Subject: Re: [TLS] HTTPS client-certificate-authentication in browsers

From: Martin Rex <[email-masked]>
Date: Wed, 7 Sep 2011 17:42:05 +0200 (MEST)

Sorry for the hardly-usable URL back then ($$-download of the
computer magazine article).  I didn't have the magazine with
me when I wrote that EMail.

The magazine article "iOpener" is a exploration of how easy it is
to access data on an Apple iPhone or iPad1, once you get your hands
on it, with publicly available information and tools.

It is based on this research and tools:

  Jean-Baptiste Bédrune, Jean Sigwald: iPhone data protection in depth

  http://conference.hackinthebox.org/hitbsecconf2011ams/materials/D2T2%20-%20Jean-Baptiste%20Be%cc%81drune%20&%20Jean%20Sigwald%20-%20iPhone%20Data%20Protection%20in%20Depth.pdf

that was presented on the hack-in-the-box 2011 conference

  Tools:
  http://code.google.com/p/iphone-dataprotection/
  http://code.google.com/p/networkpx/downloads/list

-Martin

Martin Rex wrote:
> 
> > 
> > This attitude was OK before we entered the "Google- and Apple-age".
> > It's an entirely different ball-game now!
> 
> Smart phones are already attractive targets for theft even with no
> additional digital gems added by the end user.  Significantly
> further increasing the attractiveness of that target for both,
> digital theft through malware and physical theft of the smartphone,
> does not seem overly sensible to me.
> 
> From what I read in the german computer magazine,
>   http://www.heise.de/artikel-archiv/ct/2011/15/154_kiosk
> 
> all existing iPhones and iPad1s seem to have the vulnerability
> in the Boot-Rom (i.e. Hardware, no possibility to fix by software update)
> that might enable thieves to bypass many if not all of the assumed
> "protections" and retrieve your private data.
> 
> 
> -Martin
>