Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security research on Private Cloud Compute

security.apple.com

Post reply on HN
Print view View original

61–70 of 124 posts

Re: Security research on Private Cloud Compute

#61

Post by azinman2 »

threeseed wrote: post #38
mmastrac wrote: post #5

I feel like this is all smoke and mirrors to redirect from the likelihood intentional silicon backdoors that are effectively undetectable. Without open silicon, there's no way to detect that -- say -- when registers r0-rN are set to values [A, ..., N] and a jump to address 0xCONSTANT occurs, additional access is granted to a monitor process. Of course, this limits the potential attackers to 1) exactly one government…

You have to be serious here. The level of conspiracy needed to keep something like this a secret would be unprecedented. And if Apple was able to do that why wouldn't they just backdoor iOS/OSX instead of baking it into the hardware.

Or just not make any hardware promises, and do it like iCloud or OpenAI or Gemini or any other cloud product.

Re: Security research on Private Cloud Compute

#62

Post by ls612 »

astrange wrote: post #56
gigel82 wrote: post #29

No amount of remote attestation and "transparency logs" and other bombastic statements like this would make up for the fact that they are fully in control of the servers and the software. There is absolutely no way for a customer to verify their claims that the data is not saved or transferred elsewhere. So unless they offer a way for us to run the "cloud services" on our own hardware where we can strictly monitor an…

> There is absolutely no way for a customer to verify their claims that the data is not saved or transferred elsewhere. Transparency logs are capable of verifying that, it's more or less the whole point of them. (Strictly speaking, you can make it arbitrarily expensive to fake it.) Also, if they were "transferring your data elsewhere" it would be a GDPR violation. Ironically wrt your China claim, it would also be ill…

Are transparency logs akin to Certificate Transparency but for signed code? I’ve read through the section a couple times and still don’t fully understand it.

Re: Security research on Private Cloud Compute

#63

Post by gigel82 »

astrange wrote: post #56
gigel82 wrote: post #29

No amount of remote attestation and "transparency logs" and other bombastic statements like this would make up for the fact that they are fully in control of the servers and the software. There is absolutely no way for a customer to verify their claims that the data is not saved or transferred elsewhere. So unless they offer a way for us to run the "cloud services" on our own hardware where we can strictly monitor an…

> There is absolutely no way for a customer to verify their claims that the data is not saved or transferred elsewhere. Transparency logs are capable of verifying that, it's more or less the whole point of them. (Strictly speaking, you can make it arbitrarily expensive to fake it.) Also, if they were "transferring your data elsewhere" it would be a GDPR violation. Ironically wrt your China claim, it would also be ill…

That makes no sense at all. They control the servers and services entirely; they can choose to emit whatever logs they want into the "transparent logs" and then emit whatever else they don't want into non-transparent logs.

Even if they were running open source software with cryptographically verified / reproducible builds, it's still running on their hardware (any component or the OS / kernel or even hardware can be hooked into to exfiltrate unencrypted data).

Companies like Apple don't give a crap about GDPR violations (you can look at their "DMA compliance" BS games to see to what extent they're willing to go to skirt regulations in the name of profit).

Re: Security research on Private Cloud Compute

#64

Post by davidczech »

gigel82 wrote: post #63
astrange wrote: post #56

Earlier quoted context omitted.

> There is absolutely no way for a customer to verify their claims that the data is not saved or transferred elsewhere. Transparency logs are capable of verifying that, it's more or less the whole point of them. (Strictly speaking, you can make it arbitrarily expensive to fake it.) Also, if they were "transferring your data elsewhere" it would be a GDPR violation. Ironically wrt your China claim, it would also be ill…

That makes no sense at all. They control the servers and services entirely; they can choose to emit whatever logs they want into the "transparent logs" and then emit whatever else they don't want into non-transparent logs. Even if they were running open source software with cryptographically verified / reproducible builds, it's still running on their hardware (any component or the OS / kernel or even hardware can be…

> they can choose to emit whatever logs they want into the "transparent logs" and then emit whatever else they don't want into non-transparent logs.

The log is publicly accessible and append-only, so such an event would not go un-noticed. Not sure what a non-transparent log is.

Re: Security research on Private Cloud Compute

#65

Post by astrange »

gigel82 wrote: post #63
astrange wrote: post #56

Earlier quoted context omitted.

> There is absolutely no way for a customer to verify their claims that the data is not saved or transferred elsewhere. Transparency logs are capable of verifying that, it's more or less the whole point of them. (Strictly speaking, you can make it arbitrarily expensive to fake it.) Also, if they were "transferring your data elsewhere" it would be a GDPR violation. Ironically wrt your China claim, it would also be ill…

That makes no sense at all. They control the servers and services entirely; they can choose to emit whatever logs they want into the "transparent logs" and then emit whatever else they don't want into non-transparent logs. Even if they were running open source software with cryptographically verified / reproducible builds, it's still running on their hardware (any component or the OS / kernel or even hardware can be…

> They control the servers and services entirely

There's a key signing ceremony with a third-party auditor watching; it seems to rely on trusting them together with the secure boot process. But there are other things you can add to this, basically along the lines of making the machine continually prove that it behaves like the system described in the log.

They don't control all of the service though; part of the system is that the server can't identify the user because everything goes through third party proxies owned by several different companies.

> Companies like Apple don't give a crap about GDPR violations

GDPR fines are 4% of the company's yearly global revenue. If you're a cold logical profit maximizer, you're going to care about that a lot!

Beyond that, they've published a document saying all this stuff, which means you can sue them for securities fraud if it turns out to be a lie. It's illegal for US companies to lie to their shareholders.

Re: Security research on Private Cloud Compute

#67

Post by gigel82 »

davidczech wrote: post #64
gigel82 wrote: post #63

Earlier quoted context omitted.

That makes no sense at all. They control the servers and services entirely; they can choose to emit whatever logs they want into the "transparent logs" and then emit whatever else they don't want into non-transparent logs. Even if they were running open source software with cryptographically verified / reproducible builds, it's still running on their hardware (any component or the OS / kernel or even hardware can be…

> they can choose to emit whatever logs they want into the "transparent logs" and then emit whatever else they don't want into non-transparent logs. The log is publicly accessible and append-only, so such an event would not go un-noticed. Not sure what a non-transparent log is.

Ok, but they write and fully control the closed-source software that appends to the log. How can anyone verify that all the code paths append to the log? I'm pretty sure they can just not append to the log from their ExfiltrateDataForAdvertisment() and ExfiltrateDataForGovernments() functions.

Maybe I'm not being clear; transparent logs solve the problem of supply chain attacks (that is, Apple can use the logs to some degree to ensure some 3rd party isn't modifying their code), but I'm trying to say Apple themselves ARE the bad actor, they will exfiltrate customer data for their own profit (to personalize ads, or continue building user profiles, or sell to governments and so on).

Re: Security research on Private Cloud Compute

#68

Post by axoltl »

ram_rattle wrote: post #66

Something similar published by samsung, but sad that they are not as agile as apple in this area https://research.samsung.com/blog/The-Next-New-Normal-in-Com...

This doesn't look to be the same. Apple's talking about performing computation in their cloud in a secure, privacy-preserving fashion. Samsung's paper seems to be just on local enclaves (which Apple's also been doing since iPhone 5S in the form of the Secure Enclave Processor (SEP)).

Re: Security research on Private Cloud Compute

#69

Post by gigel82 »

astrange wrote: post #65
gigel82 wrote: post #63

Earlier quoted context omitted.

That makes no sense at all. They control the servers and services entirely; they can choose to emit whatever logs they want into the "transparent logs" and then emit whatever else they don't want into non-transparent logs. Even if they were running open source software with cryptographically verified / reproducible builds, it's still running on their hardware (any component or the OS / kernel or even hardware can be…

> They control the servers and services entirely There's a key signing ceremony with a third-party auditor watching; it seems to rely on trusting them together with the secure boot process. But there are other things you can add to this, basically along the lines of making the machine continually prove that it behaves like the system described in the log. They don't control all of the service though; part of the syst…

"ceremony" is a good choice of word; it's all ceremonial and nonsense; as long as they control the hardware and the software there is absolutely no way for someone to verify this claim.

Apple has lied to shareholders before, remember those "what happens on your iPhone, stays on your iPhone" billboards back in the day they used to fool everyone into thinking Apple cares about privacy? A couple years later, they were proudly announcing how everyone's iPhone will scan their files and literally send them to law enforcement if they match some opaque government-controlled database of hashes (yes, they backed out of that plan eventually, but not before massive public outcry and going through a few "you're holding it wrong" explanations).

Re: Security research on Private Cloud Compute

#70

Post by davidczech »

gigel82 wrote: post #67
davidczech wrote: post #64

Earlier quoted context omitted.

> they can choose to emit whatever logs they want into the "transparent logs" and then emit whatever else they don't want into non-transparent logs. The log is publicly accessible and append-only, so such an event would not go un-noticed. Not sure what a non-transparent log is.

Ok, but they write and fully control the closed-source software that appends to the log. How can anyone verify that all the code paths append to the log? I'm pretty sure they can just not append to the log from their ExfiltrateDataForAdvertisment() and ExfiltrateDataForGovernments() functions. Maybe I'm not being clear; transparent logs solve the problem of supply chain attacks (that is, Apple can use the logs to som…

> How can anyone verify that all the code paths append to the log? I'm pretty sure they can just not append to the log from their ExfiltrateDataForAdvertisment() and ExfiltrateDataForGovernments() functions.

I think we have different understandings of what the transparency log is utilized for.

The log is used effectively as an append-only hash set of trusted software hashes a PCC node is allowed to run, accomplished using Merkle Trees. The client device (iPhone) uses the log to determine if the software measurements from an attestation should be rejected or not.

https://security.apple.com/documentation/private-cloud-compu...

Post reply on HN