It looks like you might have to think twice before flipping that old
iPhone on eBay when the 3G version finally hits -- it appears that restoring the phone doesn't actually erase the contents of the flash, meaning that your data is available to anyone with the proper tools until it's overwritten. Making matters worse, it appears that Apple doesn't do a low-level format when refurbishing iPhones either -- an Oregon State Police detective was able to use forensic software to pull files, emails, and screenshots off an out-of-the-box refurbished iPhone. This actually shouldn't be surprising to anyone -- we've seen
several utilities that access "deleted" portions of storage -- but since Apple doesn't provide users direct access to the iPhone's filesystem, it's basically impossible to clear your personal data off the device short of restoring and filling the disk with junk data. Hopefully iPhone 2.0's
Exchange-based "remote wipe" feature is a bit more secure, eh?
[Via
TUAW]
posted May 20th 2008 3:59PM
Lame. iPods can be wiped completely without issue, so the iPhone should be no different. I'm glad I'm not playing the early adopter game this time around.
Settings > General > Reset > Erase All Content and Settings
Quick and simple. I saw the Genius Bar technician do it and he made me confirm to reset the iPhone when I turned mine in to exchange (broken power button).
It seems like Doug Wilson didn't even read the synopsis, much less the article.
Seems like O rly didn't read Don Wilson's name properly.
Hardy har har...
watch.. in a week, Apple will sell a feature to fully wipe the phones memory for $19.99 citing that they would prefer to give it away free, but must charge due to 'accounting purposes'
Don't be silly. It will be free for iPhone users but will cost an extortionate amount to iPod Touch users.
10 bucks to Iphone and 20 to Ipod touch
dude, it been out for almost a year. I think you can buy it and not be an early adopter now.
...another reason why it's not a business phone, nor very "smart."
I wonder how much longer a low-level format would REALLY take Apple, instead of doing a simple re-flash.
Agreed. I can wipe my WinMo phone by sending a text message lol
If you put in a new SIM card it'll send me a notification with the number.
Wow!! You would think a '$600 phone' would have a security wipe feature, that's good o'l apple for ya!
Writing over the entire storage partition might take another 10 minutes on top of the regular restore process. This is really quite lazy of Apple, and a rather serious security leak. Anyone who's had their iPhone replaced could now have personal data floating out there.
I don't know how most remote wipe features work, but I doubt any of them perform a secure erase, mainly because you can't even be assured that the phone will have sufficient battery power to complete the operation. Solid state is efficient power-wise, but constant disk write for 10 minutes is not something cell phones are designed to do.
bobartig: You can encrypt everything, and then just overwrite the encryption key. That's what a Blackberry does, at least a well secured corporate one.
Never the less, the Apple iPhone is a far superior device compared to all other phones on the current market...and it can play D......
The iPhone is a fantastic device, but I think we're seeing the side effect of putting oodles of thought into the usability and sacrificing key functions to make the deadline. That said, the iPhone is likely going to get all of the most important functions before the year is out, but I myself intend to wait until it's mature enough so I don't have to deal with those glaring deficiencies. If I get an iPod touch before then, then I guess I'll just get a new Sony Ericsson and fuggetaboutit.
Far superior. Unless you value your privacy.
But who really gives a crap about that kind of stuff, right? It has coverflow, oooooh!
I'm pretty sure the iPhone is far superior in only very few ways, including (but maybe not limited to):
-Internet browsing (ONLY on WiFi though)
-HTML email
-Pretty user interface
-Threaded SMS
I'm also pretty sure that other smartphones are far superior in the ways that are either very basic or actually matter including (but not limited to):
-Decent security of any sort (Remote wipe, data scrubbing, encrypted data, etc.)
-WiFi security compatibility (specifically the ability to employ various security algorithms that iPhone simply does not support, thus making it worthless in many secure WiFi environments)
-Push email
-Compressed web browsing (through programs like Opera or Skyfire) for web surfing in EDGE-only areas
-Search abilities in long lists of messages (or anywhere else for that matter)
-MMS
-Reliability of phone calls
-Customizable sound profiles for different environments
-A speaker that is actually audible when the windows are rolled down in your car
-Navigation capabilities (and no, triangulated GPS through Google Maps is NOT an answer)
So I implore you, iEye, to tell us exactly how you can call "the Apple iPhone is a far superior device compared to all other phones on the current market." I'm not sure what's most important to you, but surely what I've listed above is not untrue.
