10 ms·

Even if it's not Russia, the release of the hacking tools gives weight to the argument that nsa/fbi should not be able to demand companies to create a back door

Even if it's not Russia, the release of the hacking tools gives weight to the argument that nsa/fbi should not be able to demand companies to create a back door in their products. > Apple: If we're forced to build a tool to hack iPhones, someone will steal it. > FBI: Nonsense. > Russia: We just published NSA's hacking tools https://twitter.com/csoghoian/status/765785340892372992 https://twitter.com/csoghoian/status/765785340892372992

AceJohnny2 10y ago
Except the FBI explicitly said Apple could work on and execute the backdoor internally and destroy it after use. It would never need to come out of their secure facilities. So I don't think this was the strongest argument for Apple. A better one is that once the US can compel Apple to do this, what's to stop Russia, China from demanding the same thing?
- silvestrov 10y ago
  When the back door is created, it cannot be destroyed. FBI had tons of other phones they wanted to access [1]. Hacking one phone would set a precedent that Apple would have to hack numerous other phones. It is so simple to steal software, just like NSA's hacking tools were stolen. If NSA cannot keep software safe, why can you think that Apple can? I think it's unreasonable to require Apple to have a higher level of security than NSA effectively has. 1: http://www.sfgate.com/nation/article/Apple-FBI-face-off-in-Congress-over-iPhone-data-6864178.php http://www.sfgate.com/nation/article/Apple-FBI-face-off-in-C...
  - unfamiliar 10y ago
    > When the back door is created, it cannot be destroyed. If the "backdoor" in question is a malicious signed OS update, then it can absolutely be destroyed. There are plenty of reasons to avoid backdoors without imbuing them with mystical qualities like the inability to delete them.
    - charliedevolve 10y ago
      Signed updates aren't secure either. Ask Microsoft.
    - ethanbond 10y ago
      The backdoor itself can be destroyed. The precedent of compelling a company to write an intrusion into its own software cannot be destroyed.
  - a3n 10y ago
    It would be like requiring a pediatrician to keep smallpox in their refrigerator.
- toufka 10y ago
  >and destroy it after use... And then recreate, and redestroy it for each of the >100 law enforcement requests in NY alone. Etc. Etc. Though the FBI says that, Apple pointed out in their brief that the reality of what that kind of situation would look like was absurd.
- vonmoltke 10y ago
  What stops them from doing it now? What about Apple being willing to hop in bed with the US government affects whether they would with Russia or China, or whether either of them would ask for this from Apple?
  - leereeves 10y ago
    Why would you think Apple is more likely to cooperate with Russia or China than with the US government?
    - nathanaldensr 10y ago
      Money, more specifically the desire for it, knows no bounds. Apple is a multinational corporation whose goal is to deliver value (read: money) to shareholders. The idea of political boundaries meaning anything is a quaint notion that I feel was true only long in the past, if it ever was. I'm not saying Apple is evil, merely that multinational corporations don't have to care about political boundaries.
      - leereeves 10y ago
        That's true, but I meant to ask if there is any reason to think Apple is likely to cooperate with Russia or China, or if that was mere speculation.
        user731955373 10y ago
        https://www.bloomberg.com/news/articles/2016-03-10/government-strikes-back-at-silicon-valley-s-support-for-apple https://www.bloomberg.com/news/articles/2016-03-10/governmen...
    - vonmoltke 10y ago
      I don't, and said nothing of the sort. I said that their decision to cooperate with one government is independent of their decision to cooperate with another. Thus, cooperating with the US does not mean they can't tell Russia and China to go fuck themselves if they asked for the same thing.
- wyager 10y ago
  Why do you trust that this was actually the FBI's intent? That sounds like a desperate PR gambit.
- rdtsc 10y ago
  > Apple could work on and execute the backdoor internally and destroy it after use. Right. So if there is a backdoor, they won't commit the code to a repo, but write it from scratch every time FBI calls them. Yes, very realistic. From that we learn two things, both bad and which tells us not to listen to or work with FBI if possible: 1) FBI is stupid and doesn't know how these things work 2) FBI is malicious and is lying
  - xkcd-sucks 10y ago
    >Right. So if there is a backdoor, they won't commit the code to a repo, but write it from scratch every time FBI calls them. Ethics aside, this seems like a very lucrative gig for software companies that bill by the hour
    - rdtsc 10y ago
      Hah! Let's not give Accenture any ideas now ;-)
  - balabaster 10y ago
    I have a fundamental issue with this paradox... > 1). FBI is stupid... While the tech industry like to cast aspersions about the FBI and how idiotic they are, I think this perception is wrong. I don't think they could possibly have access to the resources they do and be stupid. They may not always understand fully the technology they're working with, but I'm quite sure there are resources within their reach that would quickly set them straight where required. I'm sure at the very least they could create a GUI interface using Visual Basic to track their IP address. > 2). The FBI is malicious and lying... I'd like to believe they're neither but the more time goes on, the more my goodwill towards them fades... and while they're not the NSA, the doubt the NSA has cast on Government Agencies has tainted that with the "guilty by association." I can't believe they're incompetent, I do believe they (largely) do what they do with good intent, I think their strategy is short sighted. That leaves me asking the question: Have they lost sight of the future repercussions of the actions they take today or are they actively considering the future repercussions when making policy today? If they're actively considering the future repercussions of policies they're making today, that is the greater cause for concern because they're actively making policy that ensures the state's ability to monitor (and in effect, censor) the future population - counter to the first and fourth amendments.
