Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Confirms “Back Doors”, Downplays Their Severity

zdziarski.com

Post reply on HN
Print view View original

81–90 of 114 posts

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#81

Post by josho »

aktau wrote: post #33
fredsted wrote: post #29

I'm a little conflicted about this. On one hand it's good to learn about the security of your device, on the other hand he's far too partial and sensationalist about these iOS features. Yes, features. • It's good to know packet capture can be remotely enabled on your device from data collected on a computer the device has trusted. • It's good to know Apple has the power to look through your encrypted files given phys…

> It's good to know Apple has the power to look through your encrypted files given physical access (file relay). So the requisites are: "be Apple" and "have physical access"? That's awfully little for what's supposed to be encrypted files. It (seems to be) no secret that law enforcement sends devices to Apple when they can't handle them themselves. So if I'm understanding it right: you can't protect yourself with an…

What is the threat model that concerns you? If you don't trust Apple then don't use iOS full stop.

I trust Apple engineers, but not Apple Store employees. So, for me the question to ask is what effort is required to circumvent the system. If any employee at an Apple Store can circumvent your encryption then that is an issue. If circumventing requires your passcode, then that's far less concerning.

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#82

Post by josho »

Alupis wrote: post #77
fyolnish wrote: post #73

Earlier quoted context omitted.

Are you saying it has been a problem? again, this requires physical access A Mac can be booted in single user mode if one has physical access That seems like a more serious issue.

> again, this requires physical access The only physical access that is required is for the user to pair with a/some pc -- which then said pc can be used as a vehicle for attack... Other users in this thread have mentioned airport USB chargers wanting to pair with their iDevice, etc. That's not very far-fetched really...

I thought this required me to unlock my phone and say 'I trust this computer' before anything else could happen, are you saying that is not the case?

I'll yield to the fact that I cannot remove trust from a computer, that seems like a now obvious shortcoming.

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#83

Post by Alupis »

josho wrote: post #82
Alupis wrote: post #77

Earlier quoted context omitted.

> again, this requires physical access The only physical access that is required is for the user to pair with a/some pc -- which then said pc can be used as a vehicle for attack... Other users in this thread have mentioned airport USB chargers wanting to pair with their iDevice, etc. That's not very far-fetched really...

I thought this required me to unlock my phone and say 'I trust this computer' before anything else could happen, are you saying that is not the case? I'll yield to the fact that I cannot remove trust from a computer, that seems like a now obvious shortcoming.

> I thought this required me to unlock my phone and say 'I trust this computer'

It does, but only once, and then it's almost impossible to "un-trust" the computer without wiping your phone. Besides, you probably have already "trusted" your home computer -- which could be exploited between then and now and then used as a vehicle for attack.

And, as some commenters have mentioned, when you plug into a new device, use an airplane USB charging port for example, the phone may repeatedly ask you to accept a pairing with the other side (the USB charger/device), and an accidental tap on the wrong button can leave the door open.

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#84

Post by nknighthb »

Alupis wrote: post #78
ZoFreX wrote: post #74

Earlier quoted context omitted.

No, it's about the browser CA system. I don't know exactly how Apple implemented their signing for iDevices, but it's a reasonable assumption that the certs need to be signed by Apple, and they didn't effectively hand the keys over to every registrar in the world.

http://en.wikipedia.org/wiki/Code_signing They are likely using a plain-old SSL Cert signed by a plain-old public CA, which is how your computer would know if the executable appears to come from Apple or not.

First of all, code signing certificates are not "plain-old SSL certs". They're for code signing, not SSL.

Second, Apple includes their own root certificates in their own operating systems just like everybody else. I've personally implemented a code signing mechanism for a platform that had no root certificates except for those I personally generated (and still control).

The public CA system is just irrelevant here. It has nothing to do with anything.

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#85

Post by sneak »

Alupis wrote: post #6
coreymgilmore wrote: post #5

So in short: Apple has back doors that they claim aren't really back doors since only Apple apps can use them. If the NSA hasn't been using them already, it is only a matter of time.

