Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The NSA Reportedly Has Total Access To The Apple iPhone

forbes.com

Post reply on HN
Print view View original

81–90 of 212 posts

Re: The NSA Reportedly Has Total Access To The Apple iPhone

#81

Post by sigsergv »

jonahx wrote: post #76
wyager wrote: post #27

Earlier quoted context omitted.

I like the idea. I would donate towards a more secure AOSP. Unfortunately, no matter how much you sure up your phone's OS, there is still a massive, gaping hole in the form of the baseband processor. Until we have phones where the baseband is a tightly regulated slave processor, accessible only through a low-privelege mechanism (like a USB port), we can't really hope to have truly secure phones anyway.

Could you elaborate on this? -- I don't know anything about the issues of baseband processors on mobile phones (or even what they are) but it sounds interesting.

It's a good place to start: http://readwrite.com/2011/01/18/baseband_hacking_a_new_front...

Re: The NSA Reportedly Has Total Access To The Apple iPhone

#82

Post by RyanZAG »

Aren't we missing a critical point here??

> "The initial release of DROPOUTJEEP will focus on installing the implant via closed access methods." [2007]

OK, we knew this much already. I remember seeing a number of stories on how law enforcement can pull data off an iPhone, etc. Not really much new here.

> "A remote installation capability will be pursued for a future release"

Here is the interesting bit. You don't put this in a document unless you have a good plan on how to do it. Obviously with iOS devices having ports closed and being behind NAT, the NSA can't exploit them remotely. However, the NSA is pretty clear that it will have the capability in the future. Note the date on this - 2007.

Since 2007, what has changed? iCloud allows Apple to install and run code directly on your device remotely. Is there any doubt that the NSA would request Apple give them full access to iCloud? So the real issue here is what that last little line hints at: the NSA was looking to get remote access rights to all iPhones back in 2007 and with the knowledge now that they will happily backdoor AT&T/Google/Microsoft to retrieve data, is there any doubt they are now using iCloud to gain remote access to all iPhones?

I'm sure NSA/Google does the same with Google Play Services.

Re: The NSA Reportedly Has Total Access To The Apple iPhone

#83

Post by andr »

I really see this working remotely, as long as you have control over a cell phone tower or you use a phony portable base station, both of which are within the NSA's reach.

The thing is phone baseband software (which is reused on different phone models and controls the phone's I/O including GSM, USB, etc.) has hardly ever been under attack. When the iPhone arrived with its new security model, baseband bugs became one of the major ways to jailbreak a phone. Those bugs have been fixed one by one, but they were mostly on the USB side - the GSM side has been impractical to attack. A carefully crafted GSM packet could in 2008 and probably could now cause a buffer overflow in the baseband and gain access.

An interesting presentation on the topic: http://www.youtube.com/watch?v=fQqv0v14KKY

Re: The NSA Reportedly Has Total Access To The Apple iPhone

#84

Post by brudgers »

roin wrote: post #32

Not only is the slide from 2008, but it also says it requires "close access methods" and "remote installation will be pursued for a future release." In other words, they need physical access to your device. If we think that the NSA can't compromise a device after gaining physical access, well then I think we should be scared about the competence of the NSA. I don't have the patience to watch Appelbaum's hour long tal…

Close access includes the assembly line, and that would be the preferred option for an intelligence organ seeking access to a consumer device - it scales well. Given the logistics of the electronics industry, there are many potential vectors to introduce the exploit unilaterally, though working cooperatively with Korean or Taiwanese agencies is possible given shared interests and those country's roles in component manufacturing. Of course with their own chip design arm, going directly through Apple is a more obvious choice.

Re: The NSA Reportedly Has Total Access To The Apple iPhone

#86

Post by PavlovsCat »

wyager wrote: post #11

This is from a very old version of iOS (2007). We don't know if this is still true. Regardless, I can say for a fact that there are exploits for all cell phone platforms. iOS exploits are by far the hardest to find. An iOS remote execution 0day will easily fetch $250k. I've seen one go for $600k. For an Android remote exec 0day, you're looking at closer to $50k. Even if the NSA doesn't have these on hand, they can ce…

> This is from a very old version of iOS (2007). We don't know if this is still true.

According to this the NSA itself claims that it has access to all iOS devices:

https://www.youtube.com/watch?v=b0w36GAyZIA&t=44m32s (Jacob Applebaum @ 30c3, "To Protect And Infect, Part 2")

Re: The NSA Reportedly Has Total Access To The Apple iPhone

#87

Post by PavlovsCat »

allochthon wrote: post #38
blake8086 wrote: post #22

Earlier quoted context omitted.

Hey, can you post your email username/password here so we can all read your mail?

I worry about random people on the Internet having access to my information about 1000 times more than I do the NSA.

a.) the way the NSA seems to foster security flaws to use them, instead of helping fix them, they are also helping "random people" get access to your data. A backdoor put there by the NSA can be used by anyone else, in theory.

b.) what you personally do not worry about is not relevant, your arguments why nobody else should worry either are. You are not a journalist or activist, so you don't care. It's like saying it's okay that certain food contents are not labelled for the benefit of those having allergies against them, or that kids should be used as bio fuel, because you don't have an allergy or kids.

Re: The NSA Reportedly Has Total Access To The Apple iPhone

#88

Post by girvo »

alan_cx wrote: post #39
girvo wrote: post #24

Earlier quoted context omitted.

Fair enough. I do care. So, which of us matters more?

The majority. Which, as it turns out, I don't think is you or me.

Unfortunately, I think you're spot on there. Now, the question becomes whether that can be changed, and how?

Re: The NSA Reportedly Has Total Access To The Apple iPhone

#90

Post by f_salmon »

I have an iPhone.

And when I read that the US government tracks mobile phone movements all over the world (generating a ton of other information about people), I turned it off permanently (flight mode) and use it only as a PDA.

Turns out, landline phones combined with email is more than one needs.

If I wouldn't have stopped using the "mobile call feature", my iPhone would have gone straight to ebay, right now.

Post reply on HN