Private Photo Vault: Not So Private

One of the most popular App Store applications, Private Photo Vault (Ultimate Photo+Video Manager) claims over 3 million users, and that your photos are “100% private”. The application, however, stores its data files without using any additional protection or encryption than any other files stored on the iPhone. With access to an unlocked device, a pair record from a seized desktop machine, or possibly even just a copy of a desktop or iCloud backup, all of the user’s stored images and video can be recovered and read in cleartext.

I’ve consulted on a few different criminal cases where this application was used by a suspect to hide content. Using the methods stated above, it’s trivial for any capable law enforcement forensics software to recover these images (unencrypted) from a device, if the device is unlocked, or if the suspect gives their PIN, or if the suspect’s desktop machine is seized and a pair record or backup is recovered. Keep in mind that, since forensics software can do it, this also means any decent criminal hacker worth his salt can do it as well. If you are trusting your private images to this application, you are potentially at risk.

Note that this application has stored files in this fashion for years. I thought I’d re-download it and see if they’ve changed anything, but apparently this is not the case. It took all of five minutes to perform a forensic recovery of the data inside this app container on a locked phone using a pair record from a “seized” desktop. It can also be dumped easily from an unlocked device, or a device that I’ve watched you type your PIN into, etc. The application, in my opinion, offers no practical protection or technical means of privacy beyond any other file on your iPhone.

This is just one of many examples of security applications in the App Store that do not appear to do what they advertise, or at least do it in any meaningful and secure fashion. Until Apple performs any kind of testing of apps such as this (and removes those that do not provide the protection they claim), you’ll need to be very careful what applications you choose to trust your content to.