Imagine being in a political party while private intelligence contractor give you access to all the emails from the other side. You can know where all the activists are at any moment, and what the internal conflicts are, and what areas is focused. What would be your reaction if phones suddenly started to get encrypted?
While I'm against mass surveillance, I think that targeted surveillance can be a good thing. By nature of it being targeted, it is expensive to use on more people than necessary. The kind of spying the CIA would enable through compromising Apple secrets would be restricted to high-value targets if for no other reason than to ensure none of their targets knew they had that capability.
There are bad people out there, and we expect our government to stop them.
Somehow we have been doing fine under the constitution for 200 years. Now a dozen men kamikaze a building, and we have to take away everyone's freedom in order to protect them?
F that. Police and the executive branch are just being lazy. Get off your ass, do some human intelligence, investigate leads, and get a warrant if you have probable cause. Otherwise, get the hell out of my email.
When the chances of being killed by police are 55x higher than being killed by a terrorist (or whatever the recent number was) and we want to give the State more power, we are fools.
The FBI (who is responsible for all intelligence conducted in the USA, against foreigners or Americans) is absolutely required to get a search warrant.
The iPhone is one of the most popular phones in the world. Is it that crazy that the CIA is interested in them for intelligence gathering purposes?
The point the original commentor was trying to make is that this type of work is much more preferable to the mass collection that you're referring to from the Snowden documents.
Edit to expand on "should be doing": at the very least, they ought to explore such vulnerabilities as a defensive measure since their counterparts in every other State are clearly doing the same thing whenever they have the capability.
The reason for mass surveillance is control of the populace. Mass surveillance clearly doesn't prevent terrorism: most of this 4th-Amendment-violating dragnet surveillance was in place well before the Boston Bombing, and nobody caught the Tsarnaevs.
So, I'm not a little torn, either: the CIA shouldn't be looking to crack iPhones, they should be looking to beef up iPhone security to keep those other nations from doing unethical stuff. Exploiting vulnerabilities for surveillance purposes is a bad thing all around. Close them holes!
I do not believe that the CIA, as it seems to exist today, is capable of doing that manner of subversion in a targeted way, they have gone rogue. I do not think that the CIA allows itself to be overseen. That part of the question is just not possible to answer.
The CIA, as it appears now, does a huge number of unethical and apparently illegal things. It appears to be beyond oversight or control. I do find it really hard to support any action by them, just as I would find it hard to support FSB or MI6 actions. The CIA appears to be a threat to civil liberties and representative democracy in the US itself right now.
But you're falling into a rhetorical trap: just because coffee is hot, you don't wait until the coffee is cold to drink it. You can judge relative degrees of hot, just as we can judge relative degrees of unethicality. It's pretty darn bad to assassinate US citizens without due process, and I'd say due process in public, whether the citizen is abroad or on homeland soil. It's pretty darn bad to torture anyone. It's less bad to attempt to crack iOS to spy on people, and it would be even less wrong to explore the exploitability of iOS. The latter may not be wrong at all. It's completely OK to analyze open source intelligence.
They were on the radar but you really can't arrest someone until they do something.
Edit:: link for more info
I did read that link, along with many other linked pages from the original link.
See here: https://www.aclu.org/national-security/president-obama-signs...
And here: http://www.salon.com/2011/12/16/three_myths_about_the_detent...
There does seem to be a lot of debate on this topic regarding the wording of the bill and how it applies to US citizens. However, to me, the wording seems very vague and open to interpretation. Which was likely on purpose.
by manipulating Xcode, the spies could compromise the devices and private data of anyone with apps made by a poisoned developer — potentially millions of people ...
The focus of the security researchers, as described at the CIA conferences, was to target the GID key, which Apple implants on all devices that use the same processors. [...] So, if intelligence agencies extract the GID key, it means they have information useful to compromising any device containing that key.
Just like the intelligence gleaned from breaking German WWII encryption was limited?
If information can be non-invasively extracted, then there is only an operational limit on use. And isn't knowing mass information just as wrong as acting on mass information?
Unless it's a computationally-expensive attack (which are getting more infeasible now that key sizes aren't technically as limited), you run into the encryption problem: either everything being encrypted is okay, or nothing being encrypted is okay.
