Top all-time · #965
ElcomSoft blog
Company blog · blog.elcomsoft.comsecuritysystems
ElcomSoft blog is the company blog at blog.elcomsoft.com, writing about security and systems. Since 2016, 68 different Hacker News readers have linked it 94 times, most often “iOS 11 Horror Story: The Rise and Fall of iOS Security”. It is still writing: the last post was on 2026-10-09, and you can follow it by feed.
«...Everything you wanted to know about password recovery, data decryption, mobile & cloud forensics...»
Most-linked posts?
- /2011/04/nikon-image-authentication-system-compromised/7 people · 7 mentions · first linked 2017-12-12
- iOS 11 Horror Story: The Rise and Fall of iOS Security6 people · 10 mentions · first linked 2017-11-29
- /2021/01/apple-scraps-end-to-end-encryption-of-icloud-backups/3 people · 4 mentions · first linked 2021-07-21
- LUKS Encryption Broken3 people · 3 mentions · first linked 2023-02-24
- This $39 Device Can Defeat iOS USB Restricted Mode2 people · 3 mentions · first linked 2018-07-10
- Synology NAS Encryption: Forensic Analysis of Synology NAS Devices2 people · 3 mentions · first linked 2020-11-01
- Analysing Apple Pay Transactions2 people · 2 mentions · first linked 2018-08-31
- Attacking the 1Password Master Password Follow-Up2 people · 2 mentions · first linked 2017-08-19
- Volume Encryption in Synology DSM 7.2: LUKS with Questionable Key Management2 people · 2 mentions · first linked 2023-08-05
- /2021/01/apple-fbi-and-iphone-backup-encryption-everything-you-wanted-to-know/2 people · 2 mentions · first linked 2021-04-28
What Hacker News says?
https://blog.elcomsoft.com/2021/01/apple-scraps-end-to-end-e...
Comment linking /2021/01/apple-scraps-end-to-end-encryption-of-icloud-backups/
on “On Apple’s “Expanded Protections for Children” – A Personal Story”Submitted iOS 11.4 to Disable USB Port After 7 Days: What It Means for Mobile Forensics as a story · 544 points
HN discussionhttps://blog.elcomsoft.com/2021/01/apple-scraps-end-to-end-e...
Comment linking /2021/01/apple-scraps-end-to-end-encryption-of-icloud-backups/
on “On Apple’s “Expanded Protections for Children” – A Personal Story”Submitted iOS 11 Horror Story: The Rise and Fall of iOS Security as a story · 466 points
HN discussionWhen you get the prompt to input the code, just choose "Did not get a verification code" and it will fall back to SMS. See: https://blog.elcomsoft.com/wp-content/uploads/2016/03/apple_...
Comment linking /wp-content/uploads/2016/03/apple_2fa-550x341.png
on “SMS is not 2FA-secure”Submitted iOS 10: Security Weakness Discovered, Backup Passwords Much Easier to Break as a story · 220 points
HN discussionhttps://blog.elcomsoft.com/2021/01/apple-fbi-and-iphone-back...
Comment linking /2021/01/apple-fbi-and-iphone-backup-encryption-everything-you-wanted-to-know/
on “Dominance of Apple and Google’s app stores impacting competition and consumers”Submitted Breaking VeraCrypt: Obtaining and Extracting On-the-Fly Encryption Keys as a story · 82 points
HN discussionI was talking about better security that was present in iOS10 and then degraded by Apple in iOS11. See the link - https://blog.elcomsoft.com/2017/11/ios-11-horror-story-the-r...
Comment linking /2017/11/ios-11-horror-story-the-rise-and-fall-of-ios-security/
on “Apple Launches Portal for U.S. Users to Download Their Data”Submitted Breaking LastPass: Instant Unlock of the Password Vault as a story · 51 points
HN discussionHow is writing down PIN related to security? It is still a single point of failure, attacker knowing PIN can gain access to everything in your account - iCloud, password backups etc. And in iOS10 security was better, so Apple consciously decided to degrade it in iOS11. See source - https://blog.elcomsoft.com/2017/11/ios-11-horror-story-the-r...
