8 ms·

Most software already has a “golden key” backdoor: the system update

184 points by discreditable 11y ago

facetube 11y ago
The article claims that forcing Apple to write the software "isn't a big deal, as they could pay someone to do that". If the software malfunctioned and/or erased evidence on the device, who would be liable?
- xlayn 11y ago
  Well, the article mentions that; but the main point is update mechanisms are a single point of failure, because it's by design a way of delivering a change that will be applied an run as a root. On the other hand it does also lacks a reference or numbers on how many times it has been exploited.
  - natch 11y ago
    That's why updates only happen when the user accepts the update after authenticating themselves.
    - DavideNL 11y ago
      Exactly, that's the part i don't understand yet... Why doesn't Apple create a mechanism which "only allows updates to be applied after the correct pin is entered"? Then, an update created by the FBI, which would disable security mechanisms, could not be installed (without knowing the correct pin).
userbinator 11y ago
Remember when software didn't need updates almost every day? It seems like we've regressed in terms of quality and the general principle of doing it right the first time. I understand that some things do change and bugs do occur, but I don't think everything needs to, nor should the rate of bugs being found be anywhere near what it is today. Personally, I prefer stability over "new features", turn off automatic updates, and read changelists carefully. Anything which doesn't have a good description and rationale of why it needs to be changed, and how that is relevant to my usage of the software, doesn't get changed. (And software which doesn't give me the option of doing so, doesn't get used either.)
- otabdeveloper 11y ago
  > Remember when software didn't need updates almost every day? I'm old enough that I actually do remember those days. Back then we had "works best with Internet Explorer" and MS Office viruses. I don't want to go back to that world, rolling updates make the world better for everyone.
  - zokier 11y ago
    I think the timeframe OP alludes predates works best with Internet Explorer and Office viruses by a decade.
    - uxp 11y ago
      Oh, so decades before semantic versioning, where an update was shrink-wrapped in a cardboard box on a shelf at the nearest Computer City and resulted in an entire night of floppy disk swapping instead of working? Those really were the days...
- xlayn 11y ago
  >"Remember when software didn't need updates almost every day? It seems like we've regressed in terms of quality and the general principle of doing it right the first time" Keep in mind that the new environments for any pc now is interconnected, as such a mechanism to deliver fixes quickly is actually more a solution than a problem. For reference, take a non patched xp, connect to the internet and search for "how to get thin while eating" and your system will automatically install a antivirus for you ;) >"I prefer stability over "new features", turn off automatic updates, and read changelists carefully. Anything which doesn't have a good description and rationale of why it needs to be changed, and how that is relevant to my usage of the software, doesn't get changed." for that you need to become an expert on anything become patched or updated. second, it may be more about how someone else would use your system than you... as in an exploit.
  - tdkl 11y ago
    > as such a mechanism to deliver fixes quickly is actually more a solution than a problem. It's not a solution, it's an excuse for lazy testing. Same as better hardware supported sloppyness in engineering, turning a 15MB CD/DVD burning software to 500MB+ software package (software starts with a "N").
xlayn 11y ago
>"Being free of single points of failure should be a basic requirement for any new software distribution mechanisms deployed today." As in write error-free software?
stavrianos 11y ago
But, at some point there must be trust. If you don't trust software, you can try to sandbox it, but now you have to trust the sandbox. This devolves very rapidly. Open source at least provides a facsimile of recourse - just go read the code - but how much of your currently-running open-source code have you actually read? For that matter, if you had, could you be confident that you'd understood it? The Underhanded C Contest is a thing, after all. A sufficiently paranoid individual can only run code they wrote themselves. Or, they can choose to run code without a strong understanding of what it's doing. If Apple subverts their updates, that's mostly interesting as a signal of their trustworthiness moving forwards. The coolest thing about this is that we know it's happening at all, I think.
- jMyles 11y ago
  > Open source at least provides a facsimile of recourse - just go read the code - but how much of your currently-running open-source code have you actually read? Wait, what? That is not the recourse that open source provides. The great thing about open source is that you don't need every person to read the code, just one person who can either catch or verify the absence of user-abusive material. Moreover, even if zero people read the code today, it is preserved so that state (or corporate) abuse can be revealed later, providing another disincentive to introduce abusive material.
  - marcosdumay 11y ago
    How do you know you are running the same software that everybody else is reviewing?
    - jMyles 11y ago
      Surely you aren't suggesting that a reasonable answer is to read the code yourself and compare it to a known version? Obviously, the mainstream way is a hash-based file verification. Which again, everybody needn't do - only a small number - in order to catch a bad actor in the act. But I presume you are trying to make some bigger point. What is that?
ape4 11y ago
A system update is how Apple would install a backdoor, if they were forced to.
whoopdedo 11y ago
The important difference between a FLOSS system like Debian versus the walled garden of Apple is the ability to choose which keys you trust. If I lose trust in one of the Debian signers I can remove that key. I can select a different repository to download packages from. Or I can stop accepting updates and apply patches manually. As to a key being a single point of failure, PGP allows for multiply signed documents. Couldn't Debian require packages to be signed by at least two keys?
natch 11y ago
This is why EFF urges that software makers (applies to makers of hardware too, if there is a software component) should always keep the end user in the loop of deciding whether to accept updates.
mtgx 11y ago
Maybe it's time to ask Google to ask for permission before updating Chrome?
deleted 11y ago
[deleted]
vonklaus 11y ago
this is totally correct. I agree with everything he says. However, in a world where everyone uses: Android Chrome Google DNS Google Analytics Google Authenticator Google Certificates (issue and validate) Hangouts Gmail Google Docs Many machine learning is run on google code using google opensourced software. search chromecast maps google connect (starbucks, other retailers) google domain registration google chrome/webkit google wallet google playstore google CDN for serving code/fonts/libraries google self driving cars are coming ================================= I am not saying google is bad. Not even referencing this article because I think it was well thought out and there aren't that many people even saying this, although it is fairly intuitive, but the larger paradox is this: Many people talk about some database being sloppy and how they would have it replicated, maybe even a cold backup in AWS glacier on top of the backups, and yet the world is using like 3 stacks: google, apple and microsoft. Outside of this community, and a few other places, it would be highly unlikely someone is running their own openwrt router and have freebsd on their computer, fully encrypt all their emails and run their own mail server, don't own a cellphone and use garmin to navigate AND all of their network does this too and therefore they are insulated sufficiently.
studentrob 11y ago
> Is it reasonable to describe these single points of failure as backdoors? Yes. The case that Apple is making is, in part, that the FBI is forcing them to use a back door by putting Apple's stamp of approval on it with their signing key. Whether or not you agree that Apple must create the back door or not, they are still being asked to approve its use. Apple says this is compelled speech and violates the first amendment. Their brief has more details about it. The Tech Dirt summary has the most details [1]. Here's one notable passage, “The government asks this Court to command Apple to write software that will neutralize safety features that Apple has built into the iPhone in response to consumer privacy concerns... This amounts to compelled speech and viewpoint discrimination in violation of the First Amendment.” > I think many people might argue that industry-standard systems for ensuring software update authenticity do not qualify as backdoors, perhaps because their existence is not secret or hidden in any way. It's relative. That used to be somewhat hidden. Now it's very out in the open. > Having access to a "secure golden key" could be quite dangerous if sufficiently motivated people decide that they want access to it. Yeah. So let's not compromise Apple's existing security procedures by forcing that out in the open. > I expect that in the not-too-distant future, for many applications at least, attackers wishing to perform targeted malicious updates will be unable to do so without compromising a multitude of keys held by many people in many different legal jurisdictions. I hope this day comes soon. For now, let's continue fighting for our right to privacy. [1] https://www.techdirt.com/articles/20160225/15240333713/we-read-apples-65-page-filing-calling-bullshit-justice-department-so-you-dont-have-to.shtml https://www.techdirt.com/articles/20160225/15240333713/we-re...
cmurf 11y ago
Over the weekend, Apple pushed an update to a kernel extension exclusion list that broke ethernet for thousands of users. There was no notification of this update, it simply got pushed and installed, suddenly ethernet broke - as in, not even visible to the system because the ethernet driver (kext) was disallowed from loading. So... yeah it's a mistake, annoying. But we're in some sense expecting much more privacy, security, reliability of our mobile devices than our desktop systems. And I think that's an interesting shift in expectations.
deleted 11y ago
[deleted]

184 points by discreditable 11y ago

The article claims that forcing Apple to write the software "isn't a big deal, as they could pay someone to do that". If the software malfunctioned and/or erased evidence on the device, who would be liable?

xlayn 11y ago
Well, the article mentions that; but the main point is update mechanisms are a single point of failure, because it's by design a way of delivering a change that will be applied an run as a root. On the other hand it does also lacks a reference or numbers on how many times it has been exploited.
- natch 11y ago
  That's why updates only happen when the user accepts the update after authenticating themselves.
  - DavideNL 11y ago
    Exactly, that's the part i don't understand yet... Why doesn't Apple create a mechanism which "only allows updates to be applied after the correct pin is entered"? Then, an update created by the FBI, which would disable security mechanisms, could not be installed (without knowing the correct pin).

userbinator 11y ago

Remember when software didn't need updates almost every day? It seems like we've regressed in terms of quality and the general principle of doing it right the first time. I understand that some things do change and bugs do occur, but I don't think everything needs to, nor should the rate of bugs being found be anywhere near what it is today. Personally, I prefer stability over "new features", turn off automatic updates, and read changelists carefully. Anything which doesn't have a good description and rationale of why it needs to be changed, and how that is relevant to my usage of the software, doesn't get changed. (And software which doesn't give me the option of doing so, doesn't get used either.)

otabdeveloper 11y ago
> Remember when software didn't need updates almost every day? I'm old enough that I actually do remember those days. Back then we had "works best with Internet Explorer" and MS Office viruses. I don't want to go back to that world, rolling updates make the world better for everyone.
- zokier 11y ago
  I think the timeframe OP alludes predates works best with Internet Explorer and Office viruses by a decade.
  - uxp 11y ago
    Oh, so decades before semantic versioning, where an update was shrink-wrapped in a cardboard box on a shelf at the nearest Computer City and resulted in an entire night of floppy disk swapping instead of working? Those really were the days...
xlayn 11y ago
>"Remember when software didn't need updates almost every day? It seems like we've regressed in terms of quality and the general principle of doing it right the first time" Keep in mind that the new environments for any pc now is interconnected, as such a mechanism to deliver fixes quickly is actually more a solution than a problem. For reference, take a non patched xp, connect to the internet and search for "how to get thin while eating" and your system will automatically install a antivirus for you ;) >"I prefer stability over "new features", turn off automatic updates, and read changelists carefully. Anything which doesn't have a good description and rationale of why it needs to be changed, and how that is relevant to my usage of the software, doesn't get changed." for that you need to become an expert on anything become patched or updated. second, it may be more about how someone else would use your system than you... as in an exploit.
- tdkl 11y ago
  > as such a mechanism to deliver fixes quickly is actually more a solution than a problem. It's not a solution, it's an excuse for lazy testing. Same as better hardware supported sloppyness in engineering, turning a 15MB CD/DVD burning software to 500MB+ software package (software starts with a "N").

xlayn 11y ago

>"Being free of single points of failure should be a basic requirement for any new software distribution mechanisms deployed today." As in write error-free software?

stavrianos 11y ago

But, at some point there must be trust. If you don't trust software, you can try to sandbox it, but now you have to trust the sandbox. This devolves very rapidly. Open source at least provides a facsimile of recourse - just go read the code - but how much of your currently-running open-source code have you actually read? For that matter, if you had, could you be confident that you'd understood it? The Underhanded C Contest is a thing, after all. A sufficiently paranoid individual can only run code they wrote themselves. Or, they can choose to run code without a strong understanding of what it's doing. If Apple subverts their updates, that's mostly interesting as a signal of their trustworthiness moving forwards. The coolest thing about this is that we know it's happening at all, I think.

jMyles 11y ago
> Open source at least provides a facsimile of recourse - just go read the code - but how much of your currently-running open-source code have you actually read? Wait, what? That is not the recourse that open source provides. The great thing about open source is that you don't need every person to read the code, just one person who can either catch or verify the absence of user-abusive material. Moreover, even if zero people read the code today, it is preserved so that state (or corporate) abuse can be revealed later, providing another disincentive to introduce abusive material.
- marcosdumay 11y ago
  How do you know you are running the same software that everybody else is reviewing?
  - jMyles 11y ago
    Surely you aren't suggesting that a reasonable answer is to read the code yourself and compare it to a known version? Obviously, the mainstream way is a hash-based file verification. Which again, everybody needn't do - only a small number - in order to catch a bad actor in the act. But I presume you are trying to make some bigger point. What is that?

ape4 11y ago

A system update is how Apple would install a backdoor, if they were forced to.

whoopdedo 11y ago

The important difference between a FLOSS system like Debian versus the walled garden of Apple is the ability to choose which keys you trust. If I lose trust in one of the Debian signers I can remove that key. I can select a different repository to download packages from. Or I can stop accepting updates and apply patches manually. As to a key being a single point of failure, PGP allows for multiply signed documents. Couldn't Debian require packages to be signed by at least two keys?

natch 11y ago

This is why EFF urges that software makers (applies to makers of hardware too, if there is a software component) should always keep the end user in the loop of deciding whether to accept updates.

mtgx 11y ago

Maybe it's time to ask Google to ask for permission before updating Chrome?

deleted 11y ago

[deleted]

vonklaus 11y ago

this is totally correct. I agree with everything he says. However, in a world where everyone uses: Android Chrome Google DNS Google Analytics Google Authenticator Google Certificates (issue and validate) Hangouts Gmail Google Docs Many machine learning is run on google code using google opensourced software. search chromecast maps google connect (starbucks, other retailers) google domain registration google chrome/webkit google wallet google playstore google CDN for serving code/fonts/libraries google self driving cars are coming ================================= I am not saying google is bad. Not even referencing this article because I think it was well thought out and there aren't that many people even saying this, although it is fairly intuitive, but the larger paradox is this: Many people talk about some database being sloppy and how they would have it replicated, maybe even a cold backup in AWS glacier on top of the backups, and yet the world is using like 3 stacks: google, apple and microsoft. Outside of this community, and a few other places, it would be highly unlikely someone is running their own openwrt router and have freebsd on their computer, fully encrypt all their emails and run their own mail server, don't own a cellphone and use garmin to navigate AND all of their network does this too and therefore they are insulated sufficiently.

studentrob 11y ago

> Is it reasonable to describe these single points of failure as backdoors? Yes. The case that Apple is making is, in part, that the FBI is forcing them to use a back door by putting Apple's stamp of approval on it with their signing key. Whether or not you agree that Apple must create the back door or not, they are still being asked to approve its use. Apple says this is compelled speech and violates the first amendment. Their brief has more details about it. The Tech Dirt summary has the most details [1]. Here's one notable passage, “The government asks this Court to command Apple to write software that will neutralize safety features that Apple has built into the iPhone in response to consumer privacy concerns... This amounts to compelled speech and viewpoint discrimination in violation of the First Amendment.” > I think many people might argue that industry-standard systems for ensuring software update authenticity do not qualify as backdoors, perhaps because their existence is not secret or hidden in any way. It's relative. That used to be somewhat hidden. Now it's very out in the open. > Having access to a "secure golden key" could be quite dangerous if sufficiently motivated people decide that they want access to it. Yeah. So let's not compromise Apple's existing security procedures by forcing that out in the open. > I expect that in the not-too-distant future, for many applications at least, attackers wishing to perform targeted malicious updates will be unable to do so without compromising a multitude of keys held by many people in many different legal jurisdictions. I hope this day comes soon. For now, let's continue fighting for our right to privacy. [1] https://www.techdirt.com/articles/20160225/15240333713/we-read-apples-65-page-filing-calling-bullshit-justice-department-so-you-dont-have-to.shtml https://www.techdirt.com/articles/20160225/15240333713/we-re...

cmurf 11y ago

Over the weekend, Apple pushed an update to a kernel extension exclusion list that broke ethernet for thousands of users. There was no notification of this update, it simply got pushed and installed, suddenly ethernet broke - as in, not even visible to the system because the ethernet driver (kext) was disallowed from loading. So... yeah it's a mistake, annoying. But we're in some sense expecting much more privacy, security, reliability of our mobile devices than our desktop systems. And I think that's an interesting shift in expectations.

deleted 11y ago

[deleted]