Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple will notify users about state-sponsored cybersecurity threats

support.apple.com

Post reply on HN
Print view View original

41–50 of 166 posts

Re: Apple will notify users about state-sponsored cybersecurity threats

#41

Post by randyrand »

notkurt wrote: post #37

Has anyone put forward some theories as to how they are pulling this off? Are they tapping into iMessage Metadata, scanning crash logs, or something along those lines? While I totally understand the need for them to keep how they are doing this private, I do find it slightly concerning. Unless they are just flagging suspicious iCloud login attempts. If it’s relating to crash logs, it would be nice to know as I’m sure…

It’s likely much more manual that.

They admit themselves that these attacks are not easy to detect.

Re: Apple will notify users about state-sponsored cybersecurity threats

#43

Post by pomian »

imarid wrote: post #22

I know of one case of a Polish prosecutor who does not obey (do not want to bend the law) Zbigniew Ziobro, who is both the minister of justice and the prosecutor general. She received a notification from Apple just today. Source: https://mobile.twitter.com/e_wrzosek/status/1463551631648251...

I think you need to add a translation of the tweet. Because it sounds as if he didn't obey Apple's warning. Yet I think he approves of Apple's s notification. It is the government who he wasn't obeying? So the government installed the spyware?

Re: Apple will notify users about state-sponsored cybersecurity threats

#44

Post by bell-cot »

cblconfederate wrote: post #4

What if it is illegal to do so?

From a pragmatic user's point of view, that would look just like "Apple didn't happen to notice that I was a target of state-sponsored activity". Recent headlines do not suggest that Apple's cyberdefenses are all that great against state-sponsored stuff.

From a more philosophical point of view - expecting a large corporation to go mano a mano on your behalf, against a major state security organization...that's right up there with expecting Santa Claus to punish all the evil spies for being naughty.

Re: Apple will notify users about state-sponsored cybersecurity threats

#45

Post by awestley »

pomian wrote: post #43
imarid wrote: post #22

I know of one case of a Polish prosecutor who does not obey (do not want to bend the law) Zbigniew Ziobro, who is both the minister of justice and the prosecutor general. She received a notification from Apple just today. Source: https://mobile.twitter.com/e_wrzosek/status/1463551631648251...

I think you need to add a translation of the tweet. Because it sounds as if he didn't obey Apple's warning. Yet I think he approves of Apple's s notification. It is the government who he wasn't obeying? So the government installed the spyware?

Translates to: "I just received an alert @AppleSupport about a possible cyberattack on my phone from state services. With the indication that I may be targeted for what I am doing or who I am. I will take the warning seriously because it was preceded by other incidents @ZiobroPL is this a coincidence?"

Re: Apple will notify users about state-sponsored cybersecurity threats

#46

Post by gjsman-1000 »

marcan_42 wrote: post #38
notkurt wrote: post #37

Has anyone put forward some theories as to how they are pulling this off? Are they tapping into iMessage Metadata, scanning crash logs, or something along those lines? While I totally understand the need for them to keep how they are doing this private, I do find it slightly concerning. Unless they are just flagging suspicious iCloud login attempts. If it’s relating to crash logs, it would be nice to know as I’m sure…

I assume they have iMessage metadata on what accounts the NSO accounts talked to. The contents are E2E encrypted, but unless they have explicitly promised not to keep logs, they probably have the metadata logged.

Apple claims in their lawsuit that they have over 100 false iCloud accounts that were created, and is confident in their identities to the degree they are going to use them for standing to prove that NSO signed a legal agreement in the lawsuit.

In which case, NSO f!@#ed up and left iCloud Messages Backup enabled, which stores unencrypted copies of the End-to-End messages and makes it trivial for Apple to alert any person that these accounts messaged to. That's one possibility.

Re: Apple will notify users about state-sponsored cybersecurity threats

#47

Post by onethought »

smoldesu wrote: post #30
BluSyn wrote: post #15

I see a lot of pessimism in the comments. But I think this is a great step in the right direction. Other companies should take note. More of this, please!

I might care if Apple had a history of protecting US citizens from their own government, or shielding Chinese users from their own tyrannical surveillance systems.

??? Are you referring to the storing of encryption keys for iCloud in country?

Re: Apple will notify users about state-sponsored cybersecurity threats

#48

Post by smoldesu »

onethought wrote: post #47
smoldesu wrote: post #30

Earlier quoted context omitted.

I might care if Apple had a history of protecting US citizens from their own government, or shielding Chinese users from their own tyrannical surveillance systems.

??? Are you referring to the storing of encryption keys for iCloud in country?

No, I'm referring to Apple's continued cooperation with surveillance agencies across the United States and all associated governments through the FIVE EYES program. The fact that your Macbook's security keys are trivial for the government to acquire is besides the point, but potentially germane if you, well, trusted your laptop in the first place.

Re: Apple will notify users about state-sponsored cybersecurity threats

#50

Post by onethought »

smoldesu wrote: post #48
onethought wrote: post #47

Earlier quoted context omitted.

??? Are you referring to the storing of encryption keys for iCloud in country?

No, I'm referring to Apple's continued cooperation with surveillance agencies across the United States and all associated governments through the FIVE EYES program. The fact that your Macbook's security keys are trivial for the government to acquire is besides the point, but potentially germane if you, well, trusted your laptop in the first place.

Can you provide citation for this? Also how they are different from any other tech company?

My MacBooks security keys are not trivial to acquire because they aren’t in icloud.

In some of the countries in five eyes nations, you don’t have a choice about cooperating or not.

But what do 5 eyes have to do with Chinese users?

Post reply on HN