Dear Friends,

We discovered yet another privacy issue with Apple iCloud. Apparently, Apple stores iPhone call logs in iCloud without warning the user or providing an easy way to opt out. There is no option for the user to disable call log uploads without disabling iCloud Drive on their iPhone.

In turn, we made a tool for downloading synced call logs from iCloud. This new functionality is available in Elcomsoft Phone Breaker 6.20. It works whether or not the iPhone is locked, and does not require a jailbreak. All you need to download call logs from iCloud are the user's Apple ID and password or their iCloud authentication token. If you opt for the token, you can bypass two-factor authentication checks. More information is available in the official press release.

What's It All About?

Synced call logs are not something unique to Apple. However, the way Apple handles these uploads (no asking, no warning and no concise way to disable) leaves place to speculations. Why call upload is needed in addition to what's already available in iCloud backups? Is the feature designed for law enforcement? Are call logs retained on Apple's servers after the user deletes records from their devices? We don't know.

What we do know for a fact is that call logs are indeed stored on Apple's servers, and that we have a tool for extracting those logs.

Elcomsoft Phone Breaker 6.20 Extracts iPhone Call Logs

Elcomsoft Phone Breaker 6.20 comes with the ability to download synced call logs from Apple servers. Since call logs are not tied to iCloud backups and are uploaded to iCloud after only a short delay, the tool makes it possible to watch suspects' communications remotely almost in real time. Obtaining call logs requires signing in to the user's Apple account using their Apple ID and password or iCloud authentication token extracted from the user's Mac or PC.

Viewing Synced Call Logs

You'll need an updated version of Elcomsoft Phone Viewer to view synced information. We updated the Viewer with support for synced data including synced call logs; you can download the update right away.

What Else Is Synced?

Some other things like calendars, Wallet (boarding passes, payment and discount cards etc.), books, notes etc. are also synced in near real-time fashion. We are working hard on adding their extraction to the next release of Elcomsoft Phone Breaker.

iMessage Sync?

iMessages can be synced across Apple devices via Continuity. At this time, they are not extractable from iCloud. We continue investigating iMessages; please stay tuned!

Update Availability

Elcomsoft Phone Breaker 6.20 is available right away. If you have a non-expired license, you can update at no charge. If your license has already expired, please check your upgrade costs by using the "Check your license" link below.

Read our press release in: English, German, Russian.

Read our blog posts:
iPhone User? Your Calls Go to iCloud
iOS Call Syncing: How It Works

Sincerely yours,
ElcomSoft team