Live data from Hacker News

The CIA Campaign to Steal Apple's Secrets

firstlook.org

91–100 of 138 posts

Re: The CIA Campaign to Steal Apple's Secrets

#91
“Tearing apart the products of U.S. manufacturers and potentially putting backdoors in software distributed by unknowing developers all seems to be going a bit beyond ‘targeting bad guys.’ It may be a means to an end, but it’s a hell of a means.”

The trouble with the means justifying the ends, is that ends are fictions invented to enable the telling of stories. Outside the structures required for stories, there is only ever really the means.

Re: The CIA Campaign to Steal Apple's Secrets

#92
post #64

As many have noted, this does need to stop but it won't. And the problem lies squarely with you and me. Try this experiment: Ask a group of 5-10 people around you to raise their hands if they've been pissed off at any branch or level of their government. Then ask them to keep their hands up if they've contacted their representatives about that issue. Finally, ask them if the method of contact they used was the phone…

Look at the grassroots, bipartisan, loud and successful cry from the public not to enter Syria. How many months did that work? It is true that the system must represent the people. If and when it does not - whose fault is it? It can not be the people. We don't design people. We design a system to conform to the people, to communicate with them and to represent them.

Its our fault because we put those politicians in power. Its our fault because we on the whole would rather watch sports, reality tv, play games, etc... than get involved in the running of our country.

And it doesn't even take much. Can you really not spare a 5 minutes once a week to call your representatives? Think about if more people did this. Suddenly those lobbyists voices would get a lot less powerful.

Re: The CIA Campaign to Steal Apple's Secrets

#93
post #10

If I'm understanding this right, this article is claiming that the CIA served up [edit: could serve up, not proven they did, see comments below about plausibility] poisoned versions of XCode, which would then be used to make App Store apps that eventually phoned home to Langley with either app-specific data or whole-phone data. This raises so many questions, among them: 1) What was [edit: would be] the criteria for s…

They said they created a poisoned version of XCode, not that they were able to serve it up successfully to anyone.

But they sure can serve it successfully. They control the cables through which everyone's internet traffic passes, and when you download a program (such as Xcode) they can substitute it with their poisoned program [1].

I'll quote:

> All it takes is a single request from a victim passing a wiretap for exploitation to occur. Once the QUANTUM wiretap identifies the victim, it simply packet injects a 302 redirect to a FOXACID server. Now the victim’s browser starts talking to the FOXACID server, which quickly takes over the victim’s computer.

... or doesn't take over the victim's computer, but provides a download of a poisoned Xcode.

These motherfuckers have compromised the whole internet.

[1]: http://www.wired.com/2013/11/this-is-how-the-internet-backbo...

Re: The CIA Campaign to Steal Apple's Secrets

#94

This is a great argument for "Gentoo Android". While much of the iOS is Open Source or Free Software, the end-user can't really inspect the source that went into their particular device. Note that, to the extent that the CIA steals Apple secrets from foreign sources, they may not be violating any US laws. However Apple does the vast majority of its system software development in Cupertino, California. My next phone i…

    My next phone is going to be an Android that enables me to completely replace its firmware binary.
I'm not aware of a single (modern) phone where you can replace the firmware of the baseband with something open source.

Re: The CIA Campaign to Steal Apple's Secrets

#95
post #92

Earlier quoted context omitted.

Look at the grassroots, bipartisan, loud and successful cry from the public not to enter Syria. How many months did that work? It is true that the system must represent the people. If and when it does not - whose fault is it? It can not be the people. We don't design people. We design a system to conform to the people, to communicate with them and to represent them.

Its our fault because we put those politicians in power. Its our fault because we on the whole would rather watch sports, reality tv, play games, etc... than get involved in the running of our country. And it doesn't even take much. Can you really not spare a 5 minutes once a week to call your representatives? Think about if more people did this. Suddenly those lobbyists voices would get a lot less powerful.

Are not the representatives we get to choose from filtered before we can select them? Aren't the representatives beholden to those who can get them the money to run before we even get to hear that they are running? Aren't the (only two) political parties in consensus on issues in the high finance, insider trading, and foreign investment that bring their kin high rewards and imperialist neo-colonial empire building that makes this growth possible?

Yes we can bother these people about allowing gay people to marry (or not, or whatever) but when can we ask them not to cause revolutions around the world (like now in Venezuela) and then intervene with bombs and 'bring Capitalistic freedom' by fixing American private investment in their resources?

You can make noise about some things, but they either will not last (re Syria) or they will not listen. Other strategic objectives, international agreements and private investment come first.