That's the nature of secrecy.
13 years since the latest trauma. The federal government and its propaganda broadcasters have been dwelling on the specter of "terrorism" a lot longer than that. Watch media from before 11SEP2001 and you'll remember the same disproportionate focus and overreaction for many other events.
This machine is much more than a decade old. We're just starting to notice the bubbles at the bottom of the pot.
Enough with the hand-wringing. Enough with the "somebody needs to do sooooomething!". Just stop. Staaaaahp.
How long has our industry been spying on users? How much money have we made aggressively mining their data? And now, now, "These People Have Gone Too Far!"?
Everyone's got the tools. Everyone's got the knowhow, either themselves or online. Write code or quit bitching.
To the slightly different point given by poster: we have the power to broadcast this message of fearlessness to the populace at large, because we own their media. How hard a social media campaign would it be to overcome the fear and paranoia the .gov and mainstream media use?
Also, note that that same fearless attitude is directly contradicted by very popular social movements right now in certain consumer gaming industries. You're liable to end up with very strange bedfellows and enemies.
There's too much money at stake for those at the top for this to be stopped. Lucrative contracts for all their buddies whether it's in consultancy or providing military hardware and software.
I mean the fact that congress keep ordering tanks the military themselves have proclaimed loudly that they neither want nor need should be setting off alarm bells everywhere, and yet it seems to just get brushed over.
It's what their constituents want.
They are (by and large) not doing that sort of thing out of some scheming to enrich themselves. They want to be reelected to their next term, and delivering some federal cash and contracts to your district is the perfect way to do that.
Wrong, and selfish.
We have American agencies attacking innocent people everywhere in the world "because terrorism".
Or , Walker gave crypto info to decrypt Navy messages. For a few grand a month. There's plenty more listed even on Wikipedia. The amounts involved seem... not that high.
Now, sure, Apple almost certainly has higher security. (Quote from the above spy: "KMart has better security than the Navy.")
But with state level resources, do we think employees can be flipped? Or, why is the NSA not getting to grads early on, helping their career, while having them really be agents all along?
I'm on my phone and can't find the reference now, but there was a young physicist that leaked into on atomic weapons purely because he felt the US shouldn't have a monopoly on the capability. The chance that some bright, highly-sought, employee feeling that the US should have spy capabilities is approximately 1.
Is every remotely sensitive employee routinely monitored? Their families? They never get into " life threatening " scenarios? Or embarrassing scenarios that they might feel is the end? (For some, that's as simple as getting a mistress pregnant, and not being able to bear others knowing.)
Just seems like the human employees have got to be compromisable in one form or another, given the resources of the NSA and CIA.
It would be naive to think that they (and other agencies around the world) aren't already doing this.
The NSA/CIA/FBI almost certainly do have moles working within the major tech companies. As do the intelligence agencies of China, Russia, the UK, France, Germany and Israel.
Try this experiment: Ask a group of 5-10 people around you to raise their hands if they've been pissed off at any branch or level of their government. Then ask them to keep their hands up if they've contacted their representatives about that issue. Finally, ask them if the method of contact they used was the phone or written (not email) letter.
I'll bet dollars to donuts that not a single hand will be in the air.
You and I are the problem because we don't hold our representatives accountable. We really only pay attention (and marginal attention at that) during election time by buying into the campaign bullshit. At best we sign an online petition but the politicians barely care about that. They know that its easy even for the most apathetic to click a button. Sure, in cases like net neutrality it can get their attention but I'll submit that what really got their attention was the number of phone calls they were getting.
Yes, I specifically am to blame because I haven't called or written my representatives. That's going to stop. We need to be on the horn with these people frequently. Weekly. When they're in town we need to be in their faces. They said, "If you see something, say something." Well, I see corruption and I'm going to point right at them and tell them. Will you join me?
EDIT: I should add that we need to be contacting them when we approve of the work they're doing. They need data. Most of the feedback they receive is negative (and for good reason) but without positive feedback they're left searching and unfortunately the guys who claim to have the answers are the lobbyists. But remember, there are around 15,000 lobbyists in Washington D.C. but 131,144,000 voters voted in the 2012 Presidential election. I like our chances, if only we get involved.
How many months did that work?
It is true that the system must represent the people. If and when it does not - whose fault is it? It can not be the people. We don't design people. We design a system to conform to the people, to communicate with them and to represent them.
And it doesn't even take much. Can you really not spare a 5 minutes once a week to call your representatives? Think about if more people did this. Suddenly those lobbyists voices would get a lot less powerful.
Yes we can bother these people about allowing gay people to marry (or not, or whatever) but when can we ask them not to cause revolutions around the world (like now in Venezuela) and then intervene with bombs and 'bring Capitalistic freedom' by fixing American private investment in their resources?
You can make noise about some things, but they either will not last (re Syria) or they will not listen. Other strategic objectives, international agreements and private investment come first.
How are you going to immediately and suddenly alter 300 million people to spend multiple hours a week to sift through the reams of propaganda and PR (whose voices rise above political realities) to come to independent and critical political and social analysis? That's a huge lifestyle change - we can't even get 300 million people to turn off the lights when they exit rooms to save electricity. If people on the whole want to enjoy hobbies, entertainment, family and work instead of being full time politicians and investigative reporters can we snub them for that?
We need a system that can work with people who are busy living their (plebeian) lives but is still able to represent their interests. Someone might say that this isn't possible - but then are they not saying that representative democracy is not possible?
No they wouldn't. Lobbyists represent moneyed interests. You don't. You're just one person.
Seriously, you are committing two mistakes here. The first mistake is to assume that your letters and phone calls to representatives actually matter. The second mistake is to assume that your representatives have any power to stop our rogue intelligence agencies, particularly the NSA.
I want to address the second one first, because it's more important. Simply put, the NSA is out of control. They have an extremely sophisticated apparatus in place that has been growing exponentially in complexity and reach since immediately after 9/11, and they have the balls to lie to the Congress about it while under oath. And there are secret courts - secret courts! - that seem to give them blanket approval with absolutely zero accountability. An organization like that cannot be stopped, not just because it's political suicide to try to stop them but also because it would genuinely cause a lot of collateral damage.
But the other point is also worth addressing. The idea that writing or calling your representatives actually affects anything is an illusion. An illusion that must be maintained to keep things stable, but an illusion nonetheless. Because here's what actually happens when they get a letter from you: they skim through it and send you a canned response. That's it. Your opinion does not matter unless you have deep pockets and are an existing or potential donor. This is difficult to accept for some people but it is the reality.
Sorry. I'm not defeatist enough to do that.
If you call your representatives once a week, it's not going to hurt so I encourage you to do so. It's just not necessarily the solution.
Look; Its going to be hard. Its going to take a long time. So? Isn't it worth it?
I wonder how many people are genuinely afraid of raising their own profile in such a way. I'm not American, but I would certainly be partaking in any political action against the actions being discussed here.
Although as it is, I'm very hesitant to even level criticism at the CIA on HN. I'm by no means an important person, but from what we've learned I don't even want to register on the radar of these entities.
I understand where you're coming from, and clearly it's an individual choice, based on one's judgment of risk vs. reward. But let me add that when people choose that position, it just makes it that much easier for these guys to keep doing what they're doing, and getting away with it.
FWIW, I routinely criticize the CIA, NSA, etc. here, on Twitter, on Facebook, etc., using hashtags like #fuckthecia, #fuckthensa, etc. and nothing bad has happened to me as a result.
How can you be certain? How many really successful job interviews have you had since you started your one-person campaign, where the hiring company inexplicably dropped you like a hot potato? Do you regularly check your credit rating to see if weird stuff is showing up? Have your bicycle tires quit holding pressure?
I ask the last question because East Germany's Stasi did that sort of thing (https://books.google.com/books?id=GlbAmn_cajYC&pg=PA160&lpg=...). The USA "national security" establishment/"intelligence community" gets unbelievable amounts of money, that they must spend. Why not make and use "smell chairs" or randomly screw with people that openly oppose the deep state?
