{"action":"created","issue":{"url":"https://api.github.com/repos/MiniKeePass/MiniKeePass/issues/323","labels_url":"https://api.github.com/repos/MiniKeePass/MiniKeePass/issues/323/labels{/name}","comments_url":"https://api.github.com/repos/MiniKeePass/MiniKeePass/issues/323/comments","events_url":"https://api.github.com/repos/MiniKeePass/MiniKeePass/issues/323/events","html_url":"https://github.com/MiniKeePass/MiniKeePass/issues/323","id":43215676,"number":323,"title":"PIN + Remember Database Passwords vulnerability","user":{"login":"jonnieZG","id":8830300,"avatar_url":"https://avatars.githubusercontent.com/u/8830300?v=3","gravatar_id":"","url":"https://api.github.com/users/jonnieZG","html_url":"https://github.com/jonnieZG","followers_url":"https://api.github.com/users/jonnieZG/followers","following_url":"https://api.github.com/users/jonnieZG/following{/other_user}","gists_url":"https://api.github.com/users/jonnieZG/gists{/gist_id}","starred_url":"https://api.github.com/users/jonnieZG/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonnieZG/subscriptions","organizations_url":"https://api.github.com/users/jonnieZG/orgs","repos_url":"https://api.github.com/users/jonnieZG/repos","events_url":"https://api.github.com/users/jonnieZG/events{/privacy}","received_events_url":"https://api.github.com/users/jonnieZG/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2014-09-19T08:24:11Z","updated_at":"2015-01-22T21:26:57Z","closed_at":null,"body":"Hi everyone!\r\n\r\nIf a user has chosen the \"PIN Enabled\" and \"Remember Database Passwords\" options, there is an easy way to open all the stored databases by anyone who gains access to the iPhone filesystem (jailbreaked or not) without any further verifications.\r\n\r\nRequired Tools: iFunBox, a text file editor, Mac or PC, USB iPhone cable\r\n\r\nSteps to reproduce:\r\n\r\n1. Set \"PIN Enabled\" and \"Remember Database Passwords\" options in settings.\r\n2. Open a database, enter the password.\r\n3. Exit the application by completely removing it from the tasks list. It must not remain in the background.\r\n\r\nHacking:\r\n4. Connect iPhone with a cable and access the file system using iFunBox application.\r\n5. Go to /User Applications/MiniKeePass/Library/Preferences, edit the com.jflan.MiniKeePass.plist to replace pinEnabled=true with pinEnabled=false setting.\r\n6. Start the MiniKeePass application and it will just any database with a stored password, without asking you for a PIN.\r\n\r\nOne of the solutions is to digitally sign the plist file with a secret key stored in the keystore and to verify the settings each time after loading. If the file was tempered with, the application should wipe all the loaded settings, keys and user data - as if it was installed for the first time. An automatic email notification to the owner would also be nice to have.\r\n\r\nRegards,\r\nJonnie"},"comment":{"url":"https://api.github.com/repos/MiniKeePass/MiniKeePass/issues/comments/71102174","html_url":"https://github.com/MiniKeePass/MiniKeePass/issues/323#issuecomment-71102174","issue_url":"https://api.github.com/repos/MiniKeePass/MiniKeePass/issues/323","id":71102174,"user":{"login":"ittaiz","id":1378327,"avatar_url":"https://avatars.githubusercontent.com/u/1378327?v=3","gravatar_id":"","url":"https://api.github.com/users/ittaiz","html_url":"https://github.com/ittaiz","followers_url":"https://api.github.com/users/ittaiz/followers","following_url":"https://api.github.com/users/ittaiz/following{/other_user}","gists_url":"https://api.github.com/users/ittaiz/gists{/gist_id}","starred_url":"https://api.github.com/users/ittaiz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ittaiz/subscriptions","organizations_url":"https://api.github.com/users/ittaiz/orgs","repos_url":"https://api.github.com/users/ittaiz/repos","events_url":"https://api.github.com/users/ittaiz/events{/privacy}","received_events_url":"https://api.github.com/users/ittaiz/received_events","type":"User","site_admin":false},"created_at":"2015-01-22T21:26:57Z","updated_at":"2015-01-22T21:26:57Z","body":"@jonnieZG Does this reproduce if you have both PIN disabled and Remember disabled?"}}