What about Dragonfly? Is it also assisted by the government?
It is censored but it sounds like a rat trap.
'Karma': A hack used by the UAE to break into iPhones of foes
141–150 of 238 posts
Re: 'Karma': A hack used by the UAE to break into iPhones of foes
#142To expect citizens to revolt against their own country and force their "secret services" to not endanger public security any more by using and buying such 0days is one thing - that's unrealistic.
But seriously, I wonder why other governments and their citizens are not demanding drastic actions, like trade suspensions, expulsion of diplomats or other sanctions, when other countries get caught in such ways of spying or otherwise just screwing all over human rights. This one would be a perfect example to take a stand on - UAE is far smaller in oil trading and political importance than e.g. Saudi-Arabia.
Or why there seems to be next to zero public funding for providing open source, auditable hardware and software that could prevent such spying in the first place? The European Union could easily fund the development of a truly FOSS Android-based phone, down to the processors. Instead everyone seems to rely on Chinese or American products, which are both subject to non-European influence (in the US via NSLs, in China due to the massive influence of the Party on any major company).
Re: 'Karma': A hack used by the UAE to break into iPhones of foes
#143Earlier quoted context omitted.
Wouldn't the police have a "right" to know if a person has any weapons? Detaining everyone and performing a full cavity search for any and all infractions is just the police exercising their "right" to such information. Will you be the first to bend over and spread for the cops "right" to peace of mind? "That it is better 100 guilty Persons should escape than that one innocent Person should suffer, is a Maxim that ha…
> "That it is better 100 guilty Persons should escape than that one innocent Person should suffer, is a Maxim that has been long and generally approved." I wonder if that maxim is still generally approved. It seems like some authoritarians would prefer that 100 innocents would suffer than one guilty person should escape. I suppose it depends how you define "innocent" and "suffer". Under modern law, everyone is guilty…
>Under modern law, everyone is guilty of something.
This is a really dangerous (and unfortunately oft-repeated) mindset that basically boils down to advocating the position of "current laws are so complex that if we give law enforcement better tools [to combat law breaking], we'd implicate ourselves also".
This ignores two huge problems:
1. No, not everyone is guilty of something. I doubt a majority are guilty of anything, and I'd be surprised to hear even like 10-15% are guilty of anything.
2. The people that _are_ guilty of some minor infraction (e.g. jaywalking, speeding, or pick your own obscure state law) are still guilty of much less than the major crimes these kinds of systems are targeted at (terrorism, violent crime, robbery, etc). Comparing the two is like saying "we shouldn't put cameras at bank entrances because what if it catches someone jaywalking outside?"
On a more hard-line note, the people that are guilty of even the smallest things are still guilty of those things. People speed because they think they won't get caught, but it's still against the law. People jaywalk because they think they'll be safe crossing the street, but it's still illegal. People litter because they think it's not a big deal, but it's still illegal. Who gets to decide what people should get away with? Why would anyone be able to get away with breaking any law? (To wit, the obvious response is that some laws are obscure and outdated and that people aren't even aware of them, but feel free to refer back to #2 above until we've fixed those laws. Perhaps actually enforcing them is the nudge we need to push lawmakers into saying, "You know those crazy laws that are still in the books that we've ignored for a hundred years? Yeah, maybe we should get rid of those.")
>That it is better 100 guilty Persons should escape than that one innocent Person should suffer
This maxim encourages a false dichotomy that is embraced by the "we're all guilty of something" mindset, and forgets that "suffering" is a spectrum.
The people who are guilty of gotcha laws _aren't_ innocent, and _should_ suffer proportionately to the law they broke (see: fines, warnings, etc that you'd expect for silly laws that people think shouldn't be enforced, yet are still laws). I'd much rather see that "innocent" person get their $50 fine so 100 people guilty of violent crime don't escape.
"It is better 100 guilty [murderers] should escape than that one innocent [jaywalker] should suffer." Sounds silly, doesn't it?
Re: 'Karma': A hack used by the UAE to break into iPhones of foes
#144I realize it's a really sexy headline, but I'd like for there to be more than 0 proof that this is a real thing. Especially if they claim a vulnerability that's exploitable by only sending a text.
>Especially if they claim a vulnerability that's exploitable by only sending a text.
For some time, it was possible to crash some iPhones by texting them a Taiwanese flag emoji (which was censored by mainland China). https://www.cultofmac.com/561635/apples-taiwanese-flag-ban-l...
I don't know offhand if this was a buffer overflow or something else, but if you can crash the OS with a text, you . could likely exploit it instead.
