Tech firms are fighting back against government requests for user information, that includes Microsoft and Apple. As per report, the Department of Justice obtained a court order demanding that Apple lend the iMessages sent between crime suspects, in real time.
Apple said that wasn’t possible, as its iMessage service was encrypted.
But, the issue is, there's truly a very high probability that, technologically, iMessage can be wiretapped, because it doesn't let users to verify encryption keys when writing or receiving messages.
Here's How iMessage Works
When someone—let’s say when Alan—sends a text over iMessage, the content doesn’t merely go from Alan’s Apple device to someone else. First, Alan’s device contacts one among Apple’s servers. called ESS, this server stores all of the public keys for iMessage users.So from here on, the Apple server hand over Alan with, say, Steve’s encryption keys. Then equipped with this info, Alan’s iPhone encrypts the message, sends the scattered text to Apple & then forwards it over to Steve, who can decipher (i.e. decrypt) it.
So during this procedure does Apple see the particular content of the message, as it is encrypted before it leaves Alan’s device, aka end-point.
Hence, the label “end-to-end encryption.”
This centralized approach to key management isn’t actually the issue, and it's the same mechanism that varied End-toEnd encrypted messaging services use.Signal, developed by Open Whisper Systems, too makes a user’s device connect with central server of keys, Nicholas Weaver a senior researcher from the International Computer Science Institute, said in an email.
However, as noted by Weaver during a recent post on the Lawfare Blog, it is not possible for an iMessage user to be clear that the Apple server has provided them with appropriate set of encryption keys.
“Without such an interface, iMessage is “backdoor enabled” by design: the keyserver itself provides the backdoor,” Weaver writes.
Weaver also said that, if designed to try & do so, the Apple server might, rather than providing Alan with Steve’s correct keys, send a further one that the FBI had access to. Indeed, this was highlighted by researchers as way back in 2013, and Matthew Green, assistant professor at Johns Hopkins University also once laid out the same case. “[In that case] the FBI (but not Apple) can decipher all iMessages sent to Alan in the future,” Weaver continues. By adding another FBI key to all or any messages that Alan sends, it might be possible for the agency to eavesdrop on all of his outgoing texts too.
The Solution:
So, the sole approach for this potential backdoor is permitting users to verify what keys they have received. With Signal, users can hit a ‘Verify identity’ button, and the app will show their key fingerprint, & also of the person they’re communicating with. So as to make sure that they’ve been issued the correct keys, or the pair can also send this code over another means of communication, or just show it to each other personally.“Hardly anybody indeed verify keys offline, but the proficiency of doing so is what forces the keyserver to be honest,” Weaver continued. It’s worth citing that Open Whisper Systems partnered with WhatsApp to deliver end-to-end encryption, However the service, like iMessage, does not have a feature to verify user’s fingerprints.
It’s unclear why Apple has not enforced some kind of manual verification process. The company did not respond to a request for comment.
This is all presumptuous that the FBI, or alternate agency, may find the legal standing to compel Apple to send fake encryption keys to a target. As pointed out, a court order was obtained to demand Apple deliver unencrypted messages. Although that request was apparently unsuccessful, the technological groundwork for wiretapping iMessage is there, at least for the time being.
