US National Security Agency (NSA) gained powers to access American telephone, cable and satellite networks. After September 11th, “warrantless wiretapping” of Internet communications, as well as many other intrusions into personal privacy have become a fact of life. Either way, a corresponding warrant must be issued in order to seize the computer and/or the iOS device in question.Įmploying Apple iCloud for spying on users of iOS devices are not restricted with such pesky obstacles. Acquiring information from an iOS device requires physical access to that device. In order to obtain information from a phone backup, investigators need access to a PC that has those backups. However, there is something making this one different. There are so many ways to retrieve information from mobile devices that yet another backdoor may not seem like a big deal.

Other than the combination of a unique Apple ID and password, nothing protects the data on its way to an intruder except some encryption (which could not be easier to circumvent because the decryption key is available along with the data). Interestingly, unlike offline backups that feature a rather strong protection making ElcomSoft’s own recovery tools spend hours guessing the original password, data stored in the iCloud is stored unprotected. Information from the iCloud can be transferred to any remote computer with an Internet connection. At this time, information about recent iCloud activities is not reported to the owner of the device, so it will be impossible to learn about someone accessing information in the iCloud. The user will never know that their data has been accessed as no access to the physical device is required. The newly discovered backdoor allows anyone having the money to buy Elcomsoft Phone Password Breaker and having a way to discover the original Apple ID and password of the user accessing information from all iOS devices belonging to a user with that particular Apple ID. The company even built the technology for accessing this information in one of its mobile forensic products, Elcomsoft Phone Password Breaker, allowing investigators accessing backup copies of the phone’s content via iCloud services. ElcomSoft researchers discovered that information stored in the iCloud can be retrieved by anyone without having access to a physical device, provided that the original Apple ID and password are known. The service opens governments a back door for spying on iOS users without them even knowing. Using the iCloud is so simple and unobtrusive that more than 190 million customers (as of November, 2012) are using the service on regular basis.

Apple iCloud is a popular service providing Apple users the much needed backup storage space.

Elcomsoft icloud