If it's a backdoor for Apple, then it's a backdoor for anyone who can figure it out (other apps, hackers, government agencies alike).

http://i.imgur.com/0pfEwKs.png

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#86

Post by peterwwillis »

Resolving the hyperbole debate: asking a user "May I connect to some device?", then installing permanent remote access to the device, and never prompting the user again nor giving them further information, is a plain and simple backdoor.

The difference between this and malware is malware authors create web pages explaining to users to "Just click OK and don't ask what this is" before they deliver you a backdoored application.

If the prompt said "May we install remote access tools that allow us to remotely control and remove data from your device forever?", then it wouldn't be a backdoor. It would be a front door.

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#87

Post by yellowapple »

coldtea wrote: post #27
Alupis wrote: post #18

Earlier quoted context omitted.

I don't own an iDevice, but Apple's nonchalant attitude regarding possible exploitable backdoors irks me.

The fact that the other major mobile OSs gets 98% of the mobile malware (according to studies), makes this point about the "nonchalant attitude" rather week...

That 98% figure is caused primarily by users disabling the default-enabled restrictions on third-party non-Play-Store apps, and particularly in the pirated app space.

Also, s/week/weak/

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#88

Post by Karunamon »

josho wrote: post #81
aktau wrote: post #33

Earlier quoted context omitted.

> It's good to know Apple has the power to look through your encrypted files given physical access (file relay). So the requisites are: "be Apple" and "have physical access"? That's awfully little for what's supposed to be encrypted files. It (seems to be) no secret that law enforcement sends devices to Apple when they can't handle them themselves. So if I'm understanding it right: you can't protect yourself with an…

What is the threat model that concerns you? If you don't trust Apple then don't use iOS full stop. I trust Apple engineers, but not Apple Store employees. So, for me the question to ask is what effort is required to circumvent the system. If any employee at an Apple Store can circumvent your encryption then that is an issue. If circumventing requires your passcode, then that's far less concerning.

Use your imagination. Apple could be compelled to dump a device you're sending in for repairs, for example.

A great deal of these (backdoors/vulnerabilities/developer tools) have no reason to exist in a non-developer-mode consumer device.

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#89

Post by xenadu02 »

Seems like iOS 8 should offer a settings screen to allow you to revoke sync keys and/or see a list of computers you've trusted in the past. Perhaps it should default to deleting the keys if you haven't sync'd with a specific computer in some timeout period (30 days?).

A few of the services should be locked down a bit further regardless of anything else.

I also don't see this as a valid bypass of encrypted files - you need the device to be on and have its passcode entered. That's a far cry from taking a cold device, booting it, then connecting with a stolen sync key. Besides the fact that we've known you were unsafe if the device was unlocked for some time - some police even carry Faraday bags and portable chargers to keep them accessible probably for this very reason.

Re: Apple Confirms “Back Doors”, Downplays Their Severity

#90

Post by nick_riviera »

joosters wrote: post #58

What's really disappointing is that there seems to be an all-or-nothing security model here. If I pair my phone with a computer, then suddenly it has complete access to spy on me, install monitoring tools that can continue to run, etc. Why can't there be a way where I can transfer music/photos to/from my phone without providing this full device access? You'd be pretty annoyed if the front door to your house, when you…

This problem is solved pretty easily:

1> Buy a shit Nokia, use the 2 pin charger. TBH if it goes flat it won't charge off USB anyway. Then use a microSD for transferring music/photos.

2> Buy an Android handset with USB OTG. Transfer files on and off via a USB stick that you control. Charge it with a USB cable with the data pins shorted (you can buy these off Amazon).

Both of these ignore the main attack vector that I'd be concerned about which is over-the-air (via GSM/packet data) and a fuck load more scary than plugging your USB thing into a dirty USB hole and getting some USB STD.

Post reply on HN