And yes, I've owned probably every device currently out there, including the iPhone. And I also know that Apple has the potential to fix the above listed shortfalls. So don't tell me what Apple is planning on doing. I'm talking about today, May, 2008, and prior.
idiot...
Matt, don't forget that many winmo phones have the ability to tether and share their internet connection with a laptop via USB or bluetooth. For users in our industry, that is a must. Until the iPhone can do that, it's considered a toy for us.
My 8525 3G phone has 1500kb down, 600 kb up and a ping of 180. Not bad for mobile.
You're right, Steve. I was sure I'd be forgetting something, hence the "including (but not limited to)" in my description :-)
Is that illegal?
Not illegal, just dangerously stupid.
Holy crap... I'm sitting here thinking about the sensitive/confidential documents that go through my BB... That would not be good.
Thats pretty scary that all the refub iphones in the world still have your CC info and personal banking info.. Or confidential business emails still stored on them after you thought you formatted it..
Yeah i would be pissed if i was a user.. Lets see how long this will last before the Apple fanboys storm the tower demanding APPLE fix this.
How long do you think itll take for someone to try and sue APPLE b/c their personal info was found on a refurb iphone that they thought had been deleted by a format.
Apple will appease the masses by handing out a coupon for $100 off the next iPhone...
Yeah, because giving $100 worth of credit covers for something bigger that COULD potentially happen if someone were able to find information and use it and inflict various damage to the prior user...
i see Apple running out of stock of Refurb iPhones quite quickly due to identity thieves reading this article.
So far, Apple has been decent about delivering security updates. I hope this one is the same way.
iPhOWNED!
iGroaned
Why the hell are people doing banking and credit card related stuff on their iPhones?
agreed.
Well, probably because it has the most heavily advertised full-featured browser on a mobile device, and with it you should be able to do whatever you damned well please?
That said, if the USER is a moron, that's not Apple's fault. Although I guess you could argue that it IS their fault, what with their ridiculous campaigns touting their software as being the most secure and stable, giving their user a false sense of security.
I also agree, but I guess people interpreted how Apple marketed/advertised the iPhone and it's internet capabilities. By Apple saying the iPhone would be able to browse web pages like you would on a reg. desktop or do things like you would be able to do at home on your computer would make an uniformed user that it would have the same security measures of a desktop.
Why would you own a mobile device if you didn't use it to do your daily tasks? It's just a pretty little solitaire playing phone if you aren't using it to do tasks "on the go" that you would normally do on your laptop of desktop.
Most users think about security as an afterthought; usually when something bad's happened.
Remote wipe sounds kinda dirty
It's not only the iPhone, this can be done to any device otherwise it wouldn't be for sale. Also don't expect this software to be in the hands of Anyone but top ranking law enforcement agencies, this is not something your local narcotics office will have it's hands on ether i don't think. Anything can be done but i doubt law enforcement will do forensic on a phone just for any little dumb thing
What are you talking about? This is something that the guys I work with could figure out in their spare time. You don't need to work for a law enforcement agency in order to be able to hack an iPhone.
nothing a quarter inch drill bit couldn't prevent...
The entire problem is that the data is not erased properly, thus it's ridiculously easy for *anyone* to recover.
How quickly do you think this will become a nonissue? Apple is gonna issue an update and you'll be able to do a complete dump. I agree that it's sad that this is happening but the guy listed in the story did say that he used "forensic software" to get the files, it wasn't like some guy just was clicking through and found the stuff. How many other devices is this true of? Stop running around screaming like the iPhone is the only device that is potentially insecure!
I dunno, it's pretty standard of Apple to have their devices and hardware to be on "lockdown". This flaw or plus (in this case, it is a flaw), not being able to erase all your data is pretty sketchy,
The question is why wasn't it done in the first place.
Even if it is fixed, it doesn't really help all of the people that have already turned in their phones and have been resold or are available for sale. I doubt Apple is going to go back and wipe every ready for sale refurbished phone it has in inventory.
Forget about the iPhone can do this and that, this is some serious and scary stuff here. And what's more disturbing is even with the iPhone's refurbished from Apple themselves are not throughly formatted before selling again. If I had an iPhone that I sent back for whatever defect and had information on it and thought it was released, I would be going crazy right now knowing that it's still on there. Even if Apple didn't include a format app on the iPhone itself, they could have easily programmed a separate app you can download and run to format the iPhone.