Well, that's a fair point, so maybe I should say "nothing overt and noticeable has happened as a result." Beyond that, I could speculate about really subtle stuff, but that strikes me as a sure road to a level of paranoia that I don't want to engage in.
Three years ago, almost everyone laughed at folks who claimed the NSA was watching everyone. Now, it's an article of faith, and there's some evidence that people have changed behavior because of that faith.
Any sufficiently advanced level of precaution is indistinguishable from paranoia. That East German activist was probably a little puzzled by flat bicycle tires, but probably shrugged it off. What are we all shrugging off today? Stock market weirdness? Oh, that's just HFT, right?
It's known that folks profited off of "top secret" CIA-led coups in the 1950s (http://tuvalu.santafe.edu/~snaidu/papers/coups.pdf), so it's not out of the realm of reason to look at the stock market today to see if the current "intelligence community" is profiting.
That's a good question. Why are you asking? Who do you work for? What are you going to do with this information?!??
Just kidding... it is a good question, and I don't have a perfect answer. I guess I'd say the level of paranoia is too much when you reach the point of diminishing returns... that is, when it turns out that, even if you're right, knowing that doesn't help you because there's nothing you can do about it.
So, maybe an NSA agent sneaks into my parking lot every night and lets a few pounds of air out of my right rear tire. I can't prove that doesn't happen. But what am I going to do, camp out in my truck all night with my pistol at hand, hoping to catch the guy in the act? Not practical. Hire a private security guard? Not practical either. Etc., etc.
Thankfully, for the most part, its not dangerous (yet) to exercise our right to contact our representatives.
But that is the exciting part, pretending that the CIA is concerned about you, or even knows that you exist.
why should we have to use the phone, or a paper letter, when email is as good, or even better?
(a) it has dozens of companies that create technology the rest of the world uses, and
(b) it has a govt. that secretly works to undermine the technology developed by those companies.
You're not going to hear about many foreign govt's actively hacking their country's software products, simply because they could easily/secretly armtwist cos. into installing backdoors at the beginning. Take China for instance - do we think it needs to hack into, say, Huawei phones or Wechat? I don't think so.
As a foreigner, that is why this "fight" between US software cos. and its govt. is so fascinating. It's made possible through a unique combination of capital, freedom and history. And I hope it remains that way, for the sake of the rest of the world too.
The only reason you're hearing about this is because it's good PR for Apple, after their intimate relations with the security apparatus were exposed.
The good things in the article are two-fold: firstly, Apple haven't just capitulated and handed over whatever is asked of them, and secondly the documents about the effort don't specifically mention any sort of success which could be interpreted as the agency failing. Of course, if they had been successful I imagine they'd keep as quiet as possible about it.
Regarding Apple not capitulating, I'm giving them the benefit of the doubt, and assuming that they're telling the truth, but wouldn't the NSL system mean that Tim Cook couldn't reveal if Apple had been forced to release data?
I'm hoping that he has a personal warrant canary policy, and would just remain silent if asked about something he can't talk about.
This would be, of course, one of the hardest tests of professional principles you could imagine a CEO going through. I personally think Mr Cook would be a good candidate for passing this test, as he seems to have a track record for standing up for what he believes in.
I also have a feeling that the US government would think twice before taking on the Apple PR juggernaut head to head. It would be too closely matched for comfort. Apple probably have greater mind-share than any of the political parties.
As you say, it would be an interesting standoff!
Now, this is obviously happening to Google, et al, as well, so a joint action by the captains of industry — an appeal to the public more than the court — will be more effective.
It is not from the benevolence of the butcher, the brewer, or the baker that we expect our dinner, but from their regard to their own interest. ~~ Adam Smith
That said, I'd personally like to see less power aggregated into the hands of both governments and big mega-corporations. But the big difference between the two, to my mind, is that governments have a near monopoly on "legitimate" use of force, and have lots of men with guns, tanks, bombers, nukes, etc. at their disposal. Corporations mostly lack those things, except to the extent that they collude with the governments.
The government's monopoly on legitimate use of force is more relevant in less developed countries. Here, you can do more damage more easily by attacking computer-controlled infrastructure. (Imagine if the NRA was pointed at the real threat? Maybe they'd look a little like Anonymous.)
