I have a quick question:
I downloaded an iOS application that uses the NSFileProtectionComplete class to protect a sqlite file that contains sensitive information.
According to the iOS security documentation (http://images.apple.com/ipad/business/docs/iOS_Security_May12.pdf), when a device (iPhone/iPad) is paired with the laptop, the laptop obtains the escrow keybag from the mobile device . The keybag contains all the class keys necessary to decrypt information on the device.
However, I noticed that when I pair the device with the laptop and use iExplorer to browse the file system, the sqlite file is only available when the device is unlocked. When the phone is locked (still paired) the file is not readable. Files which are not using NSFileProtectionComplete can be viewed while the device is locked.
If the escrow keybag contains all the class keys to decrypt information, why do I have to unlock the device to access it through iExplorer?
I'm using iOS 6.0 on an iPad3 and used the ios-dataprotection tool (https://github.com/ciso/ios-dataprotection) to determine the data protection class used by the files.
iOS Application: AccountVault
File: PointMinder.sqlite
Any help will be appreciated.
Thanks.
From documentation file you've linked:
Complete Protection (NSFileProtectionComplete): The class key is
protected with a key derived from the user passcode and the device
UID. Shortly after the user locks a device (10 seconds, if the Require
Password setting is Immediately), the decrypted class key is
discarded, rendering all data in this class inaccessible until the
user enters the passcode again.
So device should be unlocked if you want to access that files. That is how Apple made it.
Edit: Found in "Hacking and Securing iOS Applications":
Protection class keys are master encryption keys used to unlock files based on their access policy.
Protection classes are the encryption mechanism used to enforce the access policies of files.
Some files are so important that the operating system should be able to decrypt them only when the device’s user interface is unlocked. These files’ encryption keys are wrapped with a class key that is available only after the user has entered his passcode. When the device locks again, the key is wiped from memory, making the files unavailable again.
Protection class master keys are stored in an escrow known as a keybag. The keybag contains the encrypted protection class master keys, as well as other keys to system files on the device. The system keybag is encrypted using another encryption key named BAGI, which is also stored in the effaceable storage of the NAND. Whenever the user authenticates to meet a specific security protection policy, the encrypted keys in the keybag can be decrypted.
So keys for that files are transferred, but are encrypted. When you enter your passcode, OS decrypt that key and it can then be used to decrypt files protected with it.
This works for me for SQLite databases in my app only, not for my other resources as I was hoping. BUT, I was having the same issues still being able to access the databases after locking the device and waiting several minutes with iExplore still open and device still connected. If I disconnect the iPad and connect right back in, iExplore forced to refresh I guess and I then could NOT access the databases. So not sure if it just has the old 'unencrypted' database info in memory or what.
Related
On iOS, if a file is stored using .completeFileProtection it is encrypted by the OS and only accessible when the device is unlocked according to the documentation.
In another app I looked at, the developers had encrypted all files manually and then stored the symmetric key in the device keychain.
I'm wondering if there really is any security benefit from doing that rather than using the built in .completeFileProtection? Or would it ever make sense to do both?
To my understanding, with an additional encryption, files will remain encrypted even when device is unlocked.
Also, file will be decrypted only when app needs to read it. With this approach, the app could decrypt and read files even in background mode — if we don't change the level of data protection, since default is NSFileProtectionCompleteUntilFirstUserAuthentication.
I need to protect a file with user data, however I can't really verify if built-in iOS mechanism works. I implemented data protection in my app by:
Enabling Data Protection in AppId
Updating provisioning profiles
Adding Data Protection to entitlements.plist (entry: com.apple.developer.default-data-protection = NSFileProtectionComplete)
Setting attribute FileProtectionComplete on my file
Turning on passcode on iPhone
I was able to confirm, that this attribute is set properly. However, I tried to lock device, wait about 1 minute and access file through iExplorer or by downloading app container from Xcode->Devices and every time I'm able to get non-encrypted content.
I wonder if it's a matter of debug build or not. Is there any way to download encrypted file to confirm that data protection really works (without jailbreaking)?
My application captures location data in background and saves in sqlite database. It works well when Device is not locked, but when device is locked I am not able to access sqlite database. It always gives me error code as SQLITE_AUTH(error code:23).
I have tried below options:
Disable the Data Protection from Capabilities.(Does not work)
As per Failed to create SQLite3 database with file protection in iOS, I tried the below code :
sqlite3_open_v2([dbPath UTF8String], &myDatabase, SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE|SQLITE_OPEN_FILEPROTECTION_COMPLETE, NULL)
But still its not working.
Could you please help me, How to access the sqlite database in background.
You need to enable Data Protection from your app from iTunesconnect.
1. Enable data protection for your app. For example,
2. Add below file protection key and value into your plist or entitlement file,
<key>com.apple.developer.default-data-protection</key>
<string> NSFileProtectionCompleteUntilFirstUserAuthentication</string>
The type must match to your capability set from itunes server.
3. Rebuild and test if the issue is resolved
File Data Protection
In addition to the hardware encryption features built into iOS devices, Apple
uses a technology called Data Protection to further protect data stored in flash
memory on the device. Data Protection allows the device to respond to common
events such as incoming phone calls, but also enables a high level of encryption
for user data. Key system apps, such as Messages, Mail, Calendar, Contacts,
Photos, and Health data values use Data Protection by default, and third-party
apps installed on iOS 7 or later receive this protection automatically.
Data Protection is implemented by constructing and managing a hierarchy
of keys, and builds on the hardware encryption technologies built into each
iOS device. Data Protection is controlled on a per-file basis by assigning each
file to a class; accessibility is determined by whether the class keys have been
unlocked. With the advent of the Apple File System (APFS), the file system is
now able to further sub-divide the keys into a per-extent basis (portions of a
file can have different keys). Find detail here in section File Data Protection.
As we know OS X needs master password to unlock keychain and decrypt all data that is stored there. In general master password is stored in user's brains so there no any direct IT ways to compromise this password.
At the same time iOS makes some simplifications and it doesn't require master password that known only by user. So I became interested how is logic for iOS keychain unlocking and data decrypting implemented and found such explanation in Apple docs:
In iOS, an application always has access to its own keychain items and
does not have access to any other application’s items. The system
generates its own password for the keychain, and stores the key on the
device in such a way that it is not accessible to any application.
As I understand iOS generates master password by itself and stores it in some specific place.
My question is: does anybody know or have any ideas what is it place or way that used for storing master password that guarantees preventing from any IT attacks or third party accesses?
(I found some similar questions like this, but there are no any specific information.)
You can find a lot of information in the Apple iOS Security Whitepaper
Essentially the passcode is "tangled" with a device specific ID that is not available to executing code in order to generate keys. The keys used to unlock files and the keychain are kept in memory while the phone is unlocked (or after first unlock for some protection classes) but are discarded on lock or reboot (again depending on the protection classes) but the passcode itself is never stored in memory or a code accessible file system.
I have read that
In iOS 4 and later, apps can use the data protection feature to add a
level of security to their on-disk data. Data protection uses the
built-in encryption hardware present on specific devices (such as the
iPhone 3GS and iPhone 4) to store files in an encrypted format on
disk. While the user’s device is locked, protected files are
inaccessible even to the app that created them. The user must
explicitly unlock the device (by entering the appropriate passcode) at
least once before your app can access one of its protected files.
My question is that can I use it for app level protection? That is even if user didn't set a passcode for his device, all data related to my application must be encrypted using above method while application enters in background. Is it possible? Let us put it i this way "When ever my app goes in background all the secrete data in my app must be hardware encrypted and when the app resumes back, it must prompt me to enter my password"
I have been searching for a solution for more than two days....Any help is greatly appreciated...
No you cannot. The convenient automatic file encryption mechanism only works with the passcode.
From the iOS App Programming Guide:
Data protection is available on most iOS devices and is subject to the
following requirements: [...] The user must have an active passcode
lock set for the device.
To implement an automatic encryption mechanism independent of the passcode, you need to build it on your own, e.g. using the general purpose encryption APIs.