Reference Library – Scotland
After rapidly patching a flaw1 that allowed anyone with access to a High Sierra Mac to obtain administrative control, Apple still has more work to do to make its software secure, namely iOS 11, it was claimed this week. Oleg Afonin, a security researcher for password-cracking forensic IT biz Elcomsoft, in a blog post2 on Wednesday called iOS 11 “a horror story” due to changes the fruit-themed firm made to its mobile operating system that stripped away a stack of layered defenses. What’s left, he argued, is a single point of failure: the iOS device passcode.
With an iOS device and its passcode a barrier but not a particularly strong one an attacker can gain access not only to the device, but to a variety of linked cloud services and any other hardware associated with the device owner’s Apple ID. Before the release of iOS 11, Alfonin explained in a phone interview with The Register, there were several layers of protection in iOS.
“I feel they were pretty adequate for what they were,” he said. “It seems like Apple abandoned all the layers except the passcode . Now the entire protection scheme depends on that one thing.”
What changed was the iOS device backup password in iTunes . In iOS 10 and earlier, users could set a unique password to secure an encrypted backup copy of the data on an iPhone . That password travelled with the hardware and if you attempted to connect the iPhone to a different computer in order to make another backup via iTunes, you’d have to supply the same backup password.
That’s a security problem because device backups made through iTunes contain far more data than would be available just through an unlocked iPhone . And that data can be had through the sort of forensic tools Elcomsoft and other companies sell.
“Once an intruder gains access to the user s iPhone and knows (or recovers) the passcode, there is no single extra layer of protection left,” Alfonin explains in his post. “Everything (and I mean, everything) is now completely exposed . Local backups, the keychain, iCloud lock, Apple account password, cloud backups and photos, passwords from the iCloud Keychain, call logs, location data, browsing history, browser tabs and even the user s original Apple ID password are quickly exposed.”
So the risk goes beyond the compromised phone and any associated Apple devices: Apple’s iCloud Keychain could include, say, Google or Microsoft passwords. Alfonin in his post suggested “Apple gave up” in the wake of complaints from police, the FBI, and users . Asked whether he had any reason to believe the change was made to appease authorities, he said, “I don’t believe this was made for the police . I believe it was just user complaints.”
Nonetheless, the iOS change has significant implications for those who deal with authorities, at border crossings for example.
“If I cross the border, I may be forced to reveal my passcode,” he said, noting that many thousands of electronic device searches happen every year.
With that passcode, authorities could create their own device backup and store it, which would allow them to go back and extract passwords unrelated to the device itself later on. “If that happens they have access to everything, every password I have,” he said. Alfonin said with iOS 11, Apple’s entire protection scheme has fallen apart . He likened the situation to the 2014 iCloud hack known as Celebgate4.
“Those iCloud accounts were protected with just passwords,” said Alfonin. “We have a similar situation today . If it’s just one single thing, then it’s not adequate protection.”
To fix the issue, Alfonin suggests going back to the way things were. “It was a perfectly balanced system,” he said. “I don’t think anybody complained seriously . The ability to reset an iTunes Backup password is not necessary .
If they revert it back to the way it was in iOS 10, that would be perfect.”
Of course, this is just Alfonin and Elcomsoft’s opinion . Others in the world of infosec were not convinced by his arguments for example, Dino Dai Zovi, cofounder of cloud security biz Capsulate8, was having none of it:
Apple did not respond to a request for comment.
PS: Apple’s iPhone X shares face scans with apps, which has some people worried5 . Also, if you have installed the password-less root security patch on macOS 10.13.0, and then upgraded to 10.13.1, make sure you reinstall the patch Apple’s Software Update mechanism should do this automatically and reboot .
On Tuesday 28 November, security operatives from around Glasgow attended Counter Terrorism Project Griffin Training at Cathouse, a music venue in Glasgow. The session in Glasgow was the first in a series of Project Griffin training sessions specifically targeting security operatives. A Police Scotland Counter Terrorism Security Adviser delivered the training and the event was supported by the National Licensed Trade Partnership (NLTP) whose Chair Donald McLeod provided the venue. This training will roll out in the major cities across Scotland in the coming months on behalf of the Security Industry Safer Scotland – Counter Terrorism (SISS-CT) in partnerships with the Security Industry Authority (SIA) and Police Scotland.