How are you going to immediately and suddenly alter 300 million people to spend multiple hours a week to sift through the reams of propaganda and PR (whose voices rise above political realities) to come to independent and critical political and social analysis? That's a huge lifestyle change - we can't even get 300 million people to turn off the lights when they exit rooms to save electricity. If people on the whole want to enjoy hobbies, entertainment, family and work instead of being full time politicians and investigative reporters can we snub them for that?

We need a system that can work with people who are busy living their (plebeian) lives but is still able to represent their interests. Someone might say that this isn't possible - but then are they not saying that representative democracy is not possible?

Re: The CIA Campaign to Steal Apple's Secrets

#96
post #30

What strikes me after this revelation is how unique the United States is, because: (a) it has dozens of companies that create technology the rest of the world uses, and (b) it has a govt. that secretly works to undermine the technology developed by those companies. You're not going to hear about many foreign govt's actively hacking their country's software products, simply because they could easily/secretly armtwist…

Not a peep was made while the intelligence community got in bed with tech companies. It was mutually beneficial and still is.

The only reason you're hearing about this is because it's good PR for Apple, after their intimate relations with the security apparatus were exposed.

Re: The CIA Campaign to Steal Apple's Secrets

#97

This is a great argument for "Gentoo Android". While much of the iOS is Open Source or Free Software, the end-user can't really inspect the source that went into their particular device. Note that, to the extent that the CIA steals Apple secrets from foreign sources, they may not be violating any US laws. However Apple does the vast majority of its system software development in Cupertino, California. My next phone i…

"My next phone is going to be an Android that enables me to completely replace its firmware binary."

Component firmware and device drivers will still be binary blobs. You need to go a level deeper than that.

Re: The CIA Campaign to Steal Apple's Secrets

#98
post #15

How much longer can this continue? We have American agencies attacking American companies "because terrorism". It's been 13 years since our trauma, maybe now's the time to remove the razor blade from our wrists, look ourselves in the mirror and just carry on. Bad stuff is always going to be in our future — stuff that will increasingly appear preventable between the Internet and a lot of hindsight — but our current so…

> We have American agencies attacking American companies "because terrorism"

Wrong, and selfish.

We have American agencies attacking innocent people everywhere in the world "because terrorism".

Re: The CIA Campaign to Steal Apple's Secrets

#99
post #55
post #15

How much longer can this continue? We have American agencies attacking American companies "because terrorism". It's been 13 years since our trauma, maybe now's the time to remove the razor blade from our wrists, look ourselves in the mirror and just carry on. Bad stuff is always going to be in our future — stuff that will increasingly appear preventable between the Internet and a lot of hindsight — but our current so…

I'm actually somewhat torn on this. While I'm against mass surveillance, I think that targeted surveillance can be a good thing. By nature of it being targeted, it is expensive to use on more people than necessary. The kind of spying the CIA would enable through compromising Apple secrets would be restricted to high-value targets if for no other reason than to ensure none of their targets knew they had that capabilit…

This doesn't sound targeted:

by manipulating Xcode, the spies could compromise the devices and private data of anyone with apps made by a poisoned developer — potentially millions of people ...

The focus of the security researchers, as described at the CIA conferences, was to target the GID key, which Apple implants on all devices that use the same processors. [...] So, if intelligence agencies extract the GID key, it means they have information useful to compromising any device containing that key.

Re: The CIA Campaign to Steal Apple's Secrets

#100

Earlier quoted context omitted.

It's a little discomforting that we're hoping that corporations, presumably guided by a profit motive, will defend us against the government formed for the people (though more heavily influenced by other corporations). Even if Apple is trustworthy for a company, I'm not going to enjoy the future in which we pick our favorite companies to enact policy. Now, this is obviously happening to Google, et al, as well, so a j…

Nothing wrong with "profit motive". Remember: It is not from the benevolence of the butcher, the brewer, or the baker that we expect our dinner, but from their regard to their own interest. ~~ Adam Smith That said, I'd personally like to see less power aggregated into the hands of both governments and big mega-corporations. But the big difference between the two, to my mind, is that governments have a near monopoly o…

Yeah, I agree that profit motive is a motive I can work with. I guess libertarianism can be appealing when the government acts like a tumor.

The government's monopoly on legitimate use of force is more relevant in less developed countries. Here, you can do more damage more easily by attacking computer-controlled infrastructure. (Imagine if the NRA was pointed at the real threat? Maybe they'd look a little like Anonymous.)

Post reply on HN