setup/authenticate/$APPLE_ID$ HTTP/1.1 Host: Īccept: */* User-Agent: iCloud.exe (unknown version)ĬFNetwork/520.2.6 X-Mme-Client-Info: Accept-Language: en-USĬXR0LnRld3RAaWNtb3VkLmNvbTqRd2VydHkxMjM0NQ= Returns: mmeAuthToken, dsPrsID example: GET Replace keychain with our own trusted root certificate (need keyīuilt on Google Protocol Buffers (mostly)Īpple provides file-to-chunks mapping, chunk encryption keys,Īnd full request info to 3rd-party storage providerĪuthorization:Basic authentication data = mime64 (AppleID:password) Install Open SSH, get keychain (keychain-2.db) Hotspots, VPN settings etc) Paired Bluetooth devices Offline webĪpplication cache/database Safari bookmarks, cookies, history,īackup runs daily when device is: Connected to the Internet overĬan force backup | | TV, apps, books) Mail accounts Network settings (saved Wi-Fi Settings Camera roll (photos and videos) Purchases (music, movies,

Messages (including iMessages) Call history Application data Device ICloud backup - what & when Contacts and Contact Favorites Up to 50 GB paid storage Over 320 million users in July 2013īackups, documents, notes, calendar, Find My Phone Introduced in Oct 2011 Introduced with iOS 5 5 GB free storage System-wide storage for sensitive data (keys, passwords etc) Protect unauthorized access to the device Bypassing is not IOS forensics - logical & physical acquisitionĭevice must be unlocked (by passcode or iTunes)īoot-time exploit to run unsigned code or jailbreakĭevice lock state isnt relevant, can bruteforce passcode Physical acquisition Yes/No Yes/No No Yes* Lot of sensitive data Corporate deployments are increasing. (Source: IDC Worldwide Quarterly Mobile Phone Tracker)Ībout 1.2 billion smartphones worldwide Smart devices carry a Windows Phone 8 (yet another cloud for backups) Ltd.Īpple iCloud (backups, FindMyPhone, document storage)encryptedīlackBerry backups (BB 10 and Olympia Service) HITBSecConf2013 Vladimir Katalov, ElcomSoft Co.

Www hotmail comttps www google com