieves and criminals looking to steal personal information. The types of attacks researchers are looking at are very expensive to develop, the spokesperson stressed, require physical access to the target device, and only work until Apple fixes the vulnerabilities it exploits. Apple also stressed that its goal with iOS is to balance security and convenience.
To understand the difference between these encryption states, you can do a little demonstration for yourself on iOS or Android. When your best friend calls your phone, their name usually appears on the call screen because they are in your contacts. But if you restart your device, don’t unlock it, then ask your friend to call you, only their number will appear on not their name. This is because the keys to decrypt the data in your address book are not yet in memory.
Researchers also delved into how Android and iOS handle cloud backups, another area where encryption guarantees can erode.
“It’s the same type of thing where great crypto is available, but it’s not necessarily used all the time,” Zinkus explains. “And when you back up, you also expand the data available on other devices. So if your Mac is also seized during a search, it potentially increases law enforcement access to cloud data. “
[ad_2]
