Apple’s Huge iPhone Mistake—New Warning For 1 Billion Users

Apple has a very serious problem that has suddenly become a headline issue, undermining claims about iPhone’s security and privacy credentials. It turns out that what happens on your iPhone, doesn’t always stay on your iPhone after all.

I have warned before about the dangerous flaw in Apple’s iPhone security when it comes to the private messages sent between its billion-plus users. Privacy is built in from the beginning,” Apple says. “Powerful security features help prevent anyone except you from being able to access your information.” If only it was that clear-cut. Now a new warning from a very surprising source has hit the news.

iMessage is Apple’s stock end-to-end encrypted messenger. Designed to compete with WhatsApp, it seems to have the same security—albeit only when communicating within Apple’s ecosystem. Message an Android user and you fallback to SMS, which is unacceptable in 2021—more on that later. But even when you think you’re secure, you’re probably wrong. iMessage has an alarming catch.

The issue is iCloud and the general backups you make from your iPhone. If you use Apple’s default, recommended settings, then you run Messages in iCloud—meaning you sync your messages across all your devices, and you also run a generic iCloud backup, meaning you save a copy of your phone’s data and settings to Apple’s cloud.

Here’s where it gets complicated. iMessage is secured by end-to-end encryption, the idea being that the keys to decrypt messages between you and those you message are only shared between you. That stops anyone intercepting your content. But in a bizarre twist, Apple stores a copy of those encryption keys in that iCloud backup, which it can access. That means the end-to-end encryption is actually fairly pointless.

This issue came to the fore this week, with the publication of a sensitive FBI document that advises on which messaging platforms its agents can most easily access. The iMessage issue was front and center: “if target uses iCloud backup, the encryption keys should also be provided with [lawful access] content return; can also acquire iMessages from iCloud returns if target has enabled Messages in iCloud.”

When it comes to security, WhatsApp’s assurances are clear: “We use end-to-end encryption so no one can read or listen to your personal conversations.” Apple’s wording is different—and the nuance is critical. “End-to-end encryption protects your iMessage conversations across all your devices,” it says, “so that there’s no way for Apple to read your messages when they’re in transit between devices.”

That “in transit” wording is critical. It’s absolutely correct that when messages travel between phones they’re highly secure, but on the device and backed up to the cloud, that changes. This issue is fast becoming the most critical one for secure messaging.

Despite its clearer assurances, WhatsApp didn’t do that well, with the FBI saying it can request contact lists and metadata “sent every 15 minutes” on who is messaging who. It can also access message content “if target is using an iPhone and iCloud backups enabled, iCloud returns may contain WhatsApp data to include message content.”

WhatsApp’s new encrypted backup feature is designed to resolve this exact issue, and WhatsApp even advises during the setup process that users need to remove it from iCloud backups. It turns out that little iCloud backup setting is bad news for private messaging all round—a major vulnerability Apple needs to address urgently.

Unsurprisingly, Signal comes out best on the document: “No message content, [just] data and time a user registered [and] last date a user’s connectivity to the service.” Signal avoids all on-device backup options and famously doesn’t capture any metadata at all. Essentially, if the data doesn’t exist, it can’t be provided.

“It’s impossible to turn over data that we never had access to in the first place,” Signal says. “Signal doesn’t have access to your messages; your chat list; your groups; your contacts; your stickers; your profile name or avatar; or even the GIFs you search for.”

If you want to keep your messaging private, my advice is to use WhatsApp as your daily, just given its scale, but make sure you use encrypted backups and don’t have the iCloud backup option enabled. You should definitely use Signal where your contacts also have the app. If you’re an Android user, you can set Signal as your default messenger, such that it handles SMS as well—that’s a great option to have.

This has not been a good year for Apple and its iMessage platform. The storage of encryption keys in accessible backups is one mistake, but it has made two others as well, both of which significantly reduce the security and privacy of iMessage.

First, Apple’s decision to steer clear of Google’s now coordinated RCS rollout across Android is a bad move for users. It means that Apple users messaging Android contacts, or vice versa, have to revert to a third-party platform like WhatsApp or will default to non-secure SMS, a crazy situation for 2021.

Google has been gently pressing Apple to get onboard this SMS v2 upgrade, and we saw more of that recently with a Google Messages update that translates the emoticon iMessage responses to something similar on an Android device. This is fairly pitiful as a token gesture for cross-platform interoperability, but it makes the point.

Second, Apple has also misstepped with its decision to add an on-device AI classifier to iMessage to warn minors sending or receiving explicit imagery. While this doesn’t technically breach end-to-end encryption, it does open a backdoor to outside interference within the overall secure messaging enclave and has been heavily criticized by security and privacy advocates as a result.

And let’s not forget Pegasusgate, where an iMessage compromise was implicated in zero-click attacks on Apple users reportedly perpetrated using NSO technology. Apple says it has patched those vulnerabilities in iOS 15, but it was damaging, nonetheless.

This is an interesting time for secure messaging. There has never been more awareness of the value in preserving privacy using end-to-end security, but at the same time there’s never been more pressure on tech providers to open those platforms to law enforcement. The publication of this FBI document shows that despite protests from more hawkish lawmakers, there’s a fair amount of access to data even now.

Pegasus and this lawful access revelation is all about endpoint compromise. Whether on the device and tapped by malware, or backed up to the cloud, once end-to-end encrypted data reaches one of those ends, you need to take care it’s secure. And that means protecting your device and being mindful of what you back up to where.

Meanwhile, for Apple and its security and privacy USP, this is another awkward set of headlines it could really do without. I have approached Apple for any comments on the FBI document and its serious implications for the billion-plus iPhone users.

The stark truth is that Apple needs to change its iCloud approach as a matter of urgency, to cease storing encryption keys and to avoid backup up end-to-end encrypted data unless its protection carries over or users have been specifically warned that their privacy is being compromised. This update is now critical.