Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Karma': A hack used by the UAE to break into iPhones of foes

reuters.com

Post reply on HN
Print view View original

61–70 of 238 posts

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#61

Post by mikejb »

x3tm wrote: post #36
java-man wrote: post #18

Earlier quoted context omitted.

physicist for president! elect Lisa Randall, or Sean Carroll. provided, of course, that they agree.

Merkel is a physicist. She's great. But then again many physicists were also convinced Nazi officers.

> But then again many physicists were also convinced Nazi officers.

If the Germans would have won the war, we'd probably celebrate those officers :/ All the torture and killing would be spun as "necessary evil" (if it even came to light), and further investigations would be blocked by the government. How we perceive the past is...complicated.

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#62

Post by bawana »

zaroth wrote: post #13

Whether or not this hack was developed with the help of Apple (a “backdoor”) or by a third-party exploit, this is exactly what a “golden key” looks like after it gets in the wild. An espionage tool developed by a major world power proliferates to totalitarian regimes, aided and operated by ex-NSA agents on the payroll, to compromise human rights activists and the political opposition. If ever there was proof that our…

Isn't the UAE muslim? Why Christmas? or is it because UAE dollars bought Christian mercenaries? We are still in the middle ages and the crusades are still raging. Time to get rid of money - or at least build walls that prevent money from crossing borders as well as criminals. We are not worthy of the the technologic advances that a few geniuses have bestowed on us.

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#63

Post by pjc50 »

FakeComments wrote: post #55
techntoke wrote: post #52

Earlier quoted context omitted.

C'mon everyone, be part of the solution like this person says. The intelligence agencies will never abuse their power. You can trust them. /s

That’s a deep straw man of what I said, to the point of being non-constructive mocking. You’re just being dishonest to claim I suggested trusting the spy agencies. Rather, I pointed out that they have a real mission, and they’re going to spend effort accomplishing it. But their mission isn’t to own every device — it’s to own a select few, probably on the order of hundreds or thousands a year. So, if we create a mecha…

I think the underlying point is "which intelligence agencies would be allowed to compromise devices like this"?

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#64

Post by FakeComments »

nothrabannosir wrote: post #58
FakeComments wrote: post #49

Earlier quoted context omitted.

I disagree with the conclusion of absolute security — it won’t happen, and only encourages subversion by people who both need and have a right to access the content. Instead of pontificating, the tech industry should innovate. There’s no reason that hashchains can’t be used to timelock the key, and the enclave export it in response to a signed request. Then we can at least force the compromises through the legal syst…

This sounds like a first order objection to a second order concern. In particular: > What’s not going to sell, and what the tech industry needs to get over is “lulz, it’ll impossible to intercept military or terrorist information because I need absolute privacy for my saucy emails” Seems to be an ironic mischaracterisation of the parent’s point, which was precisely that one coubtry’s terrorism is another’s gay rights…

> Seems to be an ironic mischaracterisation of the parent’s point, which was precisely that one coubtry’s terrorism is another’s gay rights activist or high ranking foreign official.

My point was that issues like this should be mediated by courts and existing legal systems, not the unilateral decision of technologists.

And that society is going to insist that be the case, hence the most effective way to protect those persecuted minorities is via cooperation and steering how that process happens — not fighting a losing battle.

Finally, that the way to increase the effective security is stop fighting ideological battles on the issue, and find a politically workable compromise which still prevents remote exploitation — the main danger of encryption bypasses.

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#65

Post by _mitch »

bawana wrote: post #62
zaroth wrote: post #13

Whether or not this hack was developed with the help of Apple (a “backdoor”) or by a third-party exploit, this is exactly what a “golden key” looks like after it gets in the wild. An espionage tool developed by a major world power proliferates to totalitarian regimes, aided and operated by ex-NSA agents on the payroll, to compromise human rights activists and the political opposition. If ever there was proof that our…

Isn't the UAE muslim? Why Christmas? or is it because UAE dollars bought Christian mercenaries? We are still in the middle ages and the crusades are still raging. Time to get rid of money - or at least build walls that prevent money from crossing borders as well as criminals. We are not worthy of the the technologic advances that a few geniuses have bestowed on us.

That quote is attributed to a former NSA employee. Something being "like Christmas" is a popular American phrase that doesn't indicate one's religion.

