Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple loses copyright battle against security startup Corellium

washingtonpost.com

Post reply on HN
Print view View original

11–20 of 64 posts

Re: Apple loses copyright battle against security startup Corellium

#11

Post by CamJN »

g_p wrote: post #10
viro wrote: post #9

Earlier quoted context omitted.

Isn't the issues that Corellium allows you to side step the passcode brute force lockout? aka...... https://www.aclu.org/news/privacy-technology/the-fbi-is-secr...

Not really, by my understanding. Corellium is effectively providing a hosted virtual machine, presumably running on their own custom hypervisor, with their own management stack to give a convenient user experience. You "spin up" VM-based instances of emulated devices (i.e. booting an emulator from a filesystem image), and can then research vulnerabilities and explore, and downgrade/upgrade iOS versions rapidly, like…

> Real devices are fused to prevent downgrades.

Not quite, to install a version of iOS it must be signed by Apple, and Apple stops signing old versions soon after releasing a new one. Further you need to put the phone in recovery mode to install a lower version because the UI simply won't do it.

You may be thinking of game consoles, which use fuses to prevent downgrades.

Re: Apple loses copyright battle against security startup Corellium

#12

Post by ajconway »

viro wrote: post #9
Simulacra wrote: post #8

A small victory for the little guy.

Isn't the issues that Corellium allows you to side step the passcode brute force lockout? aka...... https://www.aclu.org/news/privacy-technology/the-fbi-is-secr...

Actually, it can be used to prevent that from happening in the future through facilitating security research that is not restricted to Apple-approved parties.

Re: Apple loses copyright battle against security startup Corellium

#13

Post by g_p »

CamJN wrote: post #11
g_p wrote: post #10

Earlier quoted context omitted.

Not really, by my understanding. Corellium is effectively providing a hosted virtual machine, presumably running on their own custom hypervisor, with their own management stack to give a convenient user experience. You "spin up" VM-based instances of emulated devices (i.e. booting an emulator from a filesystem image), and can then research vulnerabilities and explore, and downgrade/upgrade iOS versions rapidly, like…

> Real devices are fused to prevent downgrades. Not quite, to install a version of iOS it must be signed by Apple, and Apple stops signing old versions soon after releasing a new one. Further you need to put the phone in recovery mode to install a lower version because the UI simply won't do it. You may be thinking of game consoles, which use fuses to prevent downgrades.

Thanks, I was thinking of the server-side AP Token system (i.e. the signed per-device authentication tags that confirm the firmware is up to date and able to be installed), but then ended up describing the Nintendo Switch fuse system.

Indeed, in the past I believe people have used SHSH blobs to successfully downgrade, and also if Apple misconfigured their signing server to approve older versions, people have successfully downgraded during the window created due to the misconfiguration.

Re: Apple loses copyright battle against security startup Corellium

#14

Post by _qcti »

smoldesu wrote: post #5
rvz wrote: post #2

This is huge. But it's not over yet. Hope Corellium is ready for Round 2.

What is this supposed to mean? If Apple even tries touching them again, the courts will probably toss out their hearing for fear of double jeopardy. Apple will do the same thing it's always done, which is wince and smile for the camera. Apple might hate emulation of iOS, but they hate controversy even more.

> they hate controversy even more.

Did you come from the Berenstein Bears universe? Apple does unpopular things constantly. The iPhone 12 doesn't come with a charger, and you think they're terrified of controversy?

Apple's MO is to double down on controversy.

Re: Apple loses copyright battle against security startup Corellium

#17

Post by nirushiv »

On the surface, this is an easy case for Apple. Their argument is simple: iOS is not a licensed product like Windows. You can’t run it - virtualized or not - without Apple’s permission. I do think Apple will win the follow up appeal.

For even a billion dollar company (let alone a 2 trillion dollar company), their legal team has had some surprisingly bad failings.

I recall another “cupcake” case they lost a few years ago because they walked into the courtroom without sufficient evidence (despite it being clear the other party was a copyright-infringing troll) and lost the ruling. Once a legal team starts taking things for granted, it’s time to find a new one.

Re: Apple loses copyright battle against security startup Corellium

#18

Post by zorgmonkey »

viro wrote: post #9
Simulacra wrote: post #8

A small victory for the little guy.

Isn't the issues that Corellium allows you to side step the passcode brute force lockout? aka...... https://www.aclu.org/news/privacy-technology/the-fbi-is-secr...

It is much more likely that this is based on the secure enclave vulnerability that was found earlier this year and affects devices with a A7 through A11 chip.

Re: Apple loses copyright battle against security startup Corellium

#19

Post by enos_feedler »

_qcti wrote: post #14
smoldesu wrote: post #5

Earlier quoted context omitted.

What is this supposed to mean? If Apple even tries touching them again, the courts will probably toss out their hearing for fear of double jeopardy. Apple will do the same thing it's always done, which is wince and smile for the camera. Apple might hate emulation of iOS, but they hate controversy even more.

> they hate controversy even more. Did you come from the Berenstein Bears universe? Apple does unpopular things constantly. The iPhone 12 doesn't come with a charger, and you think they're terrified of controversy? Apple's MO is to double down on controversy.

I don’t think its to double down on controversy but to not be afraid to make product changes they believe in despite the predictable ensuing controversy.

Re: Apple loses copyright battle against security startup Corellium

#20

Post by wmf »

nirushiv wrote: post #17

On the surface, this is an easy case for Apple. Their argument is simple: iOS is not a licensed product like Windows. You can’t run it - virtualized or not - without Apple’s permission. I do think Apple will win the follow up appeal. For even a billion dollar company (let alone a 2 trillion dollar company), their legal team has had some surprisingly bad failings. I recall another “cupcake” case they lost a few years…

But what about fair use? That's the argument Corellium used.
Post reply on HN