Comment linking /2017/11/ios-11-horror-story-the-rise-and-fall-of-ios-security/
on “Apple Launches Portal for U.S. Users to Download Their Data”Submitted Breaking RAR5 and 7Zip Passwords as a story · 41 points
HN discussionhttps://blog.elcomsoft.com/2017/11/ios-11-horror-story-the-r... "The release of iOS 11" ... "also made a number of other changes under the hood" ... "Each and every one of these changes was aimed at making the user’s life easier (as in “more convenience”), and each came with a small trade off in security. Combined together, these seemingly small changes made devastating synergy, effectively stripping each and every…
Comment linking /2017/11/ios-11-horror-story-the-rise-and-fall-of-ios-security/
on “Apple Launches Portal for U.S. Users to Download Their Data”Submitted Android Encryption Demystified as a story · 40 points
HN discussionRemember, Nikon's image authentication was hacked back in 2011 https://blog.elcomsoft.com/2011/04/nikon-image-authenticatio... The ACLU is sceptical regarding the whole concept: https://www.aclu-or.org/en/news/attempts-technological-solut... The root causes podcast discusses this topic in its episode 336: https://www.sectigo.com/resource-library/root-causes-336-dig... I strongly believe this should be an open source…
Comment linking /2011/04/nikon-image-authentication-system-compromised/
on “Roc Camera”Submitted Breaking into 1Password, KeePass, LastPass and Dashlane as a story · 25 points
HN discussionThanks for the response! I will have to postpone a detailed response to later. In the meantime: > Make an Access Point, use smartphone to connect to it. Run Wireshark, and you'll see what's happening. That won't help when it comes to how stuff is encrypted locally, i.e. the hardware-backed encryption[0]. PS: I think I updated my comment while you were already responding. [0]: https://blog.elcomsoft.com/2019/08/how-t…
Comment linking /2019/08/how-to-extract-and-decrypt-signal-conversation-history-from-the-iphone/
on “Signal adds a payments feature with a privacy-focused cryptocurrency”Submitted Analysing Apple Pay Transactions as a story · 10 points
HN discussionThen you should read older post by Elcomsoft (1), about Apple consciously degrading several layers of security in iOS11 (compared to iOS10) essentially to a PIN-code. Currently if you know PIN and have iPhone you can extract everything out of it, out of backups and out of iCloud. (1) https://blog.elcomsoft.com/2017/11/ios-11-horror-story-the-r...
Comment linking /2017/11/ios-11-horror-story-the-rise-and-fall-of-ios-security/
on “iOS 11.4 to Disable USB Port After 7 Days: What It Means for Mobile Forensics”Submitted iOS 11 Horror Story: The Rise and Fall of iOS Security as a story · 7 points
HN discussionYeah, such systems have been tried (and been hacked) for decades now. https://www.elcomsoft.com/news/428.html https://blog.elcomsoft.com/2011/04/nikon-image-authenticatio... You don't even have to travel to the location, you can just spoof GPS. And of course that will only be needed until some eastern european kid gets bored one weekend and the signing keys magically appear on pastebin. It's funny to see Apple fall…
Comment linking /2011/04/nikon-image-authentication-system-compromised/
on “Apple Reference Image: A New Approach for Verified Photography”Submitted Breaking into iOS 16.5: Extracting the File System and Keychain as a story · 5 points
HN discussionThe encryption is also broken. If you use encrypted shared folders, you have an arbitrary filename limit ( https://kb.synology.com/en-ro/DSM/tutorial/File_folder_path_... ). If you use volume encryption, your encryption key is stored on the NAS itself, which is capable of decrypting the data, unless you buy a second Synology NAS ( https://blog.elcomsoft.com/2023/06/volume-encryption-in-syno... ) to act as a key vaul…
Comment linking /2023/06/volume-encryption-in-synology-dsm-7-2-luks-with-questionable-key-management/
on “The Synology End Game”Submitted Microsoft Office encryption evolution: from Office 97 to Office 2019 as a story · 5 points
HN discussionThis guy says veracrypt is tough, even tougher than LUKS: https://blog.elcomsoft.com/2021/06/breaking-veracrypt-obtain... Disk encryption is generally in XTS mode, and not authenticated. That’s not limited to veracrypt.
Comment linking /2021/06/breaking-veracrypt-obtaining-and-extracting-on-the-fly-encryption-keys/
on “From stolen laptop to inside the company network”Submitted Attacking the 1Password Master Password Follow-Up as a story · 5 points
HN discussion> you mean something like ios keychain? what does this do that can't be achieved using disk encryption + sandbox? Because once the phone is booted and unlocked by the user there is no further protection. Do you keep your phone turned off? Also the lack of device pairing means it is usually easy to dump the encrypted image and crack the pass code quite quickly. https://blog.elcomsoft.com/2017/10/ios-vs-android-physic…
Comment linking /2017/10/ios-vs-android-physical-data-extraction-and-data-protection-compared/
on “Android P”Submitted Breaking VeraCrypt Containers as a story · 4 points
HN discussionJust because something is different from something that doesn't work doesn't mean the different thing will work: most things don't work. I'm not seeing anything in your description that couldn't also be said about using PKI to allow people to sign stuff they published. (And better: it's not broken by non-deceptive edits, like cropping or brightness adjustments)-- except that PKI already exists so we can't imagine th…
Comment linking /2011/04/nikon-image-authentication-system-compromised/
on “Moon Disaster”Submitted Analysing Apple Pay Transactions as a story · 4 points
HN discussion
