Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Karma': A hack used by the UAE to break into iPhones of foes

reuters.com

Post reply on HN
Print view View original

161–170 of 238 posts

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#161

Post by abrichr »

ryanlol wrote: post #153
abrichr wrote: post #139

Earlier quoted context omitted.

To clarify my earlier comment, I wasn't taking a position one way or the other. lawnchair_larry made a claim about "nobody credible" believing something. As a lay person in the field, I don't know who these credible people are. Therefore I asked whether lawnchair_larry could tell us who one or more of these credible people are, and where we can read more about what they believe to be true about the situation.

How is he supposed to refer you to people not saying something? This is most definitely a rather silly request. Can you prove that magic doesn’t exist?

> How is he supposed to refer you to people not saying something?

That's not what I was asking for. I was asking him to refer me to credible people saying that they don't believe Apple was involved. Here is what he said:

> Nobody credible believes for a second that Apple was involved, for whatever it’s worth.

I thought perhaps he had read about credible people making this claim, or had some other way of knowing what these people believe. I was simply asking for more information, so as to further educate myself.

I believe that in the absence of any sources, this claim may suffer from the Argument to the People [1] and Argument from Authority [2] logical fallacies.

Full disclosure: I have a MacBook and an iPhone. I enjoy Apple products and respect their business model. And in the absence of any evidence to the contrary, I'm inclined to believe that Apple wasn't involved. I just want to learn more about the subject from people who know more than me.

[1] https://en.wikipedia.org/wiki/Argumentum_ad_populum

[2] https://en.wikipedia.org/wiki/Argument_from_authority

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#162

Post by abugheratwork »

jonathanyc wrote: post #149
abrichr wrote: post #139

Earlier quoted context omitted.

To clarify my earlier comment, I wasn't taking a position one way or the other. lawnchair_larry made a claim about "nobody credible" believing something. As a lay person in the field, I don't know who these credible people are. Therefore I asked whether lawnchair_larry could tell us who one or more of these credible people are, and where we can read more about what they believe to be true about the situation.

Asking lawnchair_larry to give you a complete list of everyone he considers credible is disingenuous. As the other commenter stated, if someone thought that someone credible made that claim they could simply provide that source, which both (1) involves asymptotically less effort for everyone involved and (2) under reasonable assumptions is at least as effective. “Sir, I’m going to need for you to list for me all the…

> Asking lawnchair_larry to give you a complete list of everyone he considers credible is disingenuous.

Implying that was asked seems disingenuous to me, but I assume that wasn't your intent.

What I see is a request for clarification, specifically asking for the sources from which a conclusion was drawn.

It's not a police raid. Relax.

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#163

Post by basilgohar »

drusepth wrote: post #143
LeifCarrotson wrote: post #73

Earlier quoted context omitted.

> "That it is better 100 guilty Persons should escape than that one innocent Person should suffer, is a Maxim that has been long and generally approved." I wonder if that maxim is still generally approved. It seems like some authoritarians would prefer that 100 innocents would suffer than one guilty person should escape. I suppose it depends how you define "innocent" and "suffer". Under modern law, everyone is guilty…

>Under modern law, everyone is guilty of something. This is a really dangerous (and unfortunately oft-repeated) mindset that basically boils down to advocating the position of "current laws are so complex that if we give law enforcement better tools [to combat law breaking], we'd implicate ourselves also". This ignores two huge problems: 1. No, not everyone is guilty of something. I doubt a majority are guilty of any…

Totalitarianism and police states don't start by jailing the jaywalkers, but they do start by implementing the laws disproportionately against marginalized communities within the general population. This is generally overlooked by the remainder because they think, "Well, it's not affecting me."

The problem with this line of thinking, "they broke the law, they should be punished whatever it was" is that laws and morality, while sometimes intended to be aligned, are not.

Take, for example, "disobeying a police officer". On the surface of it, no one would argue that that is a problem, thinking, "of course I'll follow a police officer's instructions". However, the system has evolved to the point where someone who has initially committed no crime, stopped by the police under suspicion, can end-up dead or incarcerated due to a sadly more-and-more common sequence of escalations.

Asserting that the law is somehow perfect to the extent that all illegal behavior should be punished is also poorly framed because not everything is illegal everywhere, and in fact, what is legal and illegal is not universally known or clear. For example, to access some laws in some municipalities, the laws themselves are under private copyright and a fee must be paid and they are not accessible except directly in person, as in, not remotely (this was news a while back, not sure if there's a HN story about it).

So, I feel this viewpoint is missing some fundamental realities that may drastically change the underlying assumptions.

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#164

Post by basilgohar »

FakeComments wrote: post #55
techntoke wrote: post #52

Earlier quoted context omitted.

C'mon everyone, be part of the solution like this person says. The intelligence agencies will never abuse their power. You can trust them. /s

That’s a deep straw man of what I said, to the point of being non-constructive mocking. You’re just being dishonest to claim I suggested trusting the spy agencies. Rather, I pointed out that they have a real mission, and they’re going to spend effort accomplishing it. But their mission isn’t to own every device — it’s to own a select few, probably on the order of hundreds or thousands a year. So, if we create a mecha…

> But their mission isn’t to own every device — it’s to own a select few, probably on the order of hundreds or thousands a year.

