The flaw stems from the way in which iMessages are encrypted and how they’re then sent through Apple’s servers. Professor Michael Green, a computer scientist at JHU who led the research, told the Washington Post that he first began to suspect issues with the iMessage encryption last year after reading an Apple security guide on the encryption process. To test out his theory, he began poking around with iPhones that were not using the latest operating system on iMessage.
“We appreciate the team of researchers that identified this bug and brought it to our attention so we could patch the vulnerability.”
Green and his colleagues attempted to intercept iMessages by writing software that pretended to be an Apple server. The encrypted transmission the team targeted was photo stored on Apple’s iCloud server and the 64-digit key needed to decrypt the photo. Although the researchers were unable to actually see the key’s digits, they could use a process of trial and error to figure it out. The team changed a single digit or letter in the key and resubmitted it to the target phone. Every time they guessed right, the phone accepted it. After thousands of attempts, they had the complete key.
Once the researchers had the key, they were able to grab the photo directly from Apple’s server in a move that would’ve been totally undetectable by the user. Of course, this hack requires a great deal of skill and dedication, so it’s unlikely that your iMessages are under attack.
Even so, Apple responded quickly to the news, thanking the researchers for alerting the company about the flaw in iMessage.
“Apple works hard to make our software more secure with every release,” the company said in a statement. “We appreciate the team of researchers that identified this bug and brought it to our attention so we could patch the vulnerability … Security requires constant dedication and we’re grateful to have a community of developers and researchers who help us stay ahead.”
Apple promised a full fix with the release of iOS 9.3 on March 21. In order to fully protect iMessages from this hack, Green urges users to update their software as soon as iOS 9.3 comes through.
“It scares me that we’re having this conversation about adding back doors when we can’t even get basic encryption right.”
He also referred to the importance of sealing holes in encrypted products in light of the upcoming Apple vs. FBI court case.
For those who haven’t been following the saga, the case revolves around Apple’s refusal to create a back door for the government and U.S. law enforcement. The back door would allow the FBI to circumvent iOS security features and hack into one of the San Bernardino shooters’ iPhones. Apple argues that creating a back door would be dangerous and open up its devices to greater attacks from hackers. It could also set a dangerous precedent that would allow law enforcement to demand access to any Apple device.
Based on his statements, Green agrees with Apple in the encryption debate. He stated that the iMessage flaw would not have helped the FBI gain access to the shooter’s iPhone and warned that creating unassailable encryption is hard enough without there being a pre-existing back door for hacking into a secure device.
“Even Apple, with all their skills — and they have terrific cryptographers — wasn’t able to quite get this right,” says Professor Michael Green, who led the team responsible for discovering the bug. “So it scares me that we’re having this conversation about adding back doors to encryption when we can’t even get basic encryption right.”
Green’s team is slated to publish a paper on their findings in the near future.
