Apple's iOS 10 has weaker encryption that could make it much easier to access a password-protected backup, according to a Russian company that sells software for breaking into iPhones.
The vulnerability lies in local backups of devices running iOS 10, Apple's latest mobile operating system. Those backups, unlike ones saved to an iCloud account, can be accessed without certain security checks, according to Oleg Afonin of Russian software company Elcomsoft.
Afonin did not share which security checks could be bypassed when accessing a local backup stored in iTunes, but suggested that their absence would enable password-guessing software to work more than 40 times faster on iOS 10 devices than on those running earlier versions.
"This new vector of attack is specific to password-protected local backups produced by iOS 10 devices," Afonin wrote in a blog post. "The attack itself is only available for iOS 10 backups. Interestingly, the 'new' password verification method exists in parallel with the 'old' method, which continues to work with the same slow speeds as before."
Apple devices have notoriously strong encryption, so strong that the FBI initially claimed it needed Apple's help to break into the iPhone of a suspected terrorist earlier this year. But guessing passwords remains one of the ways to bypass that encryption.
"Logical acquisition (via password-protected iTunes backups) is currently the only way to extract and decrypt keychain data out of an iOS 10 device," Afonin wrote. It's possible that iOS 10's local backups don't require two-factor authentication, which would enable Elcomsoft software to guess passwords faster.
How much faster? The firm's software can guess iOS 9 passwords at 150,000 passwords per second with GPU acceleration, and 6,000,000 iOS 10 passwords per second using only the CPU.
Apple acknowledged the iOS 10 backup vulnerability and said it will offer a fix in an upcoming software update.
"We're aware of an issue that affects the encryption strength for backups of devices on iOS 10 when backing up to iTunes on the Mac or PC," a spokesperson said in a statement. "We are addressing this issue in an upcoming security update. This does not affect iCloud backups. We recommend users ensure their Mac or PC are protected with strong passwords and can only be accessed by authorized users. Additional security is also available with FileVault whole disk encryption."