- maze-le 10y ago
  Lets forget the argument, that this sets a dangerous precedent for a moment... Even if you assume the strictest possible processes, even if you assume only the most genius techs working on a backdoor like this: In the end the people implementing and operating a backdoor are just people like you and me. People make mistakes no matter how good the skills and processes are. And if this mistake happens, as it will happen invariably, the backdoor is out in the open and usable for adversaries with even more malicious intent.
- pdkl95 10y ago
  > once the US can compel Apple to do this, What's to stop the FBI from repeating the same process in the future? Fighting future orders would be much harder after precedent is established. Remember that after James Comey talked about spending "a lot" to get into the San Bernadino phone, he wanted a way into the phones that "doesn't involve spending tons of money in a way that's un-scaleable."[1] [1] https://www.washingtonpost.com/news/post-nation/wp/2016/04/21/the-fbi-paid-more-than-1-million-to-crack-the-san-bernardino-iphone/ https://www.washingtonpost.com/news/post-nation/wp/2016/04/2...
fooey 10y ago
Let's make state sponsored backdoors mainstream, and then build all our of devices in foreign countries. What could go wrong?
- stcredzero 10y ago
  That's the best 2 sentence summary of the politics around technology and security I've seen so far!
- finid 10y ago
  State-sponsored backdoors have been mainstreams for decades. Practically every major piece of software and hardware that's not open source has a backdoor embedded. Even popular anti-virus programs on Windows have been jimmied to allow state-sponsored malware through
  - Analemma_ 10y ago
    > Practically every major piece of software and hardware that's not open source has a backdoor embedded. [citation needed], and I mean a credible one with evidence, not tinfoil-hat raving. Yes, we know that three-letter agencies look for, and probably have a stash of, zero-days for covert access. And they also do physical attacks wherever possible (like fiber taps at Google's datacenters). But those are two very different things from backdoors built in with the cooperation of the vendor. And despite how many people on the Internet treat "companies build in gov't backdoors" as just unquestioned fact, I've never actually seen any proof.
    - galdosdi 10y ago
      I dunno. Before Snowden, a lot of nasty stuff that we now take for granted the intelligence community does, was seen as "tin foil hat." After Snowden, I no longer doubt the possibility of any realistically imaginable attack, ie, assume that if they have the physical ability to do it, you should assume they do it and are not stopped by any ethical concerns. Our intelligence apparatus has cried wolf too many times, in terms of denying they do something and then it turns out they do it, to be trusted anymore. They've lost the benefit of the doubt and if they don't want people believing all the tin foil hat things, maybe they should stop doing so many of them.
comex 10y ago
> Even if it's not Russia, the release of the hacking tools gives weight to the argument that nsa/fbi should not be able to demand companies to create a back door in their products. Not really. iOS already, today, for no other reason than to prevent downgrades, verifies every firmware upgrade/restore with an Apple server, which sends back a per-device signature. Technically, it would not be difficult for Apple to have that same server authorize a special spy firmware only for specific device IDs. The only way this could result in a mass compromise is if Apple were hacked, but hacking Apple already gets you that - the hard part isn't writing code to spy on people (especially if you've hacked them and thus have full iOS source code), it's signing it. This is different from exploits for code vulnerabilities, where there's always at minimum a secret (the location of the bug) that can't get out, and in some cases going from there to a working exploit is also difficult. At worst, if Apple went beyond compromising that one phone and set up an ongoing process to compromise phones as requested by law enforcement - then there might be some sort of online portal, and maybe it could be hacked either directly or by stealing a legitimate agency's credentials. Maybe then the spy system could be used by unsympathetic governments against their enemies, though only by stealthily submitting individual requests; there would be no way to exfiltrate something from law enforcement that would compromise everyone. I don't think that's what most people are thinking when they talk about a back door "getting out" or whatnot. Personally, I agree with Apple's refusal to create and sign a spy firmware on ethical as well as pragmatic grounds. But there's a lot of misinformation about the issue.
- DanielDent 10y ago
  I think these types of issues are why apple has started removing some of the encryption of the firmware itself.
- tw04 10y ago
  >iOS already, today, for no other reason than to prevent downgrades, verifies every firmware upgrade/restore with an Apple server, which sends back a per-device signature. Are we pretending now that the government couldn't MITM and fake the response? I think they've proven they can MITM pretty much ANYTHING their hearts desire.