As an Apple fan, this is extremely disappointing, security should have been a top priority and it's not a good enough of an excuse by anyone (not even Apple) to say it's our/their first phone.
Agreed. At one point, I thought I would have to take my iPhone in to get repaired/replaced. I fixed it myself with some effort, but I'm scared now at the data that could have been given away if it were resold.
Wow, this is a major security hole. I'm surprised by apple. Shame!
I'm just laughing at all the lowly ranked iPhan-boys.....lol times
So.... if it's jailbroken and you can access the filesystem, what do you need to delete?
This is a pretty scary thing, one of the reasons I typically keep any of my electronics devices in the family, e.g. no eBay. Either way, with all the features of 2.0, I think we will see a consumer usable "Remote Wipe" function, matter of fact, if it wasn't already planned, I bet the iTunes team is throwing a menu option in right now after reading the blogs. The iPhone has its shortfalls, I am a big Apple person and the fact the phone doesn't have MMS pisses me off as much as the next guy, but the iPhone has one killer feature that most phones don't have, or at least not as easily. That is the ability to easily update software, with the iTunes interface you have a centre point for syncing everything including a software update. The iPhone has its downfalls, but many of them can be fixed through software and sent to the masses to have loaded on their phones very quickly. Correct me if I am wrong, but I don't know of any other device with that kind of ease of upgrading.
dude...the software updates fixes the iphone and puts in features that are already built-in some cheap standard phones.
also...no one has to "jail break" other phones to use it to full capacity.
This isn't related to iPhone feature shortfalls, its a procedural problem with their refurbishing process. When your cellphone fails, regardless of which brand you have, you may not be able to do anything to it. Maybe it has a bad display or faulty dock connector, or bad power caps. You can't remote wipe a phone that won't boot! You get your warranty support and move on. (or, if you must secure your data, you destroy the phone and get a new one)
Then, its up to the mfr to make sure that the memory chips are securely wiped before they end up in a new phone. I don't know if they refurbish on the component level, but if they do, your 8GB flash chip might end up on a different phone, regardless of whether its an iPhone, black berry, etc. etc. So, not an iphone problem, but it is Apple's fault.
wow...want to hack into someone's private life...get an iphone
i wonder what the idiotic cupertino people do when designing their toys...whats the use of having such a large capacity if you cannot even fully access it and atleast delete it???
this is like getting stuff out of an old hard drive (with capacities like 8GB and 16GB) which no longer works.
Really, Vidit? Can you tell me exactly how to get this information off an iPhone? I bet you can't. I'm not saying it's not a problem, but I am saying if you got a refurb iPhone, you wouldn't be able to get any previous data off of it. If you think you could, please share with the class exactly how you would do it.
If you missed the point I'm making, please respond with something stupid.
dude...if it weren't a problem then why would we be having a discussion on this
did i say that i could be able to do it...ya i dont know how to do it and so do most of us commenting here....and thats because i'm not stupid enough to buy this toy
yes...one of the guys in this forum itself said...jail break it and access the file system...and here you go...you have everything with you
try it out Zak...buy a refurbished iphone, jail break it and you'll be able to find previous user's data...and if not then ask engadget to take off this discussion completely
and Zak...one more thing...HDD use electro-magnetic technology to store data unlike flash memory
with flash memory there can be no "image" of previous data as is the case with magnetic storage devices. that is why it is said...it will not be a problem if it were completely overwritten.
you can recover everything from an old HDD because it would be magnetic and not a flash drive
i can give you more technological details if you want.
Yes, you missed the point and said something stupid. First, I didn't say it wasn't a problem. Are you really bad at reading? Here is exactly what I said: "I'm not saying it's not a problem". For god's sake if you're going to reply can you at the very least READ what I said first? Please?
Second, you're bitching about something that not only wouldn't affect you, but you wouldn't know how to take advantage of it anyway. Can you see why you bitching about it is completely pointless? I asked you to tell me how you would do it, and you can't. I believe that was the point, it's beyond you.
Don't you think that if it were as simple as jailbreaking an iPhone that A) somebody would have done it before now and B) it wouldn't have required specialized forensic software to accomplish? Oh let me guess, you didn't read the article either.
And why you decided to point out the obvious regarding hard drives is beyond me. Do you really think you're telling me something I didn't already know? How much dumber could you possibly be about this?
