Communications of the ACM
Johns Hopkins Researchers Poke a Hole in Apple's Encryption
A research team from Johns Hopkins University has successfully cracked Apple's iMessage encryption by exploiting a bug that would enable hackers to decode photos and videos sent as secure instant messages. The researchers wrote software to emulate an Apple server, and the encrypted transmission they targeted had a link to a photo stored in Apple's iCloud server and a 64-digit decryption key. The team guessed the digits by changing a digit or a letter in the key and sending it back to the target phone to see what would be accepted, and they repeated this process thousands of times until the key was revealed.
Johns Hopkins professor Matthew D. Green says this breakthrough disproves the notion that strong commercial encryption is hack-proof for either hackers or law enforcement. He also says such methods make court orders compelling companies to create software to open security unnecessary. "It scares me that we're having this conversation about adding backdoors to encryption when we can't even get basic encryption right," Green says. He urges users to update their phones and laptops to iOS 9.3 as a preventive measure.
The American Civil Liberties Union's Christopher Soghoian says the exploit illustrates the danger of companies building their own encryption without independent vetting.
From The Washington Post
View Full Article – May Require Free Registration
Abstracts Copyright © 2016 Information Inc., Bethesda, Maryland, USA
No entries found
Comment on this article
Signed comments submitted to this site are moderated and will appear if they are relevant to the topic and not abusive. Your comment will appear with your username if published. View our policy on commentsLog in to Submit a Signed Comment
Sign In »
Sign In
Signed comments submitted to this site are moderated and will appear if they are relevant to the topic and not abusive. Your comment will appear with your username if published. View our policy on commentsCreate a Web Account
An email verification has been sent to youremail@email.com
ACM veriŞes that you are the owner of the email address you've provided by sending you a veriŞcation message. The email message will contain a link that you must click to validate this account.NEXT STEP: CHECK YOUR EMAIL
You must click the link within the message in order to complete the process of creating your account. You may click on the link embedded in the message, or copy the link and paste it into your browser.