New in OS X: Get MacRumors Push Notifications on your Mac

Resubscribe Now Close

iOS 7 Security Flaw Leaves Stored Email Attachments Unencrypted [Updated]

Monday May 5, 2014 7:28 am PDT by Kelly Hodgkins
Apple states that it uses data encryption to protect email message attachments, but a report from security researcher Andreas Kurtz, via ZDNet, claims iOS 7.0.4 and later does not include this security feature.

security-flaw-email-attachmentsKurtz detected this flaw in iOS by accessing the file system on an iPhone 4 running iOS 7.1 and 7.1.1. Browsing through the email folder for an IMAP account, Kurtz discovered that the email attachments were stored in an unencrypted state. Besides the iPhone 4, Kurtz also was able to reproduce this vulnerability on an iPhone 5s and an iPad 2 running iOS 7.0.4.
I verified this issue by restoring an iPhone 4 (GSM) device to the most recent iOS versions (7.1 and 7.1.1) and setting up an IMAP email account1, which provided me with some test emails and attachments. Afterwards, I shut down the device and accessed the file system using well-known techniques (DFU mode, custom ramdisk, SSH over usbmux). Finally, I mounted the iOS data partition and navigated to the actual email folder. Within this folder, I found all attachments accessible without any encryption/restriction
Kurtz reported this issue to Apple, which acknowledged the flaw, but provided no timetable for patching it. This isn't the first security issue Apple has faced this year. The company recently patched a serious SSL connection verification flaw in both iOS and OS X that allowed an attacker with a "privileged network position" to capture data protected by SSL/TLS.

Update 3:11 PM PT: In a statement given to iMore, an Apple spokesperson said the company is working on a fix for the issue.
"We're aware of the issue," an Apple spokeswoman told iMore, "and are working on a fix which we will deliver in a future software update."


[ 130 comments ]


Top Rated Comments

(View all)

Avatar
marvz
64 months ago
Oh noes... if someone steals my iPhone and then is using some not so easy technique to access the file system of my iPhone then navigating to my email folder can then read my email attachments......

Probably this security flaw affects 0.0001% of iOS users but everyone will think "OMG another security flaw!!!11" :rolleyes:
Rating: 34 Votes
Avatar
DipDog3
64 months ago

So iOS versions 7.0.3 and below encrypted attachments? Why would they drop that feature?


Apple's new motto:
If things aren't broken, fix them till they're broken.
Rating: 28 Votes
Avatar
yjchua95
64 months ago
I predict that an NSA agent working for Apple will bang his head on his table, while thinking: "How many more loopholes that I inserted will be discovered by the public?"
Rating: 25 Votes
Avatar
spazzcat
64 months ago
When you email an attachment its not encrypted.
Rating: 24 Votes
Avatar
GeneralChang
64 months ago
Every time someone says “This consumer electronic device isn’t secure for (x) reason!” and then follows it up with a description that pretty much requires direct hardware access, I have to wonder. How easy do you think it is to steal stuff in my pockets?
Rating: 19 Votes
Avatar
ouimetnick
64 months ago
So iOS versions 7.0.3 and below encrypted attachments? Why would they drop that feature?
Rating: 11 Votes
Avatar
GoodWatch
64 months ago

Oh noes... if someone steals my iPhone and then is using some not so easy technique to access the file system of my iPhone then navigating to my email folder can then read my email attachments......

Probably this security flaw affects 0.0001% of iOS users but everyone will think "OMG another security flaw!!!11" :rolleyes:


If 'Apple' would read 'Microsoft' this entire forum would come down on them like a ton of bricks...... Don't you think?
Rating: 11 Votes
Avatar
Alex Cutter
64 months ago


Very happy to be proven wrong by someone with creditable knowledge of the subject?


Good luck finding that here.
Rating: 8 Votes
Avatar
TEG
64 months ago
Meh.

I don't see where this is a big deal. They aren't encrypted on your computer either, and it is much more difficult to hack into a phone for the average person than a computer.
Rating: 7 Votes
Avatar
SmileyDude
64 months ago

When you email an attachment its not encrypted.


This is a huge point that is being ignored. Sure, it would probably be marginally better if attachments are encrypted on the device, but it was transmitted over an insecure channel to begin with.

Another point missed -- on iOS, the entire filesystem is encrypted and can't be accessed if there is a pincode or fingerprint securing the device. In this case, the files are unencrypted on the filesystem, but the front door to the house was left unlocked.

For average users, the filesystem encryption is more than enough security. This is just nitpicking now.
Rating: 6 Votes

[ Read All Comments ]