Mailbox iOS app is a security fail

http://subhb.org/2013/04/24/mailbox-ios-app-is-a-security-fail/

by subhb • 13 years ago

98 55 13 years ago

subhb.org

Mailbox iOS app is not even using file protection API that iOS SDK provides by default.

Samuel_Michon2• 13 years ago

“if anyone else can get hold of your phone, he can access to files of those apps where data is not protected.”

As always, if someone has physical access and unlimited time, no device or computer is safe.

Also, Mailbox.app only supports GMail. Security minded people are obviously not the target market.

erishig• 13 years ago

Does that mean that basic security should not be in a company's mind, especially when it comes to the kind of data emails can contain? Mailbox is BIG. We are not talking of an average app here!

Samuel_Michon2• 13 years ago

“Does that mean that basic security should not be in a company's mind”

I wasn’t suggesting it shouldn’t be. My point is that the article’s headline is overly dramatic: Mailbox.app is not a complete security failure because of one hack that requires physical access. Given that Mailbox only supports GMail, I’d be more worried to put my email in Google’s hands than worrying over someone grabbing my phone out of mine.

“Mailbox is BIG. We are not talking of an average app here!”

Mailbox.app is a free app that has been downloaded a couple of million times, I wouldn’t call it “BIG” yet. It’s very new, it’s still on version 1, so it’s not expected to be perfect.

DanBC3• 13 years ago

Email is not secure. Email has never been secure. Nothing you send over email is secure. There's little authentication and no signing.

All this stuff can be kludged onto email, but the attitude should be "unless I've taken measures to add security this thing is not secure".

huskyr2• 13 years ago

If you get physical access you can also read all the mails in Apple's Mail.app, or any other app on the device. Maybe not using a tool, but you can easily read them in the app, forward them, and send fake e-mails using the account of the user.

(edited to make my point more clear :)

0x0• 13 years ago

Are you sure about that? I would think that Mail.app used apprioriate file protection settings, in which case the file contents is encrypted with a key derived from the user's PIN/passcode

delinka• 13 years ago

That's not entirely correct. If the app uses the correct APIs to inform the system that particular files need more protection, then those files receive more protection. The details are available to a free dev account on Apple's developer site. As long as the device remains locked, such files remain encrypted.

Whether users pick appropriate passwords is another matter entirely.

andyhmltn2• 13 years ago

Or, you could just... open up Mail.app? and read the emails without a tool haha.

fruitydrink3• 13 years ago

Well that's a non-issue, a locked iPhone will secure Mail.apps data it won't secure Mailbox because Mailbox hasn't told the phone to.

potatolicious3• 13 years ago

Not if the device is locked. The author talks about this in the post - a properly secured file is only decrypted when the device is unlocked (in which case the mail is readable by anyone with fingers, no need for fancy USB cables).

When the device is locked the file is encrypted and cannot be easily retrieved with a USB cable and a file explorer. An app that does not properly secure its files is readable even when the device is locked.

fruitydrink3• 13 years ago

@Samuel_Michon I take issue with the crap you are spreading.

>if someone has physical access and unlimited time There is no such thing as unlimited resources.

If I had unlimited time I could crack every encrypted message on the planet.

Using DPAPI turns a 30 second hack into an online cracking job. The crypto processor in the iPhone can only check one password every ~80ms and you need the chip with you. An attacker cannot do an offline attack.

mikeash• 13 years ago

You are confusing access to the computer itself with access to the data it contains.

Given physical access and "unlimited" time (i.e. no more than a million human lifetimes, say), then certainly an attacker can gain access to the device and make it do what he wants.

However, if the data on the device is securely encrypted, then physical access and (reasonable) time doesn't matter. He won't be able to get at the data.

nezza-_-• 13 years ago

An important fact is wrong: You actually need to unlock the device to access the data unless the iPhone and the computer were paired before.

cvursache• 13 years ago

Don't have any data on this, but I know a bunch of not-so-tech-savy people that don't use lock codes. Their data's then as naked as a greek nude.

johansch• 13 years ago

If the device is not locked, how about just launching the Mailbox app and browse the attachments via its fancy UI? :)

dan1234• 13 years ago

The very fact that so many apps (Facebook, Twitter, Mail etc) remain signed in while not in use prompted me to use a lock code (albeit with a 5 min grace period, a trade off for convenience). I can't see why anyone wouldn't want it enabled.

I think most devices paired with an ActiveSync (Exchange, GMail) account are required to use lock codes.

subhb10• 13 years ago

This is correct @nezza. I should have verified this with my friend's iPhone first. But the original issue still remains the same which is the files are not protected!

richardwhiuk• 13 years ago

They aren't protected if you go into the app and look at the files (probably turning data off first).

If you can unlock the phone, you've almost certainly already lost here.

subhb10• 13 years ago

Having said the above, one can copy all the contacts and emails of someone in few seconds. This is different than just browsing an email on UI (one would need time for that). What if someone has got an access to an iDevice just for few seconds. Ohh sir, you dropped your phone. Here you go but thanks to iExplorer I have all your documents and contacts now! Is this an issue? Depends what you use your email for!

coldtea• 13 years ago

Ever tried doing it in "a few seconds"? It takes several minutes in fact.

fruitydrink3• 13 years ago

You can retrieve data from the device with special equipment after opening the phone. This is beyond the typical "geek".

If you jailbreak the phone you can access all non protected data.

iOS Mail app uses DAPI correctly. For push mail when the phone is locked it will use a public key to encrypt the data.

I am unsure if even the Gmail app uses it correctly, I only tested the stock mail app.

If you have the an escrow key pair (ie. synced to iTunes) your are screwed. If should do a DFU mode restore to wipe the keybag completely.

bonzoesc• 13 years ago

> You can retrieve data from the device with special equipment after opening the phone. This is beyond the typical "geek".

Citation needed.

mikehotel2• 13 years ago

Most people with passcodes set auto lock after a few minutes. An attacker can pair a device left briefly unattended by just connecting it to their Mac in just a few seconds.

Then, even if the device is later locked, they can bulk copy unencrypted files using tools like iExplorer, and browse at their leisure.

It's funny how some business class apps store usernames and passwords in clear text in their app sandboxes.

mariusmg2• 13 years ago

If you lose your phone is already game over. Here's a idea...if you have important data that you want to be secure.....DON"T KEEP IT ON YOUR PHONE.

How about that, huh ?

subhb10• 13 years ago

How about making it more secure! Won't it solve the problem? It's just not about Mailbox app it's about all the apps that should protect user's data. Should they care about their user's data or leave it up to the device to protect it?

mariusmg2• 13 years ago

No. Sorry but encryption doesn't really solve the problem. If you lose the device with valuable info on it, the info will be recovered even if it's encrypted.

uzyn• 13 years ago

This is like telling someone you can access his ~/Documents/ and read the content of files within when he leaves his laptop unattended and logged in.

subhb10• 13 years ago

One need to handle security differently for mobile devices and for laptops. When it comes to the example I gave above in one case a person can read the contents of the files, in another case the same person can copy your entire content. Now if that's not something to worry about, what is!

andyhmltn2• 13 years ago

That's not worrying at all. Considering you need the passcode of the device to do so. If they have the passcode, or there isn't one, then the attacker can just open the app and look without extracting the files. These aren't passwords stored in plaintext. This is plaintext stored in plaintext.

cheffe2• 13 years ago

There is a secure store solution available from a company located in germany. They call it "Secure Incremental Store" - an enhancement for Core Data.

subhb10• 13 years ago

Interesting. But Apple provides protection API for Core Data as well as a part of their SDK.

cheffe2• 13 years ago

Protection API is not enough -> jailbreak. And with device passcode disabled the door is open.

uptown• 13 years ago

I'm less concerned about physical access to the device, but more concerned about third-party services like Mailbox increasing the number of attack vectors on your inbox. Mailbox has total access to your email account. Now somebody can either attempt to hack Google's servers, or Mailbox's servers. It's enough to convince me not to sign-up for their service since email provides the gateway to virtually everything else.

jalada• 13 years ago

This. Why is no one talking about this massive elephant in the room? Mailbox wants you to trust it (and its employees) with (reversibly-encrypted? I haven't used the app but I don't know how it could provide all its features without this) access to and storage of your Gmail account and all your emails?! I barely trust Google with that.

This article just helps compound the idea that that trust might be a little misplaced....

scrumper• 13 years ago

Mailbox was nice, but I dropped it after a week when your point occurred to me. As far as I could tell, the only reason it needed full access was for push notifications. There was no discussion at all of account security, and I just couldn't bring myself to trust them. There's no way one of the usual cutesy startup apologies would cut it here if they compromised my email.

I'm back to Sparrow now (which doesn't do push) and quite happy: Mail.app tells me I have a new message, then I process my emails in Sparrow.

jder• 13 years ago

The original article misses the whole point of the NSFileProtection API: the strongest level of protection, NSFileProtectionComplete, prevents access to files while the device is locked. The whole point of the API is to protect things until the user has authenticated. (It's quite possible Mailbox is already using this API, given the evidence presented.)

In other words, this is the expected behaviour when your phone is unlocked.

See: https://developer.apple.com/library/ios/documentation/Cocoa/...

danpalmer• 13 years ago

I'd recommend "Hacking and Securing iOS Applications" by O'Reilly. It really explains well the security and permissions model on the phone.

The argument that 'once you've lost the phone you've lost the data anyway' isn't really fair. If a passcode is being used, data marked as being a security concern is protected with the passcode. A 4 digit code is trivial to brute force, yes, but the point is that it should be done anyway.

Using iExplorer to find files is a lot easier than loading a custom bootloader on to the phone, booting custom firmware, brute forcing the passcode and decrypting the files. If anything, the extra time will raise the chance that you can get to a computer and initiate a remote-wipe.

subhb10• 13 years ago

Can someone verify this with an iOS5 device. On iOS 6.1.3 this doesn't work anymore though. But someone just claimed this on the blog: "I ran a test using my iPhone 5 and a computer I’ve never synced with before. I didn’t need to unlock the phone before getting access to it I don’t believe. I did manage to browse all my mailbox files."

mikehotel2• 13 years ago

You don't need to sync your device to pair it. This someone may have connected his unlocked device to the computer, which is enough to pair the device. Once a device is paired, the file system can be browsed regardless of lock status.

I have not tested with a new 6.1.3 device yet, but if true, this would be a very serious security regression.

bengotow• 13 years ago

Mailbox.app is a security concern because it copies all of your Gmail to it's own cloud server, and delivers the email to the app from there. Sure, it's exposing your emails on the device. I'm more concerned about them exposing _everyone's_ emails when their cloud platform is exploited.

Mailbox iOS app is a security fail

Related Stories