AceJohnny2 10y ago

Except the FBI explicitly said Apple could work on and execute the backdoor internally and destroy it after use. It would never need to come out of their secure facilities. So I don't think this was the strongest argument for Apple. A better one is that once the US can compel Apple to do this, what's to stop Russia, China from demanding the same thing?

silvestrov 10y ago
When the back door is created, it cannot be destroyed. FBI had tons of other phones they wanted to access [1]. Hacking one phone would set a precedent that Apple would have to hack numerous other phones. It is so simple to steal software, just like NSA's hacking tools were stolen. If NSA cannot keep software safe, why can you think that Apple can? I think it's unreasonable to require Apple to have a higher level of security than NSA effectively has. 1: http://www.sfgate.com/nation/article/Apple-FBI-face-off-in-Congress-over-iPhone-data-6864178.php http://www.sfgate.com/nation/article/Apple-FBI-face-off-in-C...
- unfamiliar 10y ago
  > When the back door is created, it cannot be destroyed. If the "backdoor" in question is a malicious signed OS update, then it can absolutely be destroyed. There are plenty of reasons to avoid backdoors without imbuing them with mystical qualities like the inability to delete them.
  - charliedevolve 10y ago
    Signed updates aren't secure either. Ask Microsoft.
  - ethanbond 10y ago
    The backdoor itself can be destroyed. The precedent of compelling a company to write an intrusion into its own software cannot be destroyed.
- a3n 10y ago
  It would be like requiring a pediatrician to keep smallpox in their refrigerator.
toufka 10y ago
>and destroy it after use... And then recreate, and redestroy it for each of the >100 law enforcement requests in NY alone. Etc. Etc. Though the FBI says that, Apple pointed out in their brief that the reality of what that kind of situation would look like was absurd.
vonmoltke 10y ago
What stops them from doing it now? What about Apple being willing to hop in bed with the US government affects whether they would with Russia or China, or whether either of them would ask for this from Apple?
- leereeves 10y ago
  Why would you think Apple is more likely to cooperate with Russia or China than with the US government?
  - nathanaldensr 10y ago
    Money, more specifically the desire for it, knows no bounds. Apple is a multinational corporation whose goal is to deliver value (read: money) to shareholders. The idea of political boundaries meaning anything is a quaint notion that I feel was true only long in the past, if it ever was. I'm not saying Apple is evil, merely that multinational corporations don't have to care about political boundaries.
    - leereeves 10y ago
      That's true, but I meant to ask if there is any reason to think Apple is likely to cooperate with Russia or China, or if that was mere speculation.
      - user731955373 10y ago
        https://www.bloomberg.com/news/articles/2016-03-10/government-strikes-back-at-silicon-valley-s-support-for-apple https://www.bloomberg.com/news/articles/2016-03-10/governmen...
  - vonmoltke 10y ago
    I don't, and said nothing of the sort. I said that their decision to cooperate with one government is independent of their decision to cooperate with another. Thus, cooperating with the US does not mean they can't tell Russia and China to go fuck themselves if they asked for the same thing.
wyager 10y ago
Why do you trust that this was actually the FBI's intent? That sounds like a desperate PR gambit.
rdtsc 10y ago
> Apple could work on and execute the backdoor internally and destroy it after use. Right. So if there is a backdoor, they won't commit the code to a repo, but write it from scratch every time FBI calls them. Yes, very realistic. From that we learn two things, both bad and which tells us not to listen to or work with FBI if possible: 1) FBI is stupid and doesn't know how these things work 2) FBI is malicious and is lying
- xkcd-sucks 10y ago
  >Right. So if there is a backdoor, they won't commit the code to a repo, but write it from scratch every time FBI calls them. Ethics aside, this seems like a very lucrative gig for software companies that bill by the hour
  - rdtsc 10y ago
    Hah! Let's not give Accenture any ideas now ;-)
- balabaster 10y ago
  I have a fundamental issue with this paradox... > 1). FBI is stupid... While the tech industry like to cast aspersions about the FBI and how idiotic they are, I think this perception is wrong. I don't think they could possibly have access to the resources they do and be stupid. They may not always understand fully the technology they're working with, but I'm quite sure there are resources within their reach that would quickly set them straight where required. I'm sure at the very least they could create a GUI interface using Visual Basic to track their IP address. > 2). The FBI is malicious and lying... I'd like to believe they're neither but the more time goes on, the more my goodwill towards them fades... and while they're not the NSA, the doubt the NSA has cast on Government Agencies has tainted that with the "guilty by association." I can't believe they're incompetent, I do believe they (largely) do what they do with good intent, I think their strategy is short sighted. That leaves me asking the question: Have they lost sight of the future repercussions of the actions they take today or are they actively considering the future repercussions when making policy today? If they're actively considering the future repercussions of policies they're making today, that is the greater cause for concern because they're actively making policy that ensures the state's ability to monitor (and in effect, censor) the future population - counter to the first and fourth amendments.
maze-le 10y ago
Lets forget the argument, that this sets a dangerous precedent for a moment... Even if you assume the strictest possible processes, even if you assume only the most genius techs working on a backdoor like this: In the end the people implementing and operating a backdoor are just people like you and me. People make mistakes no matter how good the skills and processes are. And if this mistake happens, as it will happen invariably, the backdoor is out in the open and usable for adversaries with even more malicious intent.
pdkl95 10y ago
> once the US can compel Apple to do this, What's to stop the FBI from repeating the same process in the future? Fighting future orders would be much harder after precedent is established. Remember that after James Comey talked about spending "a lot" to get into the San Bernadino phone, he wanted a way into the phones that "doesn't involve spending tons of money in a way that's un-scaleable."[1] [1] https://www.washingtonpost.com/news/post-nation/wp/2016/04/21/the-fbi-paid-more-than-1-million-to-crack-the-san-bernardino-iphone/ https://www.washingtonpost.com/news/post-nation/wp/2016/04/2...

fooey 10y ago

Let's make state sponsored backdoors mainstream, and then build all our of devices in foreign countries. What could go wrong?

stcredzero 10y ago
That's the best 2 sentence summary of the politics around technology and security I've seen so far!
finid 10y ago
State-sponsored backdoors have been mainstreams for decades. Practically every major piece of software and hardware that's not open source has a backdoor embedded. Even popular anti-virus programs on Windows have been jimmied to allow state-sponsored malware through
- Analemma_ 10y ago
  > Practically every major piece of software and hardware that's not open source has a backdoor embedded. [citation needed], and I mean a credible one with evidence, not tinfoil-hat raving. Yes, we know that three-letter agencies look for, and probably have a stash of, zero-days for covert access. And they also do physical attacks wherever possible (like fiber taps at Google's datacenters). But those are two very different things from backdoors built in with the cooperation of the vendor. And despite how many people on the Internet treat "companies build in gov't backdoors" as just unquestioned fact, I've never actually seen any proof.
  - galdosdi 10y ago
    I dunno. Before Snowden, a lot of nasty stuff that we now take for granted the intelligence community does, was seen as "tin foil hat." After Snowden, I no longer doubt the possibility of any realistically imaginable attack, ie, assume that if they have the physical ability to do it, you should assume they do it and are not stopped by any ethical concerns. Our intelligence apparatus has cried wolf too many times, in terms of denying they do something and then it turns out they do it, to be trusted anymore. They've lost the benefit of the doubt and if they don't want people believing all the tin foil hat things, maybe they should stop doing so many of them.

comex 10y ago

> Even if it's not Russia, the release of the hacking tools gives weight to the argument that nsa/fbi should not be able to demand companies to create a back door in their products. Not really. iOS already, today, for no other reason than to prevent downgrades, verifies every firmware upgrade/restore with an Apple server, which sends back a per-device signature. Technically, it would not be difficult for Apple to have that same server authorize a special spy firmware only for specific device IDs. The only way this could result in a mass compromise is if Apple were hacked, but hacking Apple already gets you that - the hard part isn't writing code to spy on people (especially if you've hacked them and thus have full iOS source code), it's signing it. This is different from exploits for code vulnerabilities, where there's always at minimum a secret (the location of the bug) that can't get out, and in some cases going from there to a working exploit is also difficult. At worst, if Apple went beyond compromising that one phone and set up an ongoing process to compromise phones as requested by law enforcement - then there might be some sort of online portal, and maybe it could be hacked either directly or by stealing a legitimate agency's credentials. Maybe then the spy system could be used by unsympathetic governments against their enemies, though only by stealthily submitting individual requests; there would be no way to exfiltrate something from law enforcement that would compromise everyone. I don't think that's what most people are thinking when they talk about a back door "getting out" or whatnot. Personally, I agree with Apple's refusal to create and sign a spy firmware on ethical as well as pragmatic grounds. But there's a lot of misinformation about the issue.

DanielDent 10y ago
I think these types of issues are why apple has started removing some of the encryption of the firmware itself.
tw04 10y ago
>iOS already, today, for no other reason than to prevent downgrades, verifies every firmware upgrade/restore with an Apple server, which sends back a per-device signature. Are we pretending now that the government couldn't MITM and fake the response? I think they've proven they can MITM pretty much ANYTHING their hearts desire.