Apple patches encryption flaw in iOS and OS X

iTnews (AUS) ^ | Mar 22 2016 6:45AM (AUS) | Juha Saarinen

[Utilizer]

Apple has quickly released a patch for a flaw in its encryption capability for the iOS mobile and OS X desktop operating systems which could allow attackers to unscramble protected iMessage photos and videos.

First reported by the Washington Post, a group of researchers led by cryptographer Matthew Green at John Hopkins University discovered they could intercept iMessage content stored in Apple's iCloud by brute-force guessing the encryption key.

With the encryption key at hand, attackers could retrieve files from iCloud accounts without users knowing. Attackers would need to be able to bypass Apple’s TLS certificate pinning, which associates the iCloud server with expected digital credentials, to take advantage of the vulnerability, the company said.

[Utilizer]

Security is having a problem, it appears...

[zeugma]

Implementing crypto is harder than it looks. Folks like Matt Green are serious adversaries. It’s good that Apple was able to patch.

[minnesota_bound]

Let’s says there was an attack in Brussels, scores dead and wounded, an iPhone left behind by the terrorists. It is encrypted. Will Apple help decent people or side again with the terrorists right to privacy?