Sharon Roberts, our Regional Manager for Scotland, said
Security operatives across Scotland play a critical role in protecting the public. Providing funded Project Griffin training to the Private Security Industry increases Scotland’s preparedness in the event of a terrorist attack. The fact that so many security officers and door supervisors have attended the training in their own time is testament to the dedication and professionalism of the security industry and reflects the determination of people in Scotland not to give in to terrorism.
Brian Muir, Chair of SSIS-CT, said:
The Security Industry Safer Scotland – Counter Terrorism (SISS-CT) Group welcomes this important initiative. This Project Griffin training is a vital tool in providing people with the knowledge and skills to recognise the threats posed by terrorism and to understand the actions they can take to prevent it and make places and communities safer. The SISS-CT s activities are not restricted to SIA licensed personnel and apply to the wider security industry. The Group consists of representatives from Police Scotland, the Scottish Business Resilience Centre, the SIA, security providers in Scotland and various other related agencies.
Donald MacLeod, Chairman of the NLTP said,
“The National Licensing Trade Partnership is very happy to lend its support to the SIA and Project Griffin. After the recent terrorist atrocities in Paris, Manchester and London, It is now vital that all who are involved in the licence trade recognise the benefits of Counter Terrorism training, which sadly is now as important as it is necessary. The safety of the general public and staff must always come first and never more so in these dangerous times.
The aim of the NLTP is to develop and promote positive working relationships between Police Scotland, the SIA and the license trade as well as support a shared aim of best practice, responsible operation and mutual respect for each other, and Project Griffin Counter Terrorism Training ticks all these boxes and more.”
Steve Johnson, Police Scotland Assistant Chief Constable (Crime) said,
This event is an ideal opportunity to develop existing relationships in Scotland between Police Scotland and the private security industry and ther key partners. Police Scotland are delighted to support the innovative work being carried out by the Security Industry Safer Scotland (CT) Group at this time of increased risk nationally. The event reaffirms the benefits of collaborative working; ensuring organisations work together for a common goal, rather than in isolation, to make Scotland safer for all of our communities.
- The Security Industry Authority is the organisation responsible for regulating the private security industry in the United Kingdom, reporting to the Home Secretary under the terms of the Private Security Industry Act 2001.
The SIA’s main duties are: the compulsory licensing of individuals undertaking designated activities; and managing the voluntary Approved Contractor Scheme.
- For further information about the Security Industry Authority or to sign up for email updates visit www.sia.homeoffice.gov.uk.
1/55 25 November 2017
Arlene Foster gives her leader’s speech during the annual DUP party conference at La Mon House
2/55 24 November 2017
Ex-England footballer Michael Owen prior to riding in a charity race at Ascot racecourse
3/55 23 November 2017
Shoppers pass a promotional sign for ‘Black Friday’ sales discounts on Oxford Street
4/55 22 November 2017
Britain’s Chancellor of the Exchequer Phillip Hammond poses with the budget box at 11 Downing Street
5/55 21 November 2017
Protestors hold up a banner during a protest held in solidarity with the University of London cleaners’ strike
6/55 20 November 2017
British Prime Minister Theresa May greets Ghana’s President Nana Akufo-Addo outside number 10 Downing Street
7/55 19 November 2017
Grigor Dimitrov reacts to winning the Men’s Singles Final with the trophy, during day eight of the NITTO ATP World Tour Finals at the O2 Arena in London
8/55 18 November 2017
Central Scotland MSP Richard Leonard is congratulated by Glasgow MSP Anas Sarwar at the Glasgow Science Centre after he was announced as the new leader of Scottish Labour
9/55 17 November 2017
British Military Working Dog Mali poses for a photograph with his handler, Cpl . Daniel Hatley, after receiving the PDSA Dickin Medal, the animal equivalent of the Victoria Cross, for his heroic action in Afghanistan
10/55 16 November 2017
Theresa May chats with resident Val Lay during a visit to a housing estate in London
11/55 15 November 2017
Richard Radcliffe leaves the Foreign Office with his local MP Tulip Siddiq, following a meeting with Foreign Secretary Boris Johnson
12/55 14 November 2017
Four-time Olympic champion Sir Mo Farah after being awarded a Knighthood by Queen Elizabeth II