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#66

Post by syn0byte »

FakeComments wrote: post #49
zaroth wrote: post #13

Whether or not this hack was developed with the help of Apple (a “backdoor”) or by a third-party exploit, this is exactly what a “golden key” looks like after it gets in the wild. An espionage tool developed by a major world power proliferates to totalitarian regimes, aided and operated by ex-NSA agents on the payroll, to compromise human rights activists and the political opposition. If ever there was proof that our…

I disagree with the conclusion of absolute security — it won’t happen, and only encourages subversion by people who both need and have a right to access the content. Instead of pontificating, the tech industry should innovate. There’s no reason that hashchains can’t be used to timelock the key, and the enclave export it in response to a signed request. Then we can at least force the compromises through the legal syst…

Wouldn't the police have a "right" to know if a person has any weapons? Detaining everyone and performing a full cavity search for any and all infractions is just the police exercising their "right" to such information. Will you be the first to bend over and spread for the cops "right" to peace of mind?

"That it is better 100 guilty Persons should escape than that one innocent Person should suffer, is a Maxim that has been long and generally approved."

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#67

Post by brobinson »

zaroth wrote: post #10
mont wrote: post #7

Earlier quoted context omitted.

Like an exploit where all you need to do is enter the target's phone number to compromise their phone?

TFA says they need to send the target a text message. The exploit must be something like a buffer overflow in iMessage. Which we know bugs like this have been fixed. Remember the text of death which could crash any iPhone from a couple years ago?

Are you thinking of the "Stagefright" bug that did RCE via SMS on Android devices? Or maybe the Chinese censorship code that crashed iOS when people sent the Taiwanese flag emoji? 🇹🇼

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#68

Post by Ntrails »

syn0byte wrote: post #66
FakeComments wrote: post #49

Earlier quoted context omitted.

I disagree with the conclusion of absolute security — it won’t happen, and only encourages subversion by people who both need and have a right to access the content. Instead of pontificating, the tech industry should innovate. There’s no reason that hashchains can’t be used to timelock the key, and the enclave export it in response to a signed request. Then we can at least force the compromises through the legal syst…

Wouldn't the police have a "right" to know if a person has any weapons? Detaining everyone and performing a full cavity search for any and all infractions is just the police exercising their "right" to such information. Will you be the first to bend over and spread for the cops "right" to peace of mind? "That it is better 100 guilty Persons should escape than that one innocent Person should suffer, is a Maxim that ha…

>"That it is better 100 guilty Persons should escape than that one innocent Person should suffer" is a Maxim that has been long and generally approved.

It is not fundamentally true nor universally accepted. Where does the scale tip? All criminal justice systems attempt to minimise the risk - but one some level it is simply the cost of doing business. For all that it is an admirable sentiment, it is limited.

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#69

Post by sneakymichael »

neom wrote: post #6

Am I the only one who feels like every time we get news of a government compromising an iPhone through some mystical exploit, the technology around it seems very fanciful?

Bear in mind that, at one time, iOS devices could be jailbroken [to run arbitrary code] by simply opening a specifically-created PDF; https://www.wired.com/2011/07/jailbreakme-3-0-unlock-your-ip...

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#70

Post by FakeComments »

syn0byte wrote: post #66
FakeComments wrote: post #49

Earlier quoted context omitted.

I disagree with the conclusion of absolute security — it won’t happen, and only encourages subversion by people who both need and have a right to access the content. Instead of pontificating, the tech industry should innovate. There’s no reason that hashchains can’t be used to timelock the key, and the enclave export it in response to a signed request. Then we can at least force the compromises through the legal syst…

Wouldn't the police have a "right" to know if a person has any weapons? Detaining everyone and performing a full cavity search for any and all infractions is just the police exercising their "right" to such information. Will you be the first to bend over and spread for the cops "right" to peace of mind? "That it is better 100 guilty Persons should escape than that one innocent Person should suffer, is a Maxim that ha…

Uh, my proposed solution required getting a warrant to order a company to produce a device specific message which in turn could be provided via cable to the physical device, which they must also have access to, followed by spending time reversing a hash chain.

So yes, the police already have the power to search you for weapons if they have a warrant, and this is bringing the ability to search phones into line with that.

Post reply on HN