The first bit of the article is very big about compromising XCode, and I couldn't help but think that Lockheed basically just got the .gov to pay them to "rediscover" Reflections on Trusting Trust.
This raises so many questions, among them:
1) What was [edit: would be] the criteria for serving up a poisoned version instead of a real version of XCode to a dev? Was it [would it be] limited to downloadable versions or were DVD software copies affected too? One possibility came to mind: Does XCode come in different flavors based on county of sale/download, language, or a combo of the two? If so, would that be that criteria for their attempt to not target US citizens, by crudely targeting non-US and/or non-English app developer accounts? Because that would be the fakiest attempt yet at trying to claim plausible deniability, since so many apps with mainly American userbases are developed by overseas devs.
2) If a dev had a poisoned version of XCode, how could they not see a mysterious server being pinged during their development of the app? How could Apple not see something amiss during their QA of the app before they pushed it to the store?
3) If I were an evil genius Big Brother no holds barred government, I'd want data from messaging apps, social networks, and geolocation apps most of all, less so from things like single-player games. Thoughts on which apps are likely to be in the top 5 of their wishlist?
4) Does this mean that PhoneGap / Cordova / non-native HTML5 apps really are better? :-)
Say, why did Facebook change to a native app again?
5) The whole point of this proof-of-concept seems to be to have unsuspecting, innocent devs who build regular boring apps, like Tinder For Dogs or whatever, unknowingly build the app using poisoned XCode. That way, when Mr. Bad Guy eventually installs Tinder For Dogs on his iPhone, the CIA gets a secret backdoor to his entire phone.
But this seems so overly complicated! If the CIA already has a payload that phones home, why didn't they just build their own apps? Why rely on poisoning a dev environment in the vague hope that Mr. Bad Guy will someday download this particular app? What if Mr. Bad Guy doesn't even have a dog?
Also, I wrote above that an intelligence agency would not likely be interested in getting data from something like a single-player game. There's probably nothing useful to learn about there, other than Mr. Bad Guy's high score.
But maybe that dumb game was the Trojan, not the target. Mr. Bad Guy may be too smart to use SnapChat, but perhaps he installed FarmVille or Angry Birds to while away the hours...?
So I'm not sure why you are referencing Facebook switching from a WebView-based app to a more native approach.
In addition, if the Xcode installation was compromised nothing should be considered safe on that device going forward.
Of course this is all very hypothetical unless someone finds an example in the wild.
> All it takes is a single request from a victim passing a wiretap for exploitation to occur. Once the QUANTUM wiretap identifies the victim, it simply packet injects a 302 redirect to a FOXACID server. Now the victim’s browser starts talking to the FOXACID server, which quickly takes over the victim’s computer.
... or doesn't take over the victim's computer, but provides a download of a poisoned Xcode.
These motherfuckers have compromised the whole internet.
But I edited my comment to include your point: no hard proof that this technique was used...yet.
The article quotes Steven Bellovin: “Their attitude is basically amoral: whatever works is OK.” If you forgot the article, could you tell who this is talking about? The government or the corporations? It seems like it fits both pretty well. The two entities both have a lot to gain from cooperating. Why wouldn't they? Whatever works.
My guess is Tim Cook agreed for the same reason Microsoft agreed to do the same thing long ago, and now again with the new program - to get government contracts, such as the one where Apple Pay will be used to get federal services and with the plan to use Passbook or whatever as driver license in the future. Apple actually announced this in the very same day they announced it will share cyber info with the government, so it's not even trying to hide it.
I doubt Steve Jobs would've compromised the same way. As we've seen from the leaked Snowden charts, Apple only entered PRISM after Steve Jobs died.
As for Microsoft, I won't even waste my breath. They would sellout anyone for an extra million dollars. They only fight against this stuff when it seems to be publicly damaging them, because they don't want to lose billions of dollars in revenue from abroad because of this issue. So they would have no problem giving US authorities data from abroad, as long as it's still secret. Once it gets public they will "fight hard" against the practice.
I assume copypasta error? I'd still appreciate it if you have any links, as I'm trying to map out the various accusations and counter-accusations in the Snowden case. It's a good study in information warfare :-)
> Glenn Greenwald/Snowden is now suspected of doing PR for tech companies
Which is not
>a PR campaign coordinated between the US govt and US tech companies
Suspecting PR collusion yes, but on the wrong side.
They have ACTUALLY done bad crap. This is normal security research. There is no need to blow normal research and security work out of proportion. Xcode is signed, they can't just modify it and let it go. The OS X updater is also likely secure and maybe they just figured out how to trick their own computers to install a keylogger. Good, but it probably doesn't work that well. And it's fine! It's research!
Lets focus on the actual violations, not the tools. Exploits and social engineering doesn't compromise: people do. Focus on the people who broke the rules which make sure our country isn't manipulated in to an oligarchy.
Is normal security research done with the goal of finding/creating holes with the purpose of keeping them secret in order to use them as attack vectors without letting the owners of the compromised systems know about the vulnerabilities?
What's bad about this is the purpose of the research (not to discover and strengthen security, but instead to destroy it), combined with the weaponization of it (the entire goal of doing the research is to use the exploits), and the actor carrying out the attacks (the state).
It's obvious on its face why this is alarming.
At DEFCON, exploits are publicized so that software vendors and algorithm developers are motivated to strengthen the security of what they produce so that the software that all of use is more effective against attackers.
>At the 2011 Jamboree conference, there were two separate presentations on hacking the GID key on Apple’s processors. One was focused on non-invasively obtaining it by studying the electromagnetic emissions of — and the amount of power used by — the iPhone’s processor while encryption is being performed. Careful analysis of that information could be used to extract the encryption key. Such a tactic is known as a “side channel” attack. The second focused on a “method to physically extract the GID key.”
I mean whether they've backdoored the regular version available to all or only those in use by specific developers, the implication (to me) would be that binaries/applications/etc produced would then be automatically backdoored or at very least weakened?
Disclaimer: I know zip about Xcode or dev in the Apple ecosystem
The trouble with the means justifying the ends, is that ends are fictions invented to enable the telling of stories. Outside the structures required for stories, there is only ever really the means.
"Preempt threats and further US national security objectives by collecting intelligence that matters, producing objective all-source analysis, conducting effective covert action as directed by the President, and safeguarding the secrets that help keep our Nation safe."
Historically the CIA and NSA have a competitive relationship, they vie for the same funding. I would think pursuing iPhone security would cross into the NSA's domain and that they wouldn't appreciate it, however the CIA has a budget 50% larger than the NSA and I'm sure they'd like to keep it that way by staying relevant.
While much of the iOS is Open Source or Free Software, the end-user can't really inspect the source that went into their particular device.
Note that, to the extent that the CIA steals Apple secrets from foreign sources, they may not be violating any US laws. However Apple does the vast majority of its system software development in Cupertino, California.
My next phone is going to be an Android that enables me to completely replace its firmware binary. While this does void the warranty, rather than having to be concerned about potentially skanky jailbreak exploits, one more or less just sets a flag with an Android SDK command-line tool, then you can install your own firmware.
That will be of limited use in protecting me against hardware backdoors, but at least it will let me pretend that America is still The Land Of The Free.
Among the reason I am so adamant about stuff like this, and that I use my real name when I post about it so publicly, is that I am related to Roger Sherman, the fourth signer of the US Declaration of Independence, as well as to William Tecumseh Sherman and George B. McClellan, the two Generals-in-Chief of the Union Army during the American Civil War.
My mother was an active member of the Daughters of the American Revolution; I myself am entitled to membership in the Sons of the American Revolution.
It looks like the development team could use some new contributors.
My next phone is going to be an Android that enables me to completely replace its firmware binary.
Component firmware and device drivers will still be binary blobs. You need to go a level deeper than that.
The loophole(s) may have been closed, but I doubt Apple left them voluntarily.
We know about the incredibly close ties between silicon valley and the military. We know that the US government collects anything and everything, and that US corporations are complicit (or made to be complicit) in the act.
It is most likely that Greenwald was leaked these documents to create a facade of government-corporate animosity to revive trust in US corporations, all the while there existing a backdoor to facilitate snooping.