4 ms·
IMO the US intelligence apparatus likely already has Apple's publisher keys (we know they had Microsoft's at one point for Stuxnet, so this is entirely plausibl
by exelius 11y ago
IMO the US intelligence apparatus likely already has Apple's publisher keys (we know they had Microsoft's at one point for Stuxnet, so this is entirely plausible). The FBI is far less advanced than the NSA/CIA on computer crime/crypto, likely to the point the NSA/CIA would not share information with them for fear of its existence being leaked through an overzealous investigation of a mass shooter who almost certainly never interacted with anyone in ISIS of any importance.
This is probably a gambit by the FBI to get access to this type of data for their other criminal investigations. If it is publicly known that the FBI has a way to break iPhones, they can lean on the NSA/CIA to provide more effective methods (without breaking cover of the existence of those methods.)
IMO a better tactic is the one the NSA has taken: let the industry build it, and we will hack it. This is just better tradecraft because it lulls targets into a false sense of security. Look at the engineering behind Stuxnet and the Equation Group viruses - these guys are obviously in another league from the FBI (and likely even from Apple). Given the gap in skills and mission, I don't blame them for not trusting the FBI.
- rrggrr 11y agoAs I listen to former NSA director Hayden advocate for end-to-end encryption, given the agency's mission, I'm inclined to agree with you. http://www.bbc.co.uk/programmes/p03jtdn2 http://www.bbc.co.uk/programmes/p03jtdn2
- lawnchair_larry 11y agoYou have some details mixed up there. Stuxnet did not use any domestic certificates. You're likely thinking of Flame, which still did not involve stealing keys or certificates, but rather exploiting a flaw relating to how certificates were issued to the general public.
- exelius 11y agoWell, just remember that when you're dealing with clandestine agencies like CIA/NSA, they can probably either turn or place an asset in one of Apple's security teams and get access that way. Their evidence collection methods don't have to hold up in court.
- TACIXAT 11y agoWell, you should edit your post so it is accurate.
- mspecter 11y agoYeah, stuxnet used a stolen signing cert from Realtek.
- exelius 11y agoYeah, just saying that with Apple's level of access to the information on people's phones, it would be a very attractive target - and the best way to obtain access and keep it would be an insider. The NSA/CIA are spy agencies, after all, and they DEFINITELY have the capability to infiltrate a company like Apple (either through a vendor or by getting an agent on Apple's payroll).
- awqrre 11y agoSeems like the NSA does trust other law enforcement agencies at least to a certain level, with the use of parallel construction for illegally obtained evidence [1]. 1. https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction