Talk of Apple being able to read iMessage contents is nothing that new, but it’s been at the fore today after the iPhone and iPad maker was forced to reiterate that it cannot see the content of messages, even if it wanted to. That may have put people’s minds at rest, and while it should be reassuring, Apple’s claim has already had a bog old dollop of doubt thrown at it by jailbreak supremo Pod2g.
Speaking as part of his security firm QuarksLab, Pod2g says that people with the right amount of knowledge and access to an iOS device just the once could, in theory, read whatever is sent via iMessage and even alter what is being received if they so wish.
Pod2g was speaking at a conference in Kuala Lumpur, Malaysia, and even went so far as to show ZDNet how the whole thing works.
As the man himself shows in the video, it’s theoretically possible for someone to alter any message at the receiving end thanks to a flaw in the way certificates are handled. This affects both iOS devices and Macs, and QuarksLab will be releasing a Mac app and a jailbroken iOS device tweak that will plug the hole once the conference is over.
The researchers explained that to break iMessage encryption (AES, RSA, and ECDSA algorithms) in the manner shown would require the attacker to get physical control of the device — once.
Then, the attacker would install fraudulent certificates on it, and run spoofed servers tricked out to mimic Apple servers. The flaw’s essence, as QuarksLab described it, lies in the protocol’s lack of certificate pinning.
As Pod2g and his team points out, the issue comes in the fact that Apple owns the infrastructure from end-to-end, meaning that it could change the certificates and associated keys at will, effectively giving it control over our iMessages. Whether it would want to though is obviously up for debate.
Apple will no doubt now look to plug this hole on both the Mac and iOS, and the fact that malicious hackers would need access to our devices in order to pull off this trick should make us all sleep a little easier tonight.
You may also like to check out:
You can follow us on Twitter, add us to your circle on Google+ or like our Facebook page to keep yourself updated on all the latest from Microsoft, Google, Apple and the web.
