Messages in iCloud is secure enough for most of us, but opens a new attack vector for enterprise users
Along with key HomePod improvements, Apple also introduced Messages in iCloud with iOS 11.4. It’s a useful feature designed to store your Messages and attachments in iCloud, but enterprise users should think twice before enabling it.
I’m not saying iCloud is not secure – so long as you use a six-or more digit passcode or (better, but more awkward) an alphanumeric passcode, it’s highly secure. I’m reasonably confident a strong password, Apple’s own systems and its insistence you use two-factor authentication is enough for most of us.
However, when it comes to valuable enterprise or government data, I am concerned that determined cybercriminals will use phishing, man-in-the-middle and range of other complex attacks to get inside accounts, if the value of the data they want to access justifies the effort.
When you begin using Messages in iCloud you’ll find that all your messages (both iMessage and SMS) received across all your devices will be stored on Apple’s servers. A message deleted on one device will be reliably deleted on all of them, and you’ll save lots of space because those communications won’t need to be stored locally.
When you set up a new device, you’ll gain access to all your messages. The bad side of this exchange is that those messages count against your iCloud storage allowance, even though Apple offers a pathetic 5GB of space for free. Messages are still sent and received in encrypted form, so can’t (easily) be accessed on their journey.
When your messages are stored on Apple’s servers you’ll always be able to find or download the ones you need, including attachments and images. When you delete a message on one device it will be deleted across all your devices, disappearing from the cloud. Incoming messages will be made available across all your Apple products, even if they happen to be switched off when they were originally received. This works across iOS and Mac.
The fact these messages exist online may be a problem for enterprise users who need to follow strict data security protocols.
While I’m certain most larger enterprises now archive their iMessage sessions (particularly those sent using Business Chat), I’m not convinced they want that data to leak into the public cloud.
The problem is that enterprise information shared via personal messages may now be made available via iCloud. This could become a brand-new attack vector for cybercriminals hoping to undermine company security.
Another risk might be what happens to enterprise data in the event a rogue nation’s security services use local law to demand access to employee iCloud accounts, giving them the chance to explore messages held there.
Apple attracted a lot of heat in 2016 when it refused to create a way to unlock a work iPhone used by one of the San Bernardino murderers. It argued that if you create a way to unlock one device, then security across the entire platform suffers. This kind of designer insecurity threatens not just personal privacy, but enterprise and infrastructure security.
Apple didn’t say this because it didn’t want to help. Its Privacy — Transparency Reports show it will happily share information with law enforcement when permitted by the courts.
With Messages in iCloud, Apple has figured out a compromise. It provides rock solid protection for law-abiding individuals, while making it possible to provide authorities with information about criminals on receipt of a valid warrant to access iCloud data.
(It still collects way less data than competitors).
Setting up and using Messages in iCloud is a breeze. You’ll need to go through the following process on each device you want to use with the service:
You switch off this feature using the same checkboxes, when you do so you can choose to turn off Messages in iCloud for just that device or all of your devices.
Here is Apple’s tech support article concerning Messages in iCloud.
