Demo iPhone passwords hack

iPhone passwords hack is real things. A German research firm has demonstrated how passwords stored on an iPhone can be retrieved in less than six minutes without needing to know the passcode. Researchers from German engineering and research firm Fraunhofer tested the hack on an iPhone 4 and iPad 3G running iOS 4.2.1 and found that it was possible to access a range of passwords stored on the device, including: MobileMe, Google Mail as a Microsoft Exchange account, Microsoft Exchange email accounts, VPN logins and Wi-Fi network credentials.

The researchers said that the hack was relatively easy to perform and used freely available tools. However, they did have to jailbreak the device and install an SSH server in order to access the phone and copy the keychain access script that allows access to the stored information.

"After using a jailbreaking tool, to get access to a command shell, we run a small script to access and decrypt the passwords found in the keychain. The decryption is done with help of functions provided by the operating system itself," the researchers wrote in the paper. "An attacker would not need to know the user's passcode nor does he need to exploit new vulnerabilities to reveal these secrets."

Other sensitive information such as credentials saved by the Safari web browser were not revealed in the tests.