NESO Labs CEO Andreas Kurtz has revealed that email attachments within the iOS 7 MobileMail.app are not protected by Apple’s data protection mechanisms. Which is the exact opposite of what Apple claims for its iOS data protection as noted in the support page which clearly states “this provides an additional layer of protection for your email messages attachments, and third-party applications.”
Email attachments stored on Apple devices can be viewed if the file system is accessed. Most well know methods will apparently work, and no additional decryption is needed. Kurtz also managed to view the attachments by mounting the iOS data partition and simply navigating to the folder. This being said, the contents of the email themselves are encrypted and cannot be accessed.
Kurtz originally notified Apple of the issue, but decided to issue a public statement when the problem was not patched: “I reported these findings to Apple. They responded that they were aware of this issue, but did not state any date when a fix is to be expected.”
[Source: Andreas Kurtz]