This is patently untrue. Snowden and much more have made it absolutely, unambiguously clear that national spy agencies do wish to gather and collect absolutely and every bit of information possible about their own law-abiding citizens as well as those here that are not.

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#166

Post by basilgohar »

794CD01 wrote: post #127
pjc50 wrote: post #96

Earlier quoted context omitted.

The "hashing time per crack" reminds me of the old 48-bit encryption which was mandated to have short, crackable keys. Or even the previous attempt at doing this with the "LEAF". Are you proposing some sort of work function within the crypto enclave ? ie you leave the device brute-forcing for a few days and it spits out the key? The "appreciable time" is going to be subject to constant downward pressure, both politic…

>Mass surveillance is not going to go away without huge cultural reform of the security services. They don't take concessions. FakeComments was mostly talking about targeted surveillance, but I agree with him/her in spirit, since I believe that mass surveillance is not going to go away. Ever. So you can either yell futilely into the wind as it happens over your objections, up to, including, and perhaps going beyond a…

>"It is the common fate of the indolent to see their rights become a prey to the active. The condition upon which God hath given liberty to man is eternal vigilance; which condition if he break, servitude is at once the consequence of his crime and the punishment of his guilt." – John Philpot Curran: Speech upon the Right of Election for Lord Mayor of Dublin, 1790. (Speeches. Dublin, 1808.) as quoted in Bartlett's Familiar Quotations

[0] https://en.wikipedia.org/wiki/John_Philpot_Curran#Quotations

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#167

Post by TLC555 »

You have an agency like the NSA with scores of genius mathematicians and hackers and a black budget. There's nothing beyond their means, spying wise.

I suspect that one day our internal thoughts and feelings will be under constant mass surveillance, Minority Report style, but it won't look like sci-fi when it happens.

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#168

Post by TimTheTinker »

iheartpotatoes wrote: post #136
TimTheTinker wrote: post #123

Earlier quoted context omitted.

> I can't think of a great solution to this problem. There's really only one "final solution" to the problem in the purely technical realm. That would be to make provable security (in the theorem-proving sense) a non-negotiable requirement to all digital logic (both hardware and software) running on networked devices. I don't know if there's even a workable definition that would rigorously describe the goal of such a…

I think your solution needs to extend to the hardware components on the board. High security MCUs go through great lengths to defeat sideband attacks on the package (some really neat stuff too like failing if exposed to die shaving). There are secure bus initiatives but they don't extend to the BOM (bill of materials) for all the components. On top of that, GUI techniques for obscuring physical input (keyboards, UI t…

> I think your solution needs to extend to the hardware components on the board.

It does. I said all digital logic, which includes all the ICs, FPGAs, and silicon.

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#169

Post by zerocrates »

smolder wrote: post #158
FakeComments wrote: post #49

Earlier quoted context omitted.

I disagree with the conclusion of absolute security — it won’t happen, and only encourages subversion by people who both need and have a right to access the content. Instead of pontificating, the tech industry should innovate. There’s no reason that hashchains can’t be used to timelock the key, and the enclave export it in response to a signed request. Then we can at least force the compromises through the legal syst…

If I want to have a private conversation where the details of what are said are undiscoverable, I believe that's a right that people should have in a "free country", including over the internet, over phone, and so on. The fact is, I can, using some combination of math and secrets, accomplish this. I don't think anyone on earth has the right to collect/record/see the contents of my communications other than me and the…

The trick here is that the authorities will (somewhat reasonably) advertise their need for these tools under the "reasonable suspicion" label: they want the backdoor or whatever it is they need to conduct their surveillance once they do have reasonable suspicion.

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#170

Post by ganoushoreilly »

DGAP wrote: post #137
ganoushoreilly wrote: post #124

Earlier quoted context omitted.

Large govt. contractors and sub companies run this and all the other programs like this. There is tacit approval for these ops. I'd even imagine there's a bit of intel being fed back to them from the new employees .

"The FBI is now investigating whether Raven’s American staff leaked classified U.S. surveillance techniques and if they illegally targeted American computer networks" [1] It's still illegal to use US classified information for a program like this and it's still illegal to target American citizens or networks. [1] https://www.reuters.com/investigates/special-report/usa-spyi...

I didn't say it wasn't, I simply said all of it could be encompassed by the specific clause of "TTP's" that is common in anyones read on-off of information. The difficulty becomes in proving what was classified and what wasn't when it comes to techniques and procedures. If you were to use a liberal sense of the term, many of your "Security Professionals" deploying their skills around the US right now would be in violation. It's why there isn't a simple non-compete / non-authorization of future work within that field, it's just not going to stand up in court.

It's all as clear as mud and in this instance the government was more than aware of their former employees working there, many returned and went back to their prior careers.. think about that one for a second.

Post reply on HN