KillExchangeLocks version 3.0 Released

Posted by Dallas on November 29, 2008
Apple, Fanboy, iPhone, Jailbrake, Mac, Programming, Programs, Toolchain

With the latest iPhone firmware update (2.2), Apple fixed several “security holes”, one of which broke KillExchangeLocks version 2.0.

The fix that broke things was CVE-ID: CVE-2008-4229

Impact: Restoring a device from backup may not re-enable the Passcode Lock

Description: The Passcode Lock feature is designed to prevent applications from being launched unless the correct passcode is entered. A race condition in the handling of device settings may cause the Passcode Lock to be removed when the device is restored from backup. This may allow a person with physical access to the device to launch applications without the passcode. This update addresses the issue by improving the system’s ability to recognize missing preferences. This issue does not affect systems prior to iPhone OS 2.0 or iPhone OS for iPod touch 2.0. Credit to Nolen Scaife for reporting this issue.

http://lists.apple.com/archives/security-announce/2008/Nov/msg00002.html

The key parts here is the resoultion, “This update addresses the issue by improving the system’s ability to recognize missing preferences”, and the person to blame is Nolen Scaife for reporting this issue. :-)

KillExchangeLocks version 3 does not implement the ideal solution as Apple has done a pretty good job on their fix. Instead of removing the passcode automatically like before, instead you now force the settings app to alow you to remove the passcode, as if you had setup a passcode without using Exchange.

This still times out every 24 hours like before, as Apple is actively querying the Exchange server every 24 hours to update and/or validate the security settings.

The up side is you should only have to run this part once, and you will always be able to remove the passcode.

Version 3 gives you the option if you want to modify your Auto Lock timeout.

The problem here is that the iPhone will over write any change if you go into the Settings app and click on the General tab (which shows your timeout setting).

Therefore this could need to be reset often, if you go into Settings -> General a lot.

I added some extra Time out levels for your convience.

You can now choose between: Never, 1 min, 2 min, 3 min, 4 min, 5 min, 10 min, 15 min, 20 min, 25 min, 30 min, 35 min, 40 min, 45 min, 50 min, 55 min, and 1 hour time out levels.

As I said before, this is by no means the ideal fix, but it is the only way I have found so far, and I figure this is better then having nothing.

If you really want a better fix in place, I would ask you to think about donating to this project as that would make it easier for me to work on this project then other paying projects. It is in no way required, but welcomed. If you wish to donate you can do so using PayPal.

KillExchangeLocks is available in Cydia under Utilities.

KillExchangeLocks 3

Tags: , , , ,

10 Comments to KillExchangeLocks version 3.0 Released

Ryan
January 10, 2009

Dallas,
Your efforts here are certainly appreciated!
I have some interesting feedback on this app for you.
Before you released v3 I installed v2 on my 2.2 iPhone 3g.
It worked like a charm! Ran one and never needed it again.
I just swapped out my iPhone for the microcrack issue.
Now, installing v3 from cydia, it doesn’t work at all!
Is it possible that we have totally different exchange rstrictions?
I am happy to help you work on this one.
Cheers! (also, love the C4L link)

Ryan
January 11, 2009

Dallas,
I found an old copy of your v2.0 KillExchangeLocks, and it works just fine!
I installed it via WinSCP and OpenSSH into the /applications/ folder and rebooted (be sure to set permissions to 0777 on all files) and ran the app.

Interestingly enough, I ran the app, and it booted me back to the lockscreen, where it asked for my passcode. =[
Then, I went into settings and lo and behold, I could turn off the passcode finally!
I’ll keep you updated if this changes, but I hope this helps anyone looking to solve this problem with the *cough*N0rt3L*cough* exchange server!

M5_Traveled
January 22, 2009

Im in the same boat 3.0 is not working for me. I will try 2.0 over the weekend.

Seth
March 3, 2009

Hi,

Thanks for this, It works fine. But does it by any chance make the ‘profiles’ setting in the general settings vanish?

I just looked for it for the first time in a while and it is gone. (I have 2 certs installed from my exchange server, but now I cannot see them)

Seth
March 3, 2009

Hi,

Thanks for this, It works fine. But does it by any chance make the ‘profiles’ setting in the general settings vanish?

I just looked for it for the first time in a while and it is gone. (I have 2 certs installed from my exchange server, but now I cannot see them)

Eirik
June 19, 2009

Will this app work for OS 3.0? I’ll wait for your update before moving to OS 3.0, since this is an important app for me!

pcm2a
June 20, 2009

I have tested this on 3.0 and it is not working. I hope these great guys will find a work around for us!

Eirik
June 21, 2009

Hi,

Temporarily I’ll use the new Cydia app “Exchange Unlock” that came available in the last 24 hours. But would be nice with a new version of this app as well :-)

Dallas
June 22, 2009

A post today by TUAW (http://www.tuaw.com/2009/06/21/inside-iphone-3-0-fix-too-strict-passcode-lock-settings-for-exc/) said the following:

“A thread on the Apple discussions boards (http://discussions.apple.com/thread.jspa?threadID=2045901&start=0&tstart=0) points to the answer. Since the ActiveSync link to the Exchange server controls some security policies on the phone, you need to refresh those controls; the easiest way to do that, short of deleting and recreating the Exchange account, is to turn off all three sync modes and the Push setting. Once that’s done, you can go back to the passcode lock screen and disable the lock or adjust the timeout. Put your sync settings back the way they were and your changes to the passcode config should remain in place.”

Seth
June 22, 2009

For many people the suggestion above will not work as the exchange server will refresh the policies once a day.

Killexchangelock still worked for me in OS 3.0, but I had to run it once a day.

the new exchangeunlock available on Cydia seems to get around that somehow and is working great so far

Leave a comment

WP_Big_City

ERROR: si-captcha.php plugin says GD image support not detected in PHP!

Contact your web host and ask them why GD image support is not enabled for PHP.

ERROR: si-captcha.php plugin says imagepng function not detected in PHP!

Contact your web host and ask them why imagepng function is not enabled for PHP.