Checklist 66: The Latest Security Features in iOS 11: Part One
Have we ever talked about the security features built into iOS itself? Of course — we’ve covered that subject in many previous episodes, but things change. When The Checklist began, users were still walking around with iOS 9. Now we’re up to iOS 11, and Apple continues to make things more secure as they go. Even before iOS 11, Apple’s mobile system had some serious security protections and features, but they’ve added some new ones and refined others, so it’s time to revisit the topic.
Today we’ll be undertaking the first half of our two-part look at the latest features you’ll find in iOS 11. On today’s agenda, we’ll hit:
- The introduction of FaceID
- Enhanced protection against unauthorized backups
- The most recent physical security features
So, let’s dive right in: with the iPhone X streaming out of stores and into the hands of users everywhere, it seems natural that the best place to start would be Apple’s latest innovation in authentication.
The introduction of FaceID
Way back in 2013, with the release of the iPhone 5S, Apple debuted TouchID, a new method for unlocking your phone and authenticating yourself by using a fingerprint scanner built into the device. Of course, now we’re all very familiar with this technology; not only has it been on every iPhone since, but it’s present on many other phones as well. Apple even eventually built it into the newest line of MacBooks. We take it for granted today, but it was a significant step forward regarding security. Using biometrics comes with its own concerns, though, and Apple took care to protect that data by building the Secure Enclave.
Now, with the debut of the iPhone X, Apple has gambled again on a new way to push forward security and self-authentication practices: FaceID. Instead of using our fingerprints, Apple wants us to use our faces! Arguably far more unique than our fingerprints, this is even more sensitive data to deal with — and Secure Enclave is hard at work protecting the information FaceID uses to function here, too. It’s a good thing, too, because your iPhone X has a ton of data to process very quickly for FaceID to work. Before we break down how the technology works, let’s take a quick refresher on what exactly we mean when we say “Secure Enclave.”
Using a special coprocessor chip inside the phone, Apple creates a digital shield around the sensitive biometric data it uses to allow you to authenticate. The data used by TouchID and FaceID is strictly handled inside the Secure Enclave in an encrypted form. The other processes inside the device cannot read the information Secure Enclave works with; rather, it communicates with the Enclave to learn whether the supplied biometrics match the encrypted form it houses. In this way, it’s extremely difficult to inappropriately access that very sensitive information.
So, with that said, let’s jump back to FaceID. All you need to do, Apple says, is look at your iPhone X — and it’s ready to unlock. At first, it might seem like magic, but there is a ton of technology at work behind the scenes here to make it happen. Using enhanced cameras and sensors built into the bar at the top of the iPhone X’s screen, the phone searches for faces in its field of view and then analyzes them. How?
With an invisible field of more than 30,000 dots of light, the phone works to create a complete 3-dimensional map of your face. When you initially set up FaceID, it takes the time to measure a number of your features, such as the distance between your eyes, the height of your nose, and so forth. With this digital 3D model made from the dot map and an infrared image complete, the phone transforms it into a mathematical representation — just like it would do with your fingerprint — and stores it, encrypted, inside the Secure Enclave. When you look at your phone later, it scans your face again and works to compare the two sets of data. If they match, it’s you — and you’re in!
There’s more to it, though: Apple has neural networks performing machine learning on this facial data inside your phone. In other words, every time you look at the phone, it learns your face all over again, and becomes better at recognizing your specific face. Over time, it grows more and more secure, allowing it to continue to know you’re you even if you change your hair or put on glasses. The sensor is even smart enough to tell the difference between when your eyes are open and closed, and when you’re looking right at the sensor versus when you’re looking at something nearby.
Besides adding convenience to getting into your phone, FaceID also brings some cool new features to iOS 11 that we could someday see as commonplace. Lock screen notifications are one area where you must balance between good privacy practices and convenience. For non-X users, you have the choice of displaying those notifications (in which case anyone who picks up your phone can read them) or not using them at all. With FaceID, notifications will remain hidden until it sees that you’re looking at the screen; then you can see the preview. Anyone else won’t be able to see it if they pick up your phone.
So, is FaceID foolproof? There have been some stories in the media about FaceID unlocking incorrectly, and even one story about a team that went to great lengths by 3D printing a mask of someone’s face in an effort to fool the sensors. In that case, the proof of concept seemed dubious — but also the lengths it would take to duplicate someone’s face make the method extremely impractical in any real-world context. What if you have an identical twin? That’s another case where FaceID won’t be able to tell the difference between the two of you — but that’s just a fact of life, rather than something we might call a vulnerability.
In other cases, such as relatives unlocking each other’s phones, it could be a result of FaceID training itself from the wrong face. When FaceID cannot unlock the phone, it prompts for your PIN as a backup. With a correct passcode, FaceID may read the face of the user to retrain itself to recognize what should obviously be a valid user. However, family members sometimes share passcodes with one another to unlock phones, which could lead to some of the issues reported in the media. In cases where things like these happen, there is a “Reset FaceID” option that makes it easy to start over.
