German researchers have demonstrated the ability to reveal passwords stored in a locked iPhone in six minutes and without needing to crack the passcode. The attack targets Apple’s password management system known as keychain and is based on existing jailbreak exploits that gives the attacker wide access to the iPhone’s internal data.

Once jailbroken, the researchers installed an SSH server on the iPhone and install a keychain access script. This keychain access script utilizes functions that are built within the phone to access passwords and other data stored in keychain which is then outputted to the attacker. For a demo of the exploit,  jump the break.

The German researchers working at the state-sponsored Fraunhofer Institute of Secure Information Technology explain that the attack works because current iOS devices have a cryptographic key that is based on data within the device and not based upon the passcode. As a result an attacker can gain access to the internal iPhone data through a jailbreak and then access all the information required to get into keychain.

Whilst this attack is limited to accessing data in the keychain, it means data such as the passwords for Google Mail, Microsoft Exchange accounts, voicemail, WiFi passwords and some app passwords are fully compromised and accessible to an attacker with physical access to someone’s iPhone. This poses some serious security threats for corporate companies in particular who have adopted the iPhone, which includes a number of Fortune 500 companies. An attacker could steal an employees iPhone and within minutes have access to a corporate network and the user’s confidential emails.

The researchers also wrote that “control of an e-mail account allows the attacker to acquire even more additional passwords: For many web services such as social networks the attacker only has to request a password reset.”

The only way at this stage to prevent such an attack is to avoid the attacker from physically accessing the iPhone, if they do the researchers say it is imperative to “instantly initiate a change of all stored passwords, additionally, this should be also done for accounts not stored on the device but which might have equal or similar passwords, as an attacker might try out revealed passwords against the full list of known accounts.”

You can read the full research paper by Fraunhofer SIT here.

[Via PCWorld]