This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at http://www.theguardian.com/technology/2013/oct/18/imessage-qualcast-security-weakness

The article has changed 2 times. There is an RSS feed of changes available.

Version 0 Version 1
Apple's iMessage security claims 'basically just lies', say researchers Apple's iMessage security claims 'basically just lies', say researchers
(about 3 hours later)
Security researchers say Apple’s messaging service iMessage is not as secure as the company claims and that Apple, the NSA or US government could intercept messages.Security researchers say Apple’s messaging service iMessage is not as secure as the company claims and that Apple, the NSA or US government could intercept messages.
Cyril Cattiaux, a developer for penetration testing company Quarkslab, claimed that Apple’s assertion in June that iMessages are encrypted end-to-end and that not even Apple can decrypt them was “just basically lies” at the Hack in the Box security conference in Kuala Lumpur this week.Cyril Cattiaux, a developer for penetration testing company Quarkslab, claimed that Apple’s assertion in June that iMessages are encrypted end-to-end and that not even Apple can decrypt them was “just basically lies” at the Hack in the Box security conference in Kuala Lumpur this week.
"Apple can read your iMessages if they chose to, or if they are required to do so by a government order," the researchers said. "The weakness is in the [encryption] key infrastructure as it is controlled by Apple: they can change a key anytime they want, thus read the content of our iMessages.""Apple can read your iMessages if they chose to, or if they are required to do so by a government order," the researchers said. "The weakness is in the [encryption] key infrastructure as it is controlled by Apple: they can change a key anytime they want, thus read the content of our iMessages."
The paper (PDF) from Qualcast describes how they were able to add a fake security certificate to an iPhone, which meant they theoretically could grab the owner's Apple ID password The paper (PDF) from Qualcast describes how they were able to add a fake security certificate to an iPhone, which meant they theoretically could grab the owner's Apple ID password 
Apple’s iMessage system, introduced in 2011, has around 300m users and replaces text, photo and video messaging over SMS, allowing users of its iPhone, iPad, iPod touch and Mac computer users to communicate over data paths rather than SMS or MMS paths. According to some reports - quoted by Quarkslab - Edward Snowden used iMessage to evade NSA surveillance.Apple’s iMessage system, introduced in 2011, has around 300m users and replaces text, photo and video messaging over SMS, allowing users of its iPhone, iPad, iPod touch and Mac computer users to communicate over data paths rather than SMS or MMS paths. According to some reports - quoted by Quarkslab - Edward Snowden used iMessage to evade NSA surveillance.
Impossible to know if messages are being sent to the NSAImpossible to know if messages are being sent to the NSA
iMessage uses public-private key encryption systems. That means that a public key for a user is stored on Apple's server, and a private key on each device linked to their account. The private-public key pair is generated when the user creates an iCloud account with Apple.iMessage uses public-private key encryption systems. That means that a public key for a user is stored on Apple's server, and a private key on each device linked to their account. The private-public key pair is generated when the user creates an iCloud account with Apple.
When someone chooses an addressee for an iMessage, the recipient's public key - which works like a padlock - is retrieved from Apple's servers and used to encrypt the message. That can in theory only be unlocked by the private key held by the recipient. Messages sent to multiple recipients are encrypted using those recipients' public keys. When someone chooses an addressee for an iMessage, the recipient's public key - which works like a padlock - is retrieved from Apple's servers and used to encrypt the message. That can in theory only be unlocked by the private key held by the recipient. Messages sent to multiple recipients are encrypted using those recipients' public keys. 
But Quarkslab says that Apple’s management of the initial security key is obfuscated – and so it is impossible for the user to know if messages are being sent to a third party such as the NSA.But Quarkslab says that Apple’s management of the initial security key is obfuscated – and so it is impossible for the user to know if messages are being sent to a third party such as the NSA.
“The biggest problem here is you just cannot control that the public key you are using when you are ciphering the message is really the key of your recipient and not, for example, the public key of some guy in Apple,” Cattiaux said speaking to MacWorld.“The biggest problem here is you just cannot control that the public key you are using when you are ciphering the message is really the key of your recipient and not, for example, the public key of some guy in Apple,” Cattiaux said speaking to MacWorld.
