Informal Brain

Just when you thought you got rid of that incriminating email on your iphone, or removed that suspect web site from your cache you might be surprised to hear that the iPhone captures an image of the application when the “home” button is pressed.

As widely reported, the iPhone takes a screenshot every time the home button is pressed so that the 3D “zoom” effect can be processed when the application zooms in and out, when suspending and resuming applications. These shots are stored, at least temporarily, on the device, presenting potential privacy issues.

[From Keeping Your iPhone From Spying on You - iPhone Atlas]

A forensic analyst can retrieve the images from the phone by mounting the disk and using data recovery tools to reconstruct the images as they are not actually removed from the disk, just the pointers to the files are removed. This continues to demonstrate that the iPhone cannot be treated as a secure device. The iPhone atlas site demonstrates a way to disable the image storage on a jail broken phone. For the average user, be aware that your iPhone is keeping a log of your activity.

I continue to make the argument for encryption. To make that a reality, with good performance, Apple may need to embed a dedicated encryption processor to the device.

So the biggest question in my mind now is:

When will we see SquirrelFish Extreme for the Mobile Safari browser on the iPhone?

Apple is already winning the mobile browser wars, and the latest WebKit advancements will only solidify that lead.

In the past couple of days there has been a sudden outcry around the security issue with the iPhone pass code bypass issue. I loved this comment on iPhone Atlas today:

“The iPhone is a computer, just like a desktop computer, and so it can easily be booted in such a way that one can mount the disk and delete or modify the device’s configuration - including the passcode configuration. Cracking the iPhone’s passcode is about as complex as changing the root password on a desktop machine, given physical access.

[From iPhone Security Flaw Is the Tip of the Iceberg - iPhone Atlas]

This is something I have been pointing out for some time now. The iPhone doesn’t have any kind of storage based encryption so as the author of the above quote so readily points out that mounting the iPhone as a disk allows access to the configuration files. This allows easy editing of the PLIST files allowing a hacker to disable the pass code and steal the data.

For some time now I have been calling on Apple to give us encryption as an enterprise feature. I noted in a previous blog post that device encryption was the missing enterprise feature when the 2.0 software was announced. I was in shock when I watched company after company (including the military) laud the iPhone 2.0 software. Did they miss the point that the device can be compromised so easily putting their mobile exchange push data at risk?

We need to pressure Apple to add encryption to the device while fixing these pass code problems. Only encryption will protect the device from being mounted as a disk. Until then I would not store sensitive data on the device using push email from exchange, LDAP or POP3. I would be very careful with webmail solutions. For example, we are asking lots of tough questions to IBM around iNotes for Lotus Notes and how much data it allows in the browser cache.

Ask the tough questions…. and continue to demand encryption.

I applied the 2.0.2 update last night. Not sure exactly what is fixed but so far I noticed much better keyboard response and faster gps performance in the maps application.

Attached are a couple of pictures from my phone this morning. The problem with an iphone 3g service drop typically begins with the hanging 1 bar. This 1 bar of service translates into the phone not allowing any cellular access. Shortly a “no service” occurs and this is only fixed by pushing the phone in and out of airplane mode.

Here’s hoping for a quick fix from apple.

So, my original iPhone 3g headphone jack failed today. So it was off to the apple store to visit the genius bar. I left with a new phone in hand. Let’s hope i I have better luck with this one.