Apple Confirms “Back Doors”, Downplays Their Severity • Hacker News Board

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#71

Post by ZoFreX » Wed, Jul 23, 2014, 6:27 PM UTC

Alupis wrote: post #18

pessimizer wrote: post #13

Earlier quoted context omitted.

>Yet in the slides for his talk[1] under theories he writes: >"Maybe for Developers for Debugging? No." Followed by 6 bullet point reasons why this isn't a general excuse for all of the backdoors - it's mentioned in reference to all of his findings and not specifically pcapd (which is only mentioned on 2 consecutive slides out of 60, separated from this statement about debugging by 15 slides.) Your comment is far mor…

I don't own an iDevice, but Apple's nonchalant attitude regarding possible exploitable backdoors irks me.

I don't know what the situation is with Windows Mobile or any of the other mobile OS's, but with the big two it goes like this:

iOS: You get updates for your device for a decently long time after you buy it, even after new devices come out.

Android: You stop getting updates (all updates: security fixes are NOT backported) somewhere between 6 months to 2 years after getting your device, assuming it's a brand new product line. If it's not the latest and greatest there's a chance it's already out of date, and won't be receiving any updates at all. Even if you do get updates, depending on the device they may be months or even years after they are released.

So, ignoring any other mobile OS's, your choice is "a few known issues and an attitude problem" with iOS or "walking around with well publicised wide-open security vulnerabilities in your pocket" with Android.

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#72

Post by jradd » Wed, Jul 23, 2014, 6:29 PM UTC

I remember when it was trivial to examine artifacts from itunes backup until backup encryption was implemented with passphrase. (v6 I think?)

Something that still has the capabillity to bypass backup encryption sounds incredibly dangerous from my perspective.

There are plenty of legitimate concerns mentioned in his talk. I agree with the no cause for panic, but what about the fact that there are obviously services not disclosed to us, developers, users, enterprise executives relying in this for a trusted platform, etc…

The potential risk this poses (or implies) makes the lack of initial disclosure to be criminally ignorant at least. If Apple wants to balance the scale, they will need to do more than address and resolve these issues. They need to extend their transparency a smidgen. :)

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#73

Post by fyolnish » Wed, Jul 23, 2014, 6:30 PM UTC

Alupis wrote: post #38

coldtea wrote: post #27

Earlier quoted context omitted.

The fact that the other major mobile OSs gets 98% of the mobile malware (according to studies), makes this point about the "nonchalant attitude" rather week...

> The fact that the other major mobile OSs gets 98% of the mobile malware (according to studies), makes this point about the "nonchalant attitude" rather week... No it does not. It's not acceptable when any company is nonchalant about any security problem on their device, product or service. And, taking Android as an example, Google is very open about the malware and malicious app problem[1] -- and takes steps to hel…

Are you saying it has been a problem? again, this requires physical access

A Mac can be booted in single user mode if one has physical access That seems like a more serious issue.

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#74

Post by ZoFreX » Wed, Jul 23, 2014, 6:31 PM UTC

Alupis wrote: post #68

chc wrote: post #59

Earlier quoted context omitted.

That is about the browser CA system, which is a mess of questionable trust. It's not an attack that is applicable to Apple's own root certificate.

> That is about the browser CA system No, SSL certs are using to sign packages and software too. And Apple would not have a root cert, their cert would be signed by a root CA, which could be used to sign other certs if it's tricked into thinking its' Apple requesting them (like in the recent Google cert example). So one could impersonate a company if they have a cert that says they are that company.

No, it's about the browser CA system. I don't know exactly how Apple implemented their signing for iDevices, but it's a reasonable assumption that the certs need to be signed by Apple, and they didn't effectively hand the keys over to every registrar in the world.

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#75

Post by Alupis » Wed, Jul 23, 2014, 6:32 PM UTC

ZoFreX wrote: post #71

Alupis wrote: post #18

Earlier quoted context omitted.

I don't own an iDevice, but Apple's nonchalant attitude regarding possible exploitable backdoors irks me.

I don't know what the situation is with Windows Mobile or any of the other mobile OS's, but with the big two it goes like this: iOS: You get updates for your device for a decently long time after you buy it, even after new devices come out. Android: You stop getting updates (all updates: security fixes are NOT backported) somewhere between 6 months to 2 years after getting your device, assuming it's a brand new produ…

This isn't an Android vs iOS issue -- I take issue when any company ignores or brushes off a security problem.

