In the first part of this article, we discussed the techniques to read iTunes backups. The following article discloses the procedure to extract protection class keys from the Backup Keybag and covers the techniques & the tools to decrypt the protected backup files and the encrypted backups. Data protection mechanism introduced in iOS 4 protects the sensitive data in files on the file system and items in the keychain by adding another layer of encryption. Data protection uses the user’s passcode key and the device specific hardware encryption keys to generate a set of class keys which protect the designated data. Developers use the data protection API to add protection class flag to the files and the keychain items. On the iPhone, protection class keys are stored in the System Keybag. During the backup, iTunes generates a new set of protection class keys and stores them in the Backup Keybag. Class keys stored in the System Keybag are different from the keys in the Backup Keybag. Protected files and data in the backup are encrypted using the class keys that are stored in the Backup Keybag. In normal backups Backup Keybag is protected with a key generated from the iPhone hardware (Key 0x835) and in encrypted backups it is protected with the iTunes password. Data protection for files can be enabled by setting a value for the NSFileProtection attribute using the NSFileManager class setAttributes:ofItemAtPath:error method. List of protection classes available for the files are shown in Table 1. (Table 1) Data protection for keychain items can be enabled by setting a protection class value inSecItemAdd or SecItemUpdate methods. Keychain class keys also define whether a keychain item can be migrated to other device or not. List of protection classes available for the keychain items are shown in Table 2. (Table 2) Jean Sigwald, a researcher at Sogeti ESEC labs has released open source forensic tool kit that can be used to decrypt the protected backup files from normal backups and encrypted backups. Below details outline their research and gives an overview on usage of the tools.

Setup:

On Mac OS X, download & install the required python modules (pycrypto, M2crypto, construct and progressbar). [code] > sudo ARCHFLAGS=’-arch i386 -arch x86_64′ easy_install pycrypto > sudo easy_install M2crypto construct progressbar [/code] Download and install Mercurial (http://mercurial.selenic.com/) to check out the source code from the iphone-dataprotection Google code repository.

Decrypting Normal backups:

In case of normal backups, the data protection class keys stored in the Backup Keybag are protected by a hardware generated key (Key 0x835). In order to grab the protection class keys from the Backup Keybag Key 0x835 is required and the key is computed only on the device. So decryption of protected files in the normal backup is not possible without having access to the actual device. In forensic investigations the information recovered from the normal backups is less if physical access to the device is not available. Steps below explain the procedure to decrypt the protected files stored in the normal backup in case physical access to device is obtained. On the iPhone, Key 0x835 is computed by the IOAESAccelerator kernel service at iOS boot by encrypting a static value 01010101010101010101010101010101 with UID. UID is a hardware encryption key embedded in the iPhone application processor AES engine and it is unique for each device. iOS running on the iPhone cannot read the hardware key (UID) but it uses the key to compute Key 0x835 in kernel mode. UID is not accessible to user land process. This restriction can be bypassed by patching the IOAESAccelerator kernel service.

  1. Jailbreak your iPhone. If you don’t like to Jailbreak the phone, follow the steps explained in the iPhone Forensics article. 2. On the iPhone, install OpenSSH from Cydia. OpenSSH allows connecting to the device over SSH. 3. On Mac OS X workstation, download device_infos, kernel_patcher and Cyberduck tools. 4. Connect the iPhone and workstation to the same Wi-Fi network. 5. On OS X run Cyberduck and connect to the iPhone by typing iPhone IP address, root as username and alpine as password. 6. Copy device_infos and kernel_patcher executables to the iPhone root directory. 7. Run Mac terminal and SSH to the iPhone by typing iPhone IP, root as username and alpine as password. [code] > ssh root@iPhone-IP Password: alpine [/code]
  2. On SSH terminal, run the below commands to change the execution permissions of kernel_patcher and device_infos. [code] > chmod 777 kernel_patcher > chmod 777 device_infos [/code]
  3. Patch IOAESAccelerator kernel service to use the hardware encryption key (UID) from user land process. Kernel_patcher script modifies the kernel and applies the required patches to IOAESAccelerator. [code] > ./kernel_patcher [/code]
  • If the kernel is already patched, the above script displays kernel patching failed message.
  1. Run device_infos script and supply key835 as a parameter. The script computes the Key 0x835 and displays on the screen. If key835 parameter is not supplied, the script computes all the encryption keys and stores them in a Plist file. [code] > ./device_infos key835 [/code]

