A remote wipe is the only way to protecting your iPhone data if the phone falls into the hands of a thief or is lost, according to research from Germany's Fraunhofer Institute for Secure Information Technology.

The current operating system, iOS 4.2.1, offers a password protection feature. But that password doesn't offer any security against certain kinds of attack, which the Fraunhofer team used to access the keychain on the phone.

The keychain stores passwords to various apps and networks. It offers a certain amount of convenience -- when a user boots up the phone it can connect to the email client, for example, and to a local Wi-Fi network. But the down side is that by storing that information on the phone, it leaves it open to being found and decoded. The paper by the Fraunhofer team notes that the keychain data doesn't depend on the passcode that a user enters.

When someone finds or steals an iPhone, they can prevent a remote wipe by simply taking out the SIM card. This issue doesn't exist on the new Verizon iPhone, as it uses a CDMA network and doesn't have such a card, so it is slightly less vulnerable. But for those iPhones on GSM networks - basically anyone using AT&T in the U.S. or most carriers overseas - removing the SIM card would give a hacker time to hook up the iPhone to a PC.

Once hooked up, the device can be jailbroken using several widely available tools, and a script can be run that uses some of the iPhone's own system functions to decrypt passwords in the keychain.The whole process takes about six minutes.

While not every password is decrypted - web site accounts were generally not - the passwords to Wi-Fi networks the phone has accessed previously, and the virtual private networks the phone has access to, were visible. Access to a VPN can mean that a hacker or thief now has access to the iPhone owner's computer, from any location.

Jens Heider, a security researcher at Fraunhofer and one of the paper's authors, said there will always be a trade-off between convenience and security. But a simple fix would be making the security settings more adjustable. For example, one could allow the user to change the settings on Wi-Fi access, so that it would prompt for a passcode when the phone boots up. (This is similar to the way it works on a Mac computer or PC).

The simplest way to protect oneself, Heider said, is to immediately get to a computer terminal if your iPhone is lost or stolen, and do a remote wipe. Next, change the passwords that could be stored on the iPhone. He said he told Apple about the exploit. Apple did not respond to requests for comment.

Heider added that iPhones aren't unique in this respect. Other mobile operating systems, such as Android, have problems too.

In the case of Android systems, there hasn't been the work on security yet as it hasn't been widely adopted by enterprises. That could change as time passes and more businesses use Android-based devices. Perhaps the least vulnerable is the BlackBerry OS, but that has been in the enterprise market for a long time and Research In Motion has developed a lot of expertise.

Iphone ITunes Ios Iphone