13/55 13 November 2017
Restoration work continues on the Palace of Westminster
Photographs by Reuters/Getty/iStock
14/55 12 November 2017
A veteran takes his hat off during the Remembrance Sunday Cenotaph wreathe laying ceremony
15/55 11 November 2017
Members of the Western Front Association during a service at the Cenotaph to mark the Armistice Day
16/55 10 November 2017
David Davis and Michel Barnier
17/55 9 November 2017
Britain’s newly appointed Secretary of State for International Development, Penny Mordaunt, leaves Downing Street
18/55 8 November 2017
Priti Patel leaves number 10 Downing street through the back entrance
19/55 7 November 2017
School children and their teacher from Thomas Tallis School look at pictures on display at the Red Star Over Russia exhibition at the Tate Modern in London
20/55 6 November 2017
A cast of The Wrestlers, two men taking part in the Greek sport pankration, is lowered into place at Natural Trust’s Stowe Landscape Garden near Buckingham
21/55 5 November 2017
Protesters in Trafalgar Square, London, during the Million Mask March bonfire night protest
22/55 4 November 2017
Protestors take part in the ‘Justice Now: Make it Right for Palestine’ march, organised by the Palestine Solidarity Campaign, in central London
23/55 3 November 2017
People queue outside an Apple store in London to purchase the new iPhone X upon its release in the U.K . The iPhone X is positioned as a high-end, model intended to showcase advanced technologies such as wireless charging, OLED display, dual cameras and a face recognition unlock system
24/55 2 November 2017
British Prime Minister Theresa May greets Israeli Prime Minister Benjamin Netanyahu outside 10 Downing Street in London . The pair are today celebrating the centenary of a British declaration that ultimately led to the foundation of the state of Israel
25/55 1 November 2017
Mammatus clouds over St Mary’s Lighthouse in Whitley Bay, Northumberland
26/55 31 October 2017
Women protest outside Downing Street as they join a demonstration demanding rights for working mothers
27/55 30 October 2017
England’s under 17’s pose with the World Cup trophy as they arrive back to the UK
28/55 29 October 2017
Leicester City remembrance day fixture between between Leicester City and Everton at King Power Stadium
Plumb Images/Leicester City FC via Getty Images
29/55 27 October 2017
Spiderman steals a seat on the Iron Throne from Game of Thrones at MCM London Comic Con’s opening day
30/55 26 October 2017
British fashion designer Vivienne Westwood holds up a paper against the governments policy on fracking outside Downing Street in London
31/55 24 October 2017
Members of a delegation of indigenous and rural community leaders from 14 countries in Latin America and Indonesia, The Guardians of the Forest campaign, demonstrate against deforestation in London during a stop on their way to the United Nations Framework Convention on Climate Change (UNFCCC) Conference of the Parties 23 (COP 23) in Bonn, Germany
32/55 23 October 2017
Gemma Davis, 23, cleans the dolls’ house during it’s annual clean at the National Trust’s Calke Abbey property, in Ticknall, Derbyshire . The dolls’ house was used by the family’s various generations of children between 1860 and the Second World War in their school room
33/55 18 October 2017
Prince William and Kate chat with West Ham player Mark Noble and manager Slaven Bilic during the Coach Core graduation ceremony
34/55 17 October 2017
Jellyfish washed up on Sidmouth beach after storm Ophelia hit the UK
35/55 16 October 2017
A red sun appears in Mid-Wales before storm Ophelia hits
Paul Williams / Alamy Live News
36/55 15 October 2017
The Duchess of Cambridge dances with Paddington Bear as they attend a charities forum event at Paddington train station in London on October 16, 2017 . The Duke and Duchess of Cambridge and Prince Harry joined children from the charities they support on board Belmond British Pullman train at Paddington Station . The event was hosted by STUDIOCANAL, with support from BAFTA through its BAFTA Kids programme, and before embarking Their Royal Highnesses met the cast and crew from the forthcoming film Paddington 2
37/55 15 October 2017
Large waves crash along sea defences and the harbour as storm Ophelia approaches Porthleven in Cornwall, south west Britain
38/55 14 October 2017
Hillary Clinton gives a speech as she is presented with a Honorary Doctorate of Law at Swansea University in Swansea, Wales . The former US secretary of state and 2016 American presidential candidate is also visiting the UK to promote her new book, ‘What Happened’
39/55 13 October 2017
A lone protestor demonstrates outside Workmen Cuadrilla’s shale gas fracking drilling rig near Westby in Blackpool . Engineers have begun to build the new rig at the site off Preston New Road in preparation for extracting gas .
