Last week, security consultant and former iOS jailbreaker Jonathan Zdziarski made headlines with his talk, “Identifying Back Doors, Attack Points, and Surveillance Mechanisms in iOS Devices”. Here’s a link to a PDF of the slides.

Zdziarski:

Before the journalists blow this way out of proportion, this was a talk I gave to a room full of hackers explaining that while we were sleeping, this is how some features in iOS have evolved over the PAST FEW YEARS, and of course a number of companies have taken advantage of some of the capabilities. I have NOT accused Apple of working with NSA, however I suspect (based on released documents) that some of these services MAY have been used by NSA to collect data on potential targets. I am not suggesting some grand conspiracy; there are, however, some services running in iOS that shouldn’t be there, that were intentionally added by Apple as part of the firmware, and that bypass backup encryption while copying more of your personal data than ever should come off the phone for the average consumer. I think at the very least, this warrants an explanation and disclosure to the some 600 million customers out there running iOS devices. At the same time, this is NOT a zero day and NOT some widespread security emergency. My paranoia level is tweaked, but not going crazy. My hope is that Apple will correct the problem. Nothing less, nothing more. I want these services off my phone. They don’t belong there.

Apple responded to Zdziarski’s comments and presentation with this comment, posted on Twitter by Financial Times’ Tim Bradshaw:

“We have designed iOS so that its diagnostic functions do not compromise user privacy and security, but still provides needed information to enterprise IT departments, developers and Apple for troubleshooting technical issues. A user must have unlocked their device and agreed to trust another computer before that computer is able to access this limited diagnostic data. The user must agree to share this information, and data is never transferred without their consent.”

As we have said before, Apple has never worked with any government agency from any country to create a backdoor in any of our products or services.”

Rene Ritchie at iMore created a nice summary of Zdziarski’s concerns:

When you connect your iPhone or iPad to iTunes on Mac or Windows — and choose to trust that computer — a pairing record is created that maintains that trust for future connections. Zdziarski claims that if someone takes physical possession of that computer, they can steal those pairing records, connect to your device, and retrieve your personal information and/or enable remote logging. If they don’t have your computer, Zdziarski claims they can try and generate a pairing record by tricking you into connecting to a compromised accessory, like a dock (juice jacking), and/or by using mobile device management (MDM) tools intended for enterprise to get around safeguards like Apple’s Trusted Device requestor.

From an article we posted last year on juice jacking:

When you plug your smart phone into a USB cable, your device will try to pair with the device on the other end of the cable. If the only thing on the other end of the line is your personally owned USB charger, no worries. But if you plug into a public charging station or a stranger’s USB charger, you are opening yourself up to malware. The device on the other end can pair with your phone and cause all sorts of mischief.

This is all about trusted pairing. Apple is making the point that they’ve bottlenecked trusted pairing so that a user needs to agree to the pairing before data access is allowed.