This whole thread reminds me of an XKCD comic a while back...
http://imgs.xkcd.com/comics/duty_calls.png
Yeah, but who's saying that no one will attempt to learn the methods on how to hack into the iPhone now? You can't answer that question now can you, Zak? Just because someone doesn't know how to do something today doesn't necessarily mean they won't be able to learn it in the future thanks to the news and Google (learning purposes). Also, you should put into account that this is a high-tech device and chances are the person using an iPhone will probably have a good idea of how software/modding works.
This is honestly ridiculous story...
This is true with any electronics. There are thousands of HDD on ebay being sold that can probably be data mined for personal information. True, maybe the formatting system on the iPhone isnt quite the safest way of doing it, but your casual dumpster diver wont know where to get their dining mining tools.
I dont even know why Im getting all riled up about this either, its not like I even have an iPhone....
You're absolutely right!
This story is only featured because it has the word 'iPhone' in it, so people are OMG iPhone I better read this!! and since it's negative all the iPhone haters can join in and make it seem like it's the only phone with flash memory that needs to be zero written!
Here's a message to all of you:
EVERY phone that stores information on a flash chip suffers from this. You can buy a factory reset Nokia on eBay and recover the data from the previous owner.
Unless you write all zeros to every bit on the flash chip some data can be recovered, and no device I know of is going to make the user wait while it makes several passes making sure the flash is truly blank, especially an 8/16GB device!
To anyone who has sold a Hard Drive on eBay, did you really sit there and write zero's on every bit at least 7 times? No? Well shut up then :)
You can use this program to recover files.
http://www.file-recovery.net/
"This story is only featured because it has the word 'iPhone' in it, so people are OMG iPhone I better read this!! and since it's negative all the iPhone haters can join in and make it seem like it's the only phone with flash memory that needs to be zero written!"
Well, that's only half the point. The other half is that the iPhone fanboys can come n here and tell the haters why none of this matters and that the iPhone is still the greatest thing EVER.
Then they argue, despite the fact that no Fanboy will change their mind, and no hater will change their mind. and the view counts and reply numbers go up and. Bing bang boom, you've got a certified hit post!
ok u really over generalized this
yes any data on any type hdd can be reclaimed giving enough time
but the odds of u actually getting off my meizu m6 after did a low level format and wrote thousand and thousand of zeroes over it is slim and if u did it be to fragmented and it probable wouldn't be usable
the security flaw here in the iphone is the fact that apple locked u out from being able to that thus making much easier to reclaim data and a 100 percent usable
It's ridiculous to inform people that their data may not be securely wiped when they thought it was, before Apple resells the phones?
just swipe a Neodymium magnet over your phone, that would probably erase everything...
Nope: flash memory is not sensitive to magnets.
That's the OSP for ya
If you flash the baseband is everything wiped out, or can people still get your info?
I walked my iphone up to a 1.5 Tesla magnet. Ran the battery low in seconds. Thought I bricked the phone. For the hell of it I pluged in the charger. Two hours later, I had a full charge and all my data was there.
you won't believe this, but I e-mailed sjobs@mac.com (but i think it is apple.com) about this EXACT issue.
The problem is not just failing to clear flash memory. i told steve, and hopefully he listened, that in fact it is iTunes that is the problem. For example, I went to the apple store because every time i would open safari, 7 windows would be opened from a week prior when I upgraded to 1.1.3. I was given a new/replacement/refurb iphone and when i connected it to itunes at home, the same flash problem was etched into the new phone!
so if you send you iphone in for a battery refurb they could just swipe all your user data as well, right? (take a "security" backup. I am sure the UK would be interested in that)
great stuff here... Lowtech solution would be to have a BBQ in the garden, just make sure it melts properly :). otherwise they might use some forensic software to revive your data.
I write software used in repair centers for a major cellphone manufacturer. Our software automatically clears all personal information from phones as part of the repair/refurb process. We are required to do that and it's in most of our contracts with carriers (like AT&T).
This is in fact a big deal and companies have been sued for selling phones with customer information still on them. For example, one phone had a smart autocomplete function that would store your most used words and phrases and suggest them when you write a text message. Somebody ended up getting a refurb phone from a kid who had used a lot of offensive language, and the phone suggested a lot of four-letter words to the new owner.
I don't know what AT&T's relationship with Apple is, but if this sort of thing happened with our phones AT&T would basically tell us to stop refurbing phones until we fixed it.
CLASS ACTION! :)