Apple is aware of iOS 7 mail attachment bug, working on a fix
A bug has been discovered in iOS 7 that causes email attachments to not be encrypted. Before anyone panics, however, in order for an attacker to exploit the bug they'd need to a) steal your device and, b) …
Context & Ripple Effects
Security researcher Andreas Kurtz disclosed that iOS 7 stores email attachments unencrypted at rest even when Data Protection is switched on, a finding picked up the same day by ZDNet, MacRumors, AppleInsider, The Hacker News and at least four other outlets. Apple has now acknowledged the report and says a fix is in progress.
The disclosure lands two months after Apple's 'Gotofail' SSL flaw was shown to extend beyond Safari into Mail, iMessage, Facetime and Twitter — so this is the second mail-adjacent encryption failure at Apple in a single quarter, arriving amid post-Snowden scrutiny of vendor encryption claims.
First-order effects
- Enterprise and government users who rely on iOS Data Protection to satisfy compliance requirements have no assurance their attachments are encrypted on lost or stolen devices until Apple ships the promised fix.
Second-order effects
- Rival mobile platforms can pitch hardware-level encryption against iOS's now-demonstrated gap in BYOD evaluations, and Apple faces pressure to shorten its patch cycle after back-to-back crypto bugs.
Third-order effects
- If researcher disclosures keep outpacing Apple's own QA, 'encryption on by default' marketing will need independent audit to be believed — shifting security assurance from vendor claims toward third-party verification of device-at-rest behavior.
The trend: Consumer platform encryption claims are being stress-tested by independent researchers in the wake of Snowden-era surveillance revelations, forcing vendors like Apple into reactive patch-and-confirm cycles.