The site will be the first in the UK to extract shale gas since 2011
40/55 11 October 2017
Photographs of missing Syrians are displayed as people, including a group of Syrian women, stand atop a double-decker bus during a demonstration by ‘Families for Freedom’ in Parliament Square in London
41/55 9 October 2017
Workmen erect scaffolding around the Elizabeth Tower, commonly known called Big Ben, during ongoing renovations to the Tower and the Houses of Parliament
42/55 6 October 2017
An order of service is carried ahead of the funeral service for Coronation Street actress Liz Dawn, real name Sylvia Ann Ibbetson, outside Salford Cathedral . A former Woolworths shop girl from Leeds, who first set foot on Weatherfield’s famous cobbles in 1974, Dawn, who had four children, died peacefully last week at home with her family around her. PA
43/55 5 October 2017
Melanie Kramers of Oxfam poses while wearing a mask of Foreign Secretary Boris Johnson, with assorted props used in political campaigns, in the store room at Oxfam’s headquarters in London . The props have all been used in the charity’s campaigns over the years to raise awareness of issues affecting people in poverty . Today marks 75 years since Oxfam’s founding in the middle of the Second World War
44/55 4 October 2017
A visitor poses in front of an art work by Czech Repblic artist Anna Hulacova entitled ‘Ascension Mark I’ during a photocall for the Frieze Art Fair in London
45/55 2 October 2017
Britain’s Chancellor of the Exchequer Philip Hammond arrives to speak at the Conservative Party’s conference in Manchester
46/55 1 October 2017
Protesters holding flags and placards demonstrate along Oxford Street during the annual Ashura march in London . Thousands of protesters march through London today to mark Ashura and celebrate the defeat of the Islamic State in Iraq and Syria . Ashura is a Muslim festival of remembrance that falls on the tenth day of Muharram in the Islamic calendar
47/55 30 September 2017
Protesters hold up placards during the London March for Choice, calling for the legalising of abortion in Ireland after the referendum announcement, outside the Embassy of Ireland in central London
Chris J Ratcliffe/AFP
48/55 29 September 2017
Former UKIP leader Paul Nuttall (C) speaks with delegates at the UKIP annual conference being held at the The Riviera International Centre in Torquay
49/55 27 September 2017
England and West Indies fans enjoy themselves during the 4th Royal London One Day International between England and West Indies at The Kia Oval in London
50/55 26 September 2017
Labour Leader Jeremy Corbyn takes photographs during Shadow Secretary of State for Business, Energy and Industrial Strategy Rebecca Long-Bailey’s speech in the main hall, on day three of the annual Labour Party Conference in Brighton
Dan Kitwood/Getty Images
51/55 24 September 2017
Naked bathers enter the water as they take part in the North East Skinny Dip at Druridge bay in Druridge, England .
The popular annual event takes place around the autumn equinox at Druridge Bay as the sun rises . Participant registration fees have been pledged to the mental health charity MIND. Getty
52/55 23 September 2017
Rollo Maughfling, Archdruid of Stonehenge and Britain (R) conducts a ceremony as druids, pagans and revellers gather in the centre at Stonehenge, hoping to see the sun rise, as they take part in a autumn equinox celebrations at the ancient neolithic monument of Stonehenge near Amesbury in Wiltshire, England . Several hundred people gathered at sunrise ar the famous historic stone circle, a UNESCO listed ancient monument, to celebrate the equinox which is a specific moment in time that occurs twice a year when the Earth tilts neither towards (summer) or away (winter) from the sun in either the northern or southern hemisphere . Although yesterday marked the actual meteorological calendar change from summer to autumn, for druids, the following dawn is when they celebrate ‘the dawning of the new season’ following the day of equal night, which it is named after.
53/55 22 September 2017
Britain’s Prime Minister Theresa May delivers her Brexit speech at the Complesso Santa Maria Novella in Florence, Italy . British Prime Minister Theresa May will seek to unlock Brexit talks on September 22, after Brussels demanded more clarity on the crunch issues of budget payments and EU citizens’ rights
54/55 21 September 2017
People protest against the actions of the Spanish government in front of the Spanish consulate in Edinburgh . Spanish police stormed ministries and buildings belonging to Catalonia’s regional government yesterday, in an attempt to try and put a stop to the region’s independence referendum
55/55 20 September 2017
One of the final 55m turbine blades is manoeuvred into position .
The last of 116 wind turbines have been installed at the Rampion Offshore Wind Farm 13 kms off the Brighton Coast .
It will provide enough electricity to supply the equivalent of half the homes in Sussex
Mike Hewitt/Getty Images