Re: 'Karma': A hack used by the UAE to break into iPhones of foes
#145Whether or not this hack was developed with the help of Apple (a “backdoor”) or by a third-party exploit, this is exactly what a “golden key” looks like after it gets in the wild. An espionage tool developed by a major world power proliferates to totalitarian regimes, aided and operated by ex-NSA agents on the payroll, to compromise human rights activists and the political opposition. If ever there was proof that our…
I disagree with the conclusion of absolute security — it won’t happen, and only encourages subversion by people who both need and have a right to access the content. Instead of pontificating, the tech industry should innovate. There’s no reason that hashchains can’t be used to timelock the key, and the enclave export it in response to a signed request. Then we can at least force the compromises through the legal syst…
The objections to a golden key are irrespective of whatever system permits the golden key access. Your hashchains are completely irrelevant. The courts will use some key to sign their request, and that key will leak.
Cryptography reduces message security to key security, nothing more.
Re: 'Karma': A hack used by the UAE to break into iPhones of foes
#146Earlier quoted context omitted.
welcome to reality
Now imagine what's going to be possible in Australia with their compulsory surveillance laws... Though, I wouldn't be super surprised if they banned people they forced to implement exploits from leaving country =X
I take a more pessimistic view. We should think that all this is already being done, just not acknowledged.
Re: 'Karma': A hack used by the UAE to break into iPhones of foes
#147Whether or not this hack was developed with the help of Apple (a “backdoor”) or by a third-party exploit, this is exactly what a “golden key” looks like after it gets in the wild. An espionage tool developed by a major world power proliferates to totalitarian regimes, aided and operated by ex-NSA agents on the payroll, to compromise human rights activists and the political opposition. If ever there was proof that our…
Nobody credible believes for a second that Apple was involved, for whatever it’s worth.
Could be some rogue employee, could be a legitimate employee under constraints / influence of an organization, etc. The NSA tried to do it with Linux quite a few times.
Re: 'Karma': A hack used by the UAE to break into iPhones of foes
#148Whether or not this hack was developed with the help of Apple (a “backdoor”) or by a third-party exploit, this is exactly what a “golden key” looks like after it gets in the wild. An espionage tool developed by a major world power proliferates to totalitarian regimes, aided and operated by ex-NSA agents on the payroll, to compromise human rights activists and the political opposition. If ever there was proof that our…
"Totalitarian regime" I stop reading whenever I hear doublespeak. You need to find a new way to address countries that aren't western democracies. Especially since the rest of the world is catching up, you won't hold this monopoly on labels for much longer.
Connotations aside, totalitarian is an accurate description of the majority of the UAE. Most of it's citizens live in constituent Emirates which are absolute monarchies. Dubai is a notable exception as a constitutional monarchy, although the relative strength of the monarch is not exactly set even there.
Re: 'Karma': A hack used by the UAE to break into iPhones of foes
#149Earlier quoted context omitted.
Wouldn’t it be far more useful for you to provide someone credible making such a claim? If he was wrong this claim would be so trivial to refute that sources seem entirely pointless.
To clarify my earlier comment, I wasn't taking a position one way or the other. lawnchair_larry made a claim about "nobody credible" believing something. As a lay person in the field, I don't know who these credible people are. Therefore I asked whether lawnchair_larry could tell us who one or more of these credible people are, and where we can read more about what they believe to be true about the situation.
Asking lawnchair_larry to give you a complete list of everyone he considers credible is disingenuous.
As the other commenter stated, if someone thought that someone credible made that claim they could simply provide that source, which both (1) involves asymptotically less effort for everyone involved and (2) under reasonable assumptions is at least as effective.
“Sir, I’m going to need for you to list for me all the crimes you didn’t commit last Saturday.”
Re: 'Karma': A hack used by the UAE to break into iPhones of foes
#150Whether or not this hack was developed with the help of Apple (a “backdoor”) or by a third-party exploit, this is exactly what a “golden key” looks like after it gets in the wild. An espionage tool developed by a major world power proliferates to totalitarian regimes, aided and operated by ex-NSA agents on the payroll, to compromise human rights activists and the political opposition. If ever there was proof that our…
"Totalitarian regime" I stop reading whenever I hear doublespeak. You need to find a new way to address countries that aren't western democracies. Especially since the rest of the world is catching up, you won't hold this monopoly on labels for much longer.
Those countries being relatively more powerful doesn't directly make their governments less unethical. Giving lip service to their propaganda doesn't help either.
Also, if you're talking about the mid east and not, say, China, the future doesn't really look bright.