Got a tip for us? Share it...

New in OS X: Get MacRumors Push Notifications on your Mac

Resubscribe Now Close

iOS 7 Security Flaw Leaves Stored Email Attachments Unencrypted [Updated]

Apple states that it uses data encryption to protect email message attachments, but a report from security researcher Andreas Kurtz, via ZDNet, claims iOS 7.0.4 and later does not include this security feature.

security-flaw-email-attachmentsKurtz detected this flaw in iOS by accessing the file system on an iPhone 4 running iOS 7.1 and 7.1.1. Browsing through the email folder for an IMAP account, Kurtz discovered that the email attachments were stored in an unencrypted state. Besides the iPhone 4, Kurtz also was able to reproduce this vulnerability on an iPhone 5s and an iPad 2 running iOS 7.0.4.
I verified this issue by restoring an iPhone 4 (GSM) device to the most recent iOS versions (7.1 and 7.1.1) and setting up an IMAP email account1, which provided me with some test emails and attachments. Afterwards, I shut down the device and accessed the file system using well-known techniques (DFU mode, custom ramdisk, SSH over usbmux). Finally, I mounted the iOS data partition and navigated to the actual email folder. Within this folder, I found all attachments accessible without any encryption/restriction
Kurtz reported this issue to Apple, which acknowledged the flaw, but provided no timetable for patching it. This isn't the first security issue Apple has faced this year. The company recently patched a serious SSL connection verification flaw in both iOS and OS X that allowed an attacker with a "privileged network position" to capture data protected by SSL/TLS.

Update 3:11 PM PT: In a statement given to iMore, an Apple spokesperson said the company is working on a fix for the issue.
"We're aware of the issue," an Apple spokeswoman told iMore, "and are working on a fix which we will deliver in a future software update."

Top Rated Comments

(View all)

11 weeks ago
Oh noes... if someone steals my iPhone and then is using some not so easy technique to access the file system of my iPhone then navigating to my email folder can then read my email attachments......

Probably this security flaw affects 0.0001% of iOS users but everyone will think "OMG another security flaw!!!11" :rolleyes:
Rating: 34 Votes
11 weeks ago

So iOS versions 7.0.3 and below encrypted attachments? Why would they drop that feature?


Apple's new motto:
If things aren't broken, fix them till they're broken.
Rating: 28 Votes
11 weeks ago
I predict that an NSA agent working for Apple will bang his head on his table, while thinking: "How many more loopholes that I inserted will be discovered by the public?"
Rating: 25 Votes
11 weeks ago
When you email an attachment its not encrypted.
Rating: 24 Votes
11 weeks ago
Every time someone says “This consumer electronic device isn’t secure for (x) reason!” and then follows it up with a description that pretty much requires direct hardware access, I have to wonder. How easy do you think it is to steal stuff in my pockets?
Rating: 19 Votes
11 weeks ago

Oh noes... if someone steals my iPhone and then is using some not so easy technique to access the file system of my iPhone then navigating to my email folder can then read my email attachments......

Probably this security flaw affects 0.0001% of iOS users but everyone will think "OMG another security flaw!!!11" :rolleyes:


If 'Apple' would read 'Microsoft' this entire forum would come down on them like a ton of bricks...... Don't you think?
Rating: 11 Votes
11 weeks ago
So iOS versions 7.0.3 and below encrypted attachments? Why would they drop that feature?
Rating: 11 Votes
11 weeks ago


Very happy to be proven wrong by someone with creditable knowledge of the subject?


Good luck finding that here.
Rating: 8 Votes
11 weeks ago
Meh.

I don't see where this is a big deal. They aren't encrypted on your computer either, and it is much more difficult to hack into a phone for the average person than a computer.
Rating: 7 Votes
11 weeks ago
One of Apples biggest problems is that they remain schtum.
People want some acknowledgement and feedback, this along with the regular changing of OS versions will prevent them from ever being the major force in enterprise.
Rating: 6 Votes

[ Read All Comments ]