‘No one but the sender and receiver can see or read them’‘No one but the sender and receiver can see or read them’
After the Guardian's revelations about the NSA's Prism program in June, Apple originally claimed that conversations that take place over iMessage and FaceTime "are protected by end-to-end encryption, so no one but the sender and receiver can see or read them. Apple cannot decrypt that data. Similarly, we do not store data related to customers' location, map searches or Siri requests in any identifiable form."After the Guardian's revelations about the NSA's Prism program in June, Apple originally claimed that conversations that take place over iMessage and FaceTime "are protected by end-to-end encryption, so no one but the sender and receiver can see or read them. Apple cannot decrypt that data. Similarly, we do not store data related to customers' location, map searches or Siri requests in any identifiable form."
But Rik Ferguson, vice-president of independent security company Trend Micro, told the Guardian: "The research demonstrated that Apple could decrypt the data, proving the categorical statement that 'Apple cannot decrypt that data' untrue."But Rik Ferguson, vice-president of independent security company Trend Micro, told the Guardian: "The research demonstrated that Apple could decrypt the data, proving the categorical statement that 'Apple cannot decrypt that data' untrue."
Quarkslab's researchers point out that they cannot tell if Apple or anyone else is intercepting iMessages, but it is possible for someone inside Apple, or someone with access to keys from the public encryption key server, to decrypt messages. Apple might be required to hand over those keys if it was subject to an order from a US government court.Quarkslab's researchers point out that they cannot tell if Apple or anyone else is intercepting iMessages, but it is possible for someone inside Apple, or someone with access to keys from the public encryption key server, to decrypt messages. Apple might be required to hand over those keys if it was subject to an order from a US government court.
End-to-end encryption is a very good thingEnd-to-end encryption is a very good thing
"The fact that Apple offers end-to-end encryption for communication services is a very good thing," said Ferguson."The fact that Apple offers end-to-end encryption for communication services is a very good thing," said Ferguson.
Other popular messaging services such as WhatsApp and Line messenger are equally vulnerable to interception, but most lack any sort of encryption; they are sent as plain text, like the majority of email services.Other popular messaging services such as WhatsApp and Line messenger are equally vulnerable to interception, but most lack any sort of encryption; they are sent as plain text, like the majority of email services.
Ferguson said he preferred Apple's approach: "Somebody has to control the keys, and who would you rather trust with that control? It's Apple's service and Apple's encryption so that means whoever holds the keys will be able unlock the locks. Apple, like any other organisation, has to comply with legal requests, and so there's always a residual risk using an encryption service provided by someone else."Ferguson said he preferred Apple's approach: "Somebody has to control the keys, and who would you rather trust with that control? It's Apple's service and Apple's encryption so that means whoever holds the keys will be able unlock the locks. Apple, like any other organisation, has to comply with legal requests, and so there's always a residual risk using an encryption service provided by someone else."
Secure messaging applications which employ encryption methods, such as PGP, can ensure that the security keys used are only held by the sender and the recipient, although most are not consumer-friendly service-based like iMessages or Google Hangouts.Secure messaging applications which employ encryption methods, such as PGP, can ensure that the security keys used are only held by the sender and the recipient, although most are not consumer-friendly service-based like iMessages or Google Hangouts.
 “We do not provide any government agency with direct access to our servers, and any government agency requesting customer content must get a court order,” said Apple in a statement. “We do not provide any government agency with direct access to our servers, and any government agency requesting customer content must get a court order,” said Apple in a statement.
Update
Apple has clarified its position on iMessage encryption, explaining to AllthingsD that it cannot read encrypted messages sent across the service:
“iMessage is not architected to allow Apple to read messages. The research discussed theoretical vulnerabilities that would require Apple to re-engineer the iMessage system to exploit it, and Apple has no plans or intentions to do so.”
 • Apple's new iPad and iPad mini are expected at an Apple event on 22 October. • Apple's new iPad and iPad mini are expected at an Apple event on 22 October.
Our editors' picks for the day's top news and commentary delivered to your inbox each morning.Our editors' picks for the day's top news and commentary delivered to your inbox each morning.