Once Key 0x835 is grabbed, it is possible to decrypt the Backup Keybag and obtain the data protection class keys. Later these class keys are used to decrypt the protected files in the backup. 11. On Mac OS X terminal, navigate to iphone-dataprotection directory. Run the backup_tool.py script by supplying the iTunes backup directory path. [code] > python python_scripts/backup_tool.py /Users/User/Library/Application Support/MobileSync/Backup/[iPhone UDID]/ [output_path] [/code] If output_path is not mentioned, the script creates [iPhone UDID]_extract directory in the backup folder and extracts the backup files into it. On the backup, the iPhone keychain sqlite database is stored as a Plist file (Keychain-backup.plist). The Plist file contents are encrypted with the keychain data protection class keys. Items in the keychain can only be viewed after decrypting it with the keychain protection class keys. Run keychain_tool.py and supply Key 0x835. The script decrypts the Backup Keybag, grabs the protection class keys from 6 to 11 (listed in Table 2) and decrypts the keychain items. [code] > python python_scripts/keychain_tool.py –d /Users/User/Library/Application Support/MobileSync/Backup/[iPhone UDID_extract]/keychain-backup.plist /Users/User/Library/Application Support/MobileSync/Backup/[iPhone UDID_extract]/Manifest.plist [/code] The above script dumps the generic passwords, internet passwords, certificates and private keys from the keychain backup file.

Decrypting Encrypted backups

In cases of encrypted backups, migratable data protection class keys (6 to 8 listed in Table 2) stored in the Backup Keybag are protected by iTunes password and ThisDeviceOnly class keys (9 to 11 listed in Table 2) stored in the Backup Keybag are protected by Key 0x835 along with the iTunes password. Most of the data stored in the encrypted backups is migratable as the data is encrypted with the iTunes password and it is not tied to a specific device. Files in the backup are encrypted with a unique key for each file using AES 256 in CBC mode. Encryption keys are stored in the Backup Keybag and protected by iTunes password. In order to decrypt the Backup Keybag, grab the protection class keys and decrypt backup files iTunes password is required. So decryption of files in the encrypted backup is not possible without the iTunes password. In forensic investigations the information recovered from the backups is less if the iTunes password is not available. As iTunes does not impose any password strength rules on encrypted backups, it is easy to perform a brute force attack on it. Encrypted backups add a significant difficulty in data recovering and it may be impossible with a complex password in use. During the backup iTunes stores the encrypted backup password on the iPhone keychain. So if the backup password is unknown and physical access to the device is available, the backup password can be retrieved by viewing the iPhone keychain items. On a JailBroken iPhone, all the keychain items can be viewed using keychain_dumper tool. Tools like iPhone Backup Extractor & iPhone Backup Browser does not work on encrypted backups. They can only read & parse the Manifest.mbdb file and prepares a file structure. However the file cannot be opened as the content is encrypted. Steps below explain the procedure to decrypt the files stored in the encrypted backup with a known iTunes password. Run backup_tool.py and supply iTunes password to it. In case if the password is unknown, modify the backup_tool.py script and attach a brute force script to it. Backup_tool.py script takes the user entered password, decrypts the Backup Keybag, grabs all the encryption keys and decrypts the files in the backup. [code] > python python_scripts/backup_tool.py /Users/User/Library/Application Support/MobileSync/Backup/[iPhone UDID]/ [output_path] [/code] If output_path is not mentioned, the script creates [iPhone UDID]_extract directory in the backup folder and extracts the backup files into it. On the encrypted backup, the iPhone keychain sqlite database is stored as a Plist file (Keychain-backup.plist). The Plist file contents are encrypted with the migratable and ThisDeviceOnly keychain data protection class keys. To view migratable keychain items run keychain_tool.py and supply iTunes password. To view ThisDeviceOnly keychain items run keychain_tool.py and supply Key 0x835. [code] > python python_scripts/keychain_tool.py –d /Users/User/Library/Application Support/MobileSync/Backup/[iPhone UDID_extract]/keychain-backup.plist /Users/User/Library/Application Support/MobileSync/Backup/[iPhone UDID_extract]/Manifest.plist [/code] The above script dumps the generic passwords, internet passwords, certificates and private keys from the keychain backup file.

Conclusion:

Techniques illustrated in the article shows that forensics investigation is possible on the latest version of iPhone backups. However the information recovered from the backup alone without physical access to the device is less. Apple is also changing the backup mechanism with every major release of iTunes. So it is always challenging to design the scripts to decrypt the iTunes backups.

iPhone data protection in depth by Jean-Baptiste Bédrune, Jean Sigwald http://esec-lab.sogeti.com/dotclear/public/publications/11-hitbamsterdam-iphonedataprotection.pdf

iPhone data protection tools

http://code.google.com/p/iphone-dataprotection/

iPhone wiki http://theiphonewiki.com