That covers FaceID — but what other security improvements are there in iOS 11?
Enhanced protection against unauthorized backups
Apple has also taken steps in iOS 11 to shore up their protection against unauthorized users getting access to your device data through the backup process. Previously, when you hooked your iPhone up to a computer, it would display a prompt asking if you wanted to mark the machine as “trusted.” Whether you selected yes or no, that was the end of it — the phone would proceed to interface with iTunes, and could create an automatic backup.
If someone has your phone and access to a trusted computer, they could potentially access a backup of your device and start trying to root through it. At most, they would need your fingerprint to make the device trusted. In a law enforcement context, that’s a trivial request — the courts have sided with the police when it comes to compelling users to give up their fingerprints. It could also pose a potential access for forensic companies who make it their jobs to figure out ways to recover information from inaccessible devices.
In iOS 11, this behavior has all changed. Now, you must enter your passcode when you connect the iPhone to a computer, no matter what. Even if you unlock your phone and plug it in, it will still prompt for your passcode — and neither TouchID nor FaceID are enough to bypass these requirements. While the police can compel suspects for fingerprints, there has not been a clear precedent on the subject of passcodes and passwords. So, in addition to making your backups harder for someone to get to on a whim, it also demonstrates Apple’s continued commitments to shoring up user privacy. That does make it harder for forensic workers, who may need to create an accurate backup copy of the device to enter into evidence in court, though.
Once you’ve entered your passcode, the device will continue to remember that machine as trusted. However, Apple’s 2FA does have the ability to recognize different devices. By learning which devices are trusted and which are not, your phone can know when to prompt for your second factor for authentication. Who knows where we’ll see this type of machine learning going in the future?
That said, there are also times when you might need to get into your phone to recover some data — or you might just be curious about how digital forensics works when it comes to phones. If you want to dig deeper into the way these things work or to see what the “state of the art” in this field is like, we suggest checking out the blogs run and maintained by some of the big forensic companies. Elcomsoft is one of the major players in this field, and they produce a very informative and detailed blog that can shine a light on the work being done to exploit features or uncover flaws for extracting data from devices.
The latest physical security features
Beyond FaceID and stronger, safer backup procedures, Apple’s made some tweaks to the way the phone behave in the physical world, too. One of the most significant additions, and certainly one of the most widely reported changes, was the implementation of the Emergency SOS mode. With our phones being with us nearly 100% of the time, they’re often our first link to help when trouble arises. The SOS mode was created to help address emergency situations and add some more functionality to your phone. How does it work?
For iPhone 7 and below, users must rapidly press the right-side button on their phone five times. For iPhone 8 and X users, hold the side button and a volume button simultaneously. Once done, you will activate SOS mode. If the “Auto Call” setting is enabled, this will automatically start a countdown to placing a call to your emergency services. Otherwise, it brings up a menu of sliders which allow you to call for help quickly or to display important medical details set up in your Health app. As an added feature, activating the SOS can also notify your emergency services of your location. You’ll find a new “Emergency SOS” page in your iPhone’s Settings that will allow you to set up everything associated with this feature.
However, it still does more: when you activate Emergency SOS, it also temporarily disables TouchID or FaceID, just as if you had restarted your device, so you must enter your passcode before it can be unlocked again. In situations where you feel like your privacy might be in danger, such as someone trying to unlawfully access your phone, enabling this mode could be an option to lock others out in an emergency.
Besides the SOS feature, Apple has also taken steps to make us all safer on the road with the implementation of the Do Not Disturb while Driving feature. While this feature isn’t enabled by default, it’s something you can choose to enable to make yourself a safer driver. Once activated, the iPhone will use its sensors to determine when you’re in motion while driving. Should someone send you a text message, they’ll receive an instant and automatic reply that you can’t respond because you’re driving. However, your friend or family members can still respond with “Urgent!” to ensure immediate delivery of the message. This is an interesting way that Apple has introduced to help reinforce good usage habits.
If you did not enable this feature when setting up your phone, check out the “Do Not Disturb” options in Settings. You’ll find the Driving option in there alongside several configuration options, such as automatic activation when the iPhone pairs with your car’s Bluetooth. That’s it — it’s effortless to set up.
From the brave new world of FaceID authentication to backup security improvements and new ways to stay secure in the real world, iOS 11 has a lot of new features packed into it. That’s why we can’t cover everything about it in just one episode! We’ll be returning next week to cover another three important topics, including Apple’s improvements to preventing tracking and more. As always, you can find show notes for all our previous episodes right here. We’ll see you again next week! Thanks for listening to The Checklist, brought to you by SecureMac.
