The CIA Campaign to Steal Apple's Secrets (2015) • Hacker News Board

Re: The CIA Campaign to Steal Apple's Secrets (2015)

#111

Post by nickelcitymario » Wed, Apr 03, 2019, 12:05 PM UTC

Mirioron wrote: post #103

nickelcitymario wrote: post #63

Earlier quoted context omitted.

I suspect we have a similar % of Canadians who distrust the government as Americans do. I'd count myself among them. However: 1) I maintain that the only reason to fund an intelligence agency is to expect them to perform intelligence activities, and today that requires being the best in the world at black hat infosec. 2) I mistrust my government less than I mistrust yours or Russsia's, because at least my government…

> 2) I mistrust my government less than I mistrust yours or Russsia's, because at least my government depends on me for votes and taxes and general compliance with laws. But this also means that they have way more reason to lie to you and to mislead you.

Well, their incentives are different, this is true. I don't know that it's MORE reason.

I mean, if they successfully lie to me, they get my taxes.

If they successfully lie to you, maybe you don't invade our country.

Re: The CIA Campaign to Steal Apple's Secrets (2015)

#112

Post by nickelcitymario » Wed, Apr 03, 2019, 12:10 PM UTC

kurthr wrote: post #98

nickelcitymario wrote: post #67

Earlier quoted context omitted.

Apple products are used globally, so even if they do restrict their spying efforts externally, the ability to hack Apple products is aligned with those efforts. They should also absolutely be looking for vulnerabilities in Huawei products. They should be looking for them in any product with significant market share. But there's no reason to think they can't do both. All that aside: Theres a social credit system with…

Apple sales in China are ~10% of the market and falling. In the US (especially high value targets) are ~50% or higher. That's not a good ratio for the US. I suspect the numbers for Russia are more similar to China. Targeting your own people (and not trying to secure the system) isn't a good strategic plan.

Ok, so it's 10%.

Thought experiment: You're a chinese spy. Your enemy is pouring tonnes of effort into hacking the phones made by your own country, but have chosen to put zero effort into hacking those made by theirs.

Which phone do you use?

Meanwhile, your own people are good at hacking both American and Chinese phones.

So in this scenario, the USA's decision to not try to hack products made by American companies leaves them at a decided disadvantage to China's decision to hack all of them.

Re: The CIA Campaign to Steal Apple's Secrets (2015)

#113

Post by ionised » Wed, Apr 03, 2019, 1:33 PM UTC

marnett wrote: post #30

dictum wrote: post #21

Earlier quoted context omitted.

I'm yet to see a clear explanation for citizens not being as much of a risk as, say, a random foreigner located far away from your country. If anything, a citizen is more capable of carrying out a terrorist attack, or just doing any action some foreign power wants to perform in that country. The exception for domestic citizens seems to be just a concession for the masses and their representatives, not a pragmatic cho…

The American revolution was started because citizens did not want the government in their homes.

That's the fairy tale version.

Re: The CIA Campaign to Steal Apple's Secrets (2015)

#114

Post by kurthr » Wed, Apr 03, 2019, 2:27 PM UTC

nickelcitymario wrote: post #112

kurthr wrote: post #98

Earlier quoted context omitted.

Apple sales in China are ~10% of the market and falling. In the US (especially high value targets) are ~50% or higher. That's not a good ratio for the US. I suspect the numbers for Russia are more similar to China. Targeting your own people (and not trying to secure the system) isn't a good strategic plan.

Ok, so it's 10%. Thought experiment: You're a chinese spy. Your enemy is pouring tonnes of effort into hacking the phones made by your own country, but have chosen to put zero effort into hacking those made by theirs. Which phone do you use? Meanwhile, your own people are good at hacking both American and Chinese phones. So in this scenario, the USA's decision to not try to hack products made by American companies le…

Hack the NSO group (or any of your adversaries/allies) and use their zero days... likely a lot cheaper than developing your own or creating new ones for other people to hack and use against you. If nobody else has any, you're not behind :^)

Re: The CIA Campaign to Steal Apple's Secrets (2015)

#115

Post by megous » Wed, Apr 03, 2019, 4:33 PM UTC

marssaxman wrote: post #107

Godel_unicode wrote: post #100

Earlier quoted context omitted.

I suspect you're being downvoted because of the below. Spoiler alert: dictators don't follow the same value calculus as normal people for when they should "bother". https://en.m.wikipedia.org/wiki/Poisoning_of_Alexander_Litvi... https://en.m.wikipedia.org/wiki/Sergei_Skripal

Sure, I'm aware of those cases - but I am not a former Russian military intelligence officer, and I'll wager that nobody else participating in this thread is, either. There is no conceivable reason that any dictator, anywhere in the world, should care enough about any of us to bother spending the enormous amount of money and presumably political capital that would be involved in executing such an attack, so why shoul…

That's obviously true (most people will not be targeted). But there's plenty more cases than the last few prominent ones. There are also low level cases that are not reported globally, only in local news.

It's ranging from secret services trying to use people to bomb planes and public places, to dissidents active abroad being threatened, beaten up or assassinated by suspected secret services of their origin countries. On source of such activity is Assad's regime in Syria.

https://www.middleeastmonitor.com/20190119-is-assad-trying-t...

It's uncommon, unlikely, but not that unique.

Re: The CIA Campaign to Steal Apple's Secrets (2015)

#116

Post by otakucode » Wed, Apr 03, 2019, 11:42 PM UTC

>Brennan said the CIA reorganization will be modeled after the agency’s Counterterrorism Center, which runs the U.S. targeted killing and drone program.

I always like to remind people when this comes up - The CIA is a civilian agency. They are not military. They have no legal right to engage in anything remotely resembling military action. Their only legal behavior is to collect international intelligence, though they seem to be capable only of doing everything outside their mandate and not within it. Why they weren't disbanded after the USSR imploded into bankruptcy 2 weeks after they had delivered a report claiming that the USSR was 'not a paper tiger' and 'growing stronger every day' and that they would continue to present the largest threat to the US on the global stage for the foreseeable future I have no idea. Most amateurs could have told you the USSR was on its last legs after years of scientists and members of their military reporting not being paid for years at a time. But the CIA was absolutely certain that they were doing great. And they should know, they had devoted stupendous resources to their intelligence work there. But, nope, they didn't see it coming at all.

Re: The CIA Campaign to Steal Apple's Secrets (2015)

#117

Post by ficklepickle » Thu, Apr 04, 2019, 5:15 AM UTC

ilrwbwrkhv wrote: post #99

everdrive wrote: post #89

Earlier quoted context omitted.

I never said it was moral or ok, just that it doesn't suggest that the purpose is spy on Americans.

oh trust me... everything is tested at home first...

Or on Canadians. Our government has historically been very willing to let the USA experiment on unwitting civilians.

Re: The CIA Campaign to Steal Apple's Secrets (2015)

#118

Post by DINKDINK » Thu, Apr 04, 2019, 3:08 PM UTC

CalChris wrote: post #106

DINKDINK wrote: post #94

Earlier quoted context omitted.

>How is pen testing of iPhones stealing Apple's secrets? Did you read the article? The CIA -- in addition to pentesting -- is trying to exfiltrate GID keys of Apple devices. That is quite literally, trying to steal Apple's secrets -- not checking which systems have vulnerabilities.

Thank you, I did read the article. No, that's pen testing.

I guess we disagree then. Pen testing to me is: "Can I steal your key? Here, I have a proof that I can steal it." Actually exfiltrating (not necessary to produce a proof that you were able to view it) so that you can produce fraudulent signatures is completely orthogonal to exfiltration.