Apple's screw-up leaves tethered iPhones easily crackable

[silicon_toad2000]

http://www.theregister.co.uk/2013/06/18/iospoor_passwords_crackable_24_seconds/

iPhones being used as Wi-Fi hotspots are open to attack because of lax security protocols in the automatic password generation system Apple has in place, according to new research from the University of Erlangen in Germany.

The paper, "Usability vs. Security: The Everlasting Trade-Off in the Context of Apple iOS Mobile Hotspots" by Andreas Kurtz, Felix Freiling, and Daniel Metz, found that the seemingly random password iOS generates for hotspots is simple to crack. It consists of four to six characters followed by a four-digit number string.

As a test, the team downloaded a 52,500-word dictionary from an open source version of Scrabble, added number-generating code, and cracked the iOS password system every time – although the team points out it isn't suggesting Apple used the same dictionary. Using a AMD Radeon HD 6990 GPU, the average time to crack was 59 minutes – which is interesting, but hardly practical.

So the team then reverse-engineered the iOS word list used for password generation, using "static and dynamic analysis," tools like GNU Debugger, and by manually going through the ARM disassembly of the relevant iOS frameworks. They found Apple uses English-language words of between four and six letters from a dictionary copyrighted by Lernout & Hauspie Speech Products.