![]() iCloud backups, photos, messages, and even passwords are kept on third-party servers owned by Amazon, Microsoft, Google, AT&T and the Chinese government (for users residing in continental China). With this number of restrictions, are authentication tokens still usable? What can you obtain from the user’s iCloud account with an authentication token, and what can be accessed with a login and password? How two-factor authentication affects what’s available in an iCloud account, and why knowing the screen lock passcode (or Mac system password) can help? Keep reading to find out.Īpple does not own the servers (or, rather, services) that store their users’ data. Even today, this workaround is only working if the user had a macOS computer. It took us more than a year to figure out a workaround allowing experts to transfer authentication tokens from the user’s computer. Sometime last year Apple pinned authentication tokens to a particular computer, making them usable just from the very PC or Mac they’ve been created on. ![]() Tokens cannot be used to access passwords ( iCloud Keychain), Screen Time, Health and Messages. Tokens can no longer be used to access iCloud backups, period. During the next years, we learned how to use authentication tokens to access other types of data stored in iCloud including the user’s photo library, browsing history, contacts, calendars and other information that Apple synchronizes across all of the user’s devices that are signed in to the same Apple account. In Breaking Into iCloud: No Password Required we discussed the benefits of this approach. Some five years ago, we learned how to use authentication tokens to access iCloud backups without a password. While the ability to download iCloud backups has been around for years, the need to supply the user’s login and password followed by two-factor authentication was always a roadblock. The upcoming release of iOS 13 brings additional security measures that will undoubtedly make physical access even more difficult. In iOS forensics, cloud extraction is a viable alternative when physical acquisition is not possible.
0 Comments
Leave a Reply. |