iOS email encryption isn't as safe as Apple led you to believe

sincity · May 5, 2014

The maelstrom of internet security risks keeps on brewing, this time involving the Apple's latest iOS update, iOS 7.1.1.

The day after the new system's release, security researcher Andreas Kurtz wrote on his blog about a serious flaw in the system's ability to encrypt email attachments within the MobileMail.app. He wrote to Apple immediately.

"They responded that they were aware of this issue, but did not state any date when a fix is to be expected," Kurtz wrote. "Considering the long time iOS 7 is available by now and the sensitivity of email attachments many enterprises share on their devices (fundamentally relying on data protection), I expected a near-term patch. Unfortunately, even today's iOS 7.1.1 did not remedy the issue, leaving users at risk of data theft."

To sum up the technical jargon, Kurtz setup an IMAP email account and sent out some test emails with attachments. He shut the phone down and used "well-known techniques" to recover the attachments "without any encryption/restriction."

The plot thickens

What's worse is that this isn't just an issue for 7.1.1 users, but for anyone using iOS 7.1 or version 7.0.4 as well. Is Apple saying "too bad, so sad" to its trusting business-class users?

While Apple may not be known for their airtight security when it comes to operating systems, these are the people who recently embedded fingerprint-scanning technology into their flagship iPhone 5S.

These software updates are generally tens of thousands of lines long and, realistically, come with a few bugs. While Kurtz goes on to suggest concerned users can disable news synchronization, it seems like this is more a concern for government workers and law enforcement agencies and less likely a concern when trying to keep your vacation pics safe.