That does not detract from the current situation at all.

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#76

Post by chc » Wed, Jul 23, 2014, 6:38 PM UTC

Alupis wrote: post #68

chc wrote: post #59

Earlier quoted context omitted.

That is about the browser CA system, which is a mess of questionable trust. It's not an attack that is applicable to Apple's own root certificate.

> That is about the browser CA system No, SSL certs are using to sign packages and software too. And Apple would not have a root cert, their cert would be signed by a root CA, which could be used to sign other certs if it's tricked into thinking its' Apple requesting them (like in the recent Google cert example). So one could impersonate a company if they have a cert that says they are that company.

You are conflating the CA system traditionally used on the Web with SSL itself. Apple does not depend on other certificate authorities to sign its software. Anybody can create their own root CA — it just won't be trusted by browsers out of the box.

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#77

Post by Alupis » Wed, Jul 23, 2014, 6:41 PM UTC

fyolnish wrote: post #73

Alupis wrote: post #38

Earlier quoted context omitted.

> The fact that the other major mobile OSs gets 98% of the mobile malware (according to studies), makes this point about the "nonchalant attitude" rather week... No it does not. It's not acceptable when any company is nonchalant about any security problem on their device, product or service. And, taking Android as an example, Google is very open about the malware and malicious app problem[1] -- and takes steps to hel…

Are you saying it has been a problem? again, this requires physical access A Mac can be booted in single user mode if one has physical access That seems like a more serious issue.

> again, this requires physical access

The only physical access that is required is for the user to pair with a/some pc -- which then said pc can be used as a vehicle for attack...

Other users in this thread have mentioned airport USB chargers wanting to pair with their iDevice, etc.

That's not very far-fetched really...

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#78

Post by Alupis » Wed, Jul 23, 2014, 6:50 PM UTC

ZoFreX wrote: post #74

Alupis wrote: post #68

Earlier quoted context omitted.

> That is about the browser CA system No, SSL certs are using to sign packages and software too. And Apple would not have a root cert, their cert would be signed by a root CA, which could be used to sign other certs if it's tricked into thinking its' Apple requesting them (like in the recent Google cert example). So one could impersonate a company if they have a cert that says they are that company.

No, it's about the browser CA system. I don't know exactly how Apple implemented their signing for iDevices, but it's a reasonable assumption that the certs need to be signed by Apple, and they didn't effectively hand the keys over to every registrar in the world.

http://en.wikipedia.org/wiki/Code_signing

They are likely using a plain-old SSL Cert signed by a plain-old public CA, which is how your computer would know if the executable appears to come from Apple or not.

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#79

Post by ZoFreX » Wed, Jul 23, 2014, 6:52 PM UTC

Alupis wrote: post #75

ZoFreX wrote: post #71

Earlier quoted context omitted.

I don't know what the situation is with Windows Mobile or any of the other mobile OS's, but with the big two it goes like this: iOS: You get updates for your device for a decently long time after you buy it, even after new devices come out. Android: You stop getting updates (all updates: security fixes are NOT backported) somewhere between 6 months to 2 years after getting your device, assuming it's a brand new produ…

This isn't an Android vs iOS issue -- I take issue when any company ignores or brushes off a security problem. That does not detract from the current situation at all.

What I wanted to highlight is that the "big picture" of security with Apple is one of taking things seriously, not ignoring or brushing things off.

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#80

Post by alain94040 » Wed, Jul 23, 2014, 7:15 PM UTC

criley2 wrote: post #12

bcohen5055 wrote: post #10

Earlier quoted context omitted.

"back doors" that require approval from the user on the phone..??

Backdoors that require the user to unlock their device and have paired with a PC in the past. If a paired PC is compromised (a trivial task for a sophisticated hacker or the NSA, if the millions of windows pc bot nets are evidence), and wifi sync is enabled, and the device is unlocked and in use, then the compromised PC could theoretically harvest personal information from the device without any warning or notificati…

If a paired PC is compromised

Guess what. If you hacked into my Mac, then yes, you can see my pictures in iPhoto. As my iPhone keeps syncing to the Mac, yes, you'll be able to see the pictures from my phone. But you'll also be able to view my emails (from Mail on the Mac), all my documents, and install a key logger on my Mac and steal my bank credentials.