59 ms·

This is a shallow, incorrect argument. As a reminder, a custom version of iOS is absolutely useless without the means to get it onto a device. In fact, it's po

by ikeboy 9y ago

This is a shallow, incorrect argument. As a reminder, a custom version of iOS is absolutely useless without the means to get it onto a device. In fact, it's possible and relatively cheap for a talented team to make that custom version without Apple's help. That means is a key held only by Apple, needed to sign software before it can run on any iOS device. Apple uses this key every single time any iOS device around the world is updated- a nonce is generated on device, sent to Apple, signed along with the firmware, then verified on-device before it allows the new software to run. Creating the software may have been work for Apple, but would not contribute in any way to making phones less safe. Signing a piece of software inside their own premises for a particular nonce and device ID can likewise not be used to make any other device unsafe. This is a process Apple does many times a day, whenever any device updates.

Matt3o12_ 9y ago
If the started that, local law enforcement companies would also ask to have their govOS signed by apple to be installed on a particular device. How do you make sure that a) the link from the local law enforcement branch is authentic and has not been compromised, b) make sure that the person requesting such an update is actually authorized to do so (and not just some criminal how gained access to the law enforcement computers). Not matter what you do, there is still a very good chance that somehow unauthorized people get access to sign an OS for any of apple's devices device they want. It might not result in such a huge attacked but nonetheless, there is still damaged to be done.
- ikeboy 9y ago
  The right answer here is they need a valid writ from a court, just like the FBI had. We don't have much of an issue with criminals getting wiretaps through faking subpoenas to phone companies (although I did find https://arstