SafeCode – Safeguarding Security and Privacy of User Data on Stolen iOS Devices

Abstract

Stolen phones, until the descent of smartphones, simply meant minutes’ overages or huge bills from long-distance calls. Now the cost could be anything ranging from your privacy, security, finance or simply “YOU”. A Smartphoneos knowledge of its user, if not protected, is a potential risk to the very user’s security and privacy. When a smartphone is stolen, it isn’t just the device you need to worry about but the treasure of private and sensitive data it holds, which can compromise your very safety and privacy if in the wrong hands. A determined adversary can potentially uncover a lot of things from a stolen iOS device — credit card numbers, passwords of various other accounts, bank account numbers, etc. On top of that, if it’s a work phone, the adversary can also gain entry into your company’s restricted network, which is otherwise highly secure and private. In this paper we propose a simple yet powerful method of protecting the loss of private and sensitive data resident on a stolen iOS devices, focusing mainly on iPhones. SafeCode security mechanism leverages on existing passcode protection mechanism on iOS devices to prevent the device from being “switched off” or “silenced” by the adversary when the device is stolen. SafeCode, in the best case scenario, extends the “window of opportunity” of recovering the stolen device. In the worst case scenario, SafeCode augments the probability of remotely wiping the device with the same extended “window of opportunity”.