iTunes Backup Passwords 'Much Easier' to Crack in iOS 10, Apple Working on Fix

iOS 10 uses a new password verification mechanism for iTunes backups that makes them easier to crack, according to testing performed by Elcomsoft, a company that specializes in software designed to access iPhone data.

Encrypted iTunes backups created on a Mac or PC are protected by a password that can potentially be brute forced by password cracking software. The backup method in iOS 10 "skips certain security checks," allowing Elcomsoft to try backup passwords "approximately 2500 times faster" compared to iOS 9 and earlier operating systems.

ios10
Obtaining the password for an iTunes backup provides access to all data on the phone, including that stored in Keychain, which holds all of a user's passwords and other sensitive information.

At this time, we have an early implementation featuring CPU-only recovery. The new security check is approximately 2,500 times weaker compared to the old one that was used in iOS 9 backups. At this time, we are getting these speeds:

iOS 9 (CPU): 2,400 passwords per second (Intel i5)
iOS 9 (GPU): 150,000 passwords per second (NVIDIA GTX 1080)
iOS 10 (CPU): 6,000,000 passwords per second (Intel i5)

In specific terms, security analyst Per Thorsheim of Peerlyst says Apple has switched from using a PBKDF2 hashing algorithm with 10,000 iterations to using a SHA256 algorithm with a single iteration, allowing for a significant speed increase when brute forcing a password.

ios10passwordcrackingelcomsoft

Image via Peerlyst

In a statement given to Forbes, Apple confirmed it is aware of the issue and is working on a fix.

"We're aware of an issue that affects the encryption strength for backups of devices on iOS 10 when backing up to iTunes on the Mac or PC. We are addressing this issue in an upcoming security update. This does not affect iCloud backups," a spokesperson said. "We recommend users ensure their Mac or PC are protected with strong passwords and can only be accessed by authorized users. Additional security is also available with FileVault whole disk encryption."

As Apple points out, this security oversight is limited to backups created on a Mac or PC and does not affect the security of iCloud backups. Most users likely do not need to worry about this issue as it requires access to the Mac or PC that was used to make the backup.

Apple has updates for iOS 10 and macOS Sierra in the works, and it's possible a fix will be included in the new versions of the software. iOS 10.1 and macOS Sierra 10.12.1 were seeded to developers and public beta testers earlier this week.

Related Forum: iOS 10

Top Rated Comments

joshwenke Avatar
100 months ago
Physical access to ANY machine is a security risk, no matter how strong password encryption is.
Score: 20 Votes (Like | Disagree)
cicalinarrot Avatar
100 months ago
They must hurry up. Yahoo was lucky enough their stocks were already worth nothing before the hacking.
Score: 17 Votes (Like | Disagree)
dwsolberg Avatar
100 months ago
I love Apple, but this sort of thing is so frustrating from a company that is trying to make privacy be such a huge part of its brand. Without security, privacy cannot exist. It doesn't have a huge effect on me, but it lowers my level of trust that Apple knows what it's doing.

As a developer, this is a pretty glaring flaw, so I can only assume (or hope, rather) it was a temporary implementation that accidentally got through to a release version. Whatever happened, it's bizarre.
Score: 17 Votes (Like | Disagree)
Hanzu Lao Avatar
100 months ago
Pretty lazy on their part.
Score: 13 Votes (Like | Disagree)
asleep Avatar
100 months ago
Lowered security threshold because hacking is becoming less of an issue in 2016...?
Score: 12 Votes (Like | Disagree)
Northgrove Avatar
100 months ago
But this is NOT physical access to the iPhone. They are talking about decrypting the BACKUP data. This data is typically on e hard drive on a PC or Mac or maybe in Apple's iCloud
This is iTunes backups. Most don't use iTunes backups these days, even fewer would have had time to make one for iOS 10. While this doesn't demand physical access to an iPhone, it seems to me like it would demand physical access to a PC or Mac (and only a PC or Mac, not an iPhone or iPad).
Score: 12 Votes (Like | Disagree)

Popular Stories

iOS 17

Troubling iOS 17.5 Bug Reportedly Resurfacing Old Deleted Photos

Wednesday May 15, 2024 5:29 am PDT by
There are concerning reports on Reddit that Apple's latest iOS 17.5 update has introduced a bug that causes old photos that were deleted – in some cases years ago – to reappear in users' photo libraries. After updating their iPhone, one user said they were shocked to find old NSFW photos that they deleted in 2021 suddenly showing up in photos marked as recently uploaded to iCloud. Other...
General Apps Messages

iMessage Down for Some Users [Update: Service Restored]

Thursday May 16, 2024 3:00 pm PDT by
The iMessage service that Apple users to send messages to one another appears to be down for some users, and messages are failing to go out or are taking an extra long time to send. There are numerous reports about the issue on social networks and a spike of outage reports on Down Detector, but Apple's System Status page is not yet reporting an outage. Update: Apple's status page says...
CarPlay Sound Recognition

Apple Previews Three New CarPlay Features Coming With iOS 18

Wednesday May 15, 2024 9:18 am PDT by
Apple today previewed new accessibility features coming with iOS 18 later this year, and this includes some new options for CarPlay. Apple highlighted three new features coming to CarPlay: Voice Control: This feature will allow users to navigate CarPlay and control apps with just their voice. Color Filters: This feature will make the CarPlay interface visually easier to use for...
maxresdefault

Hands-On With the New M4 OLED iPad Pro

Wednesday May 15, 2024 10:40 am PDT by
Today is the official launch day of the new iPad Pro models, and these updated tablets mark the biggest feature and design refresh that we've seen for the iPad Pro in several years. We picked up one of the new 13-inch models to check out everything new. Subscribe to the MacRumors YouTube channel for more videos. When it comes to design, Apple is still offering 11-inch and 13-inch size options ...
iphone 15 pro max vs iphone 16 pro max

iPhone 16 Pro Max Looks This Much Bigger Beside iPhone 15 Pro Max

Thursday May 16, 2024 4:51 am PDT by
This year's upcoming iPhone 16 Pro Max is expected to get a boost in overall size from 6.7-inches to 6.9-inches, and a new image gives us a good idea of how the current iPhone 15 Pro Max compares to what could be Apple's largest ever iPhone. The image above, posted on X by ZONEofTECH, shows a dummy model representing the ‌iPhone 16 Pro‌ Max alongside an actual iPhone 15 Pro Max. Dummy...
Delta Hands On Feature

iPhone Emulators on the App Store: Game Boy, N64, PS1, PSP, and More

Thursday May 16, 2024 12:45 pm PDT by
In April, Apple updated its guidelines to allow retro game emulators on the App Store, and several popular emulators have already been released. The emulators released so far allow iPhone users to play games released for older consoles from Nintendo, Sony, SEGA, Atari, and others. A list of some popular emulators available on the App Store so far follows. Released Delta Delta is...