There have been a lot of passcode exploits lately. Should you be worried? How much protection does your lock screen actually give you?
This is a common concern these days especially after the leakage of private nude photos of Amanda Seyfried and Emma Watson. While the truth is, this concern isn’t unfounded, and while these exploits don’t give an attacker full access to your phone, other tricks can. Here’s what you need to know about keeping your phone secure.
What These Exploits Actually Do
Let’s start with the iPhone: Both of the recent iOS 6 passcode exploits allowed an attacker to glitch their way only into the Phone app, not the home screen. As such, they could place calls, see/edit your contacts and access your photos via the “assign new picture” option. So while it doesn’t give someone total access to your phone, it’s still enough to be concerned about.
The exploits affecting Samsung Galaxy phones worked a bit differently, flashing the home screen (or whatever was open before the phone locked) for no more than a second. While it doesn’t seem all that nefarious, it’s enough time to launch an app, and persistent attackers could use it repeatedly to download an app that would unlock your phone completely.
Both manufacturers are aware of these problems—Apple recently released iOS 6.1.3 to address its passcode issue, only to have it circumvented yet again. Samsung has also stated its intent to do the same, although at the time that this is being written the only existing fix is a third party one.
A Passcode Doesn’t Completely Protect You
It may seem like your phone’s security has suddenly been compromised with all these passcode exploits, but really, passcodes have never been foolproof. In fact, they’re no more secure than any other password or PIN: they can be cracked, and they really shouldn’t be the only thing protecting your smartphone’s data.
I reached out to security expert Brandon Gregg about the level of security a passcode affords. Here’s what he had to say:
Passcodes do not mean encryption. Only if you specifically go to your Android settings can you encrypt your phone (and SD card) with a separate, strong password. Too many people believe their four digit Android or iOS passcodes protect their private information. First off, anyone can easily brute force your short 10,000 possibility password. Tools like XRY (which I use and was profiled on Gizmodo) can do the crack in milliseconds. Second, a passcode does not protect from direct forensic access by tools like XRY, MPE by Accessdata and the growing list of programs for Law Enforcement. Once inside the phone, all your data is up for grabs. The best thing you can do right now is full encryption. The above tools aren’t designed for brute force at that
Basically, your data is vulnerable on two levels. First, you have a lock screen passcode, which can be cracked, although using a strong alphanumeric password can make brute-forcing your phone take much longer to crack. However, your data is still sitting there on your phone’s hard drive, and an attacker with the proper forensic equipment and enough patience can still get at your data—unless you have full disk encryption.
Android has had full disk encryption since Honeycomb (3.0), albeit with some limitations. iOS also has a Data Protection API that apps can use to encrypt and protect your data, but it’s up to app developers to incorporate it (and it doesn’t work with apps that use iCloud), so it’s a lot less useful. In both cases, however, the encryption key is the same as your passcode lock, and you’d have to use a strong passcode for the encryption to be effective. But who wants to enter in a long, alphanumeric password every time they need their phone? The point is to make it hard for hackers to get into your phone, not you.
Should I Even Bother with a Passcode Lock?
Of course. There’s no reason for you to make things easy for the thief who steals your phone. You could also be very fortunate and end up being robbed by someone who doesn’t know the first thing about getting around lock screens. By all means, enable your passcode, and make sure it’s a good one.
However, understand that your lock screen alone isn’t going to truly protect your data, and encryption is far from perfect. To that end, we recommend setting up a service like Apple’s Find My iPhone, or a third-party applock to lock all the apps that may leak your privacy. They can track your smartphone and wipe its data when you lose it (or it gets stolen). Hopefully, you’ll never need to worry about this sort of thing, but you know what an ounce of prevention is worth.
