October 18, 2013
Four Months On, Apple Still Claims It Cannot Decrypt iMessages
Michael Harper for redOrbit.com - Your Universe Online
However, security firm QuarksLab presented a white paper at the Hack in the Box conference on October 17, 2013 in which they claim Apple can, in fact, decrypt iMessages if they really wanted to. This led to several headlines claiming that even Apple’s notoriously locked-down services are vulnerable to spying from the government.
Now Apple has released another statement claiming QuarksLab’s white paper is based on theoretical engineering and does not represent how iMessage is currently deployed.
In its lengthy and detailed white paper, QuarksLab suggests Apple could essentially pull off a “man-in-the-middle” attack by controlling both ends of the conversation. At its most basic level, iMessage already facilitates conversations in this way, patching one user to another, but QuarksLab’s paper goes into much further detail.
Apple encrypts iMessage through a series of keys, keys the company claims it has no access to. To communicate with one another, the users are essentially using these keys to both access the person they’re chatting with and to unlock the message. If Apple simply interrupts this transaction, says QuarksLab, it could read the messages being sent through the service.
"Yes, there is end-to-end encryption as Apple claims, but the weakness is in the key infrastructure as it is controlled by Apple: They can change a key anytime they want, thus read the content of our iMessages,” writes Cyril Cattiaux on the QuarksLab blog post explaining the vulnerability.
“Apple's claim that they cant read end-to-end encrypted iMessage is definitely not true. As everyone suspected: yes they can! Suspecting is not knowing, and we hope to have dig enough in the protocol to show how Apple could do it,” Cattiaux added.
In a statement to All Things D today, however, Apple refutes this research and says it couldn’t intercept messages even if it wanted to.
“iMessage is not architected to allow Apple to read messages,” said an Apple spokesperson. “The research discussed theoretical vulnerabilities that would require Apple to re-engineer the iMessage system to exploit it, and Apple has no plans or intentions to do so.”
The constant stream of information about the NSA’s surveillance program makes this issue particularly difficult. Though Apple claims it can’t read iMessages if it wanted to, it is likely it could be forced to by the government. It’s been reported that some companies, specifically Microsoft and Microsoft-owned Skype, have built in backdoors to their servers to allow for easy interception of data.
Additionally, we’ve also heard how companies aren’t allowed to discuss details of NSA surveillance programs and wouldn’t be allowed to say in what way they participated. In other words, Apple may say it can’t access iMessages, but under threat of the law, it may find a way.
Earlier this year, however, the Drug Enforcement Administration claimed it was “impossible” to intercept iMessages between two Apple devices.
After trying to snoop on messages sent between two suspects, the DEA claimed it couldn’t be done. Though the entirety of iMessage has yet to be understood or discovered, QuarksLab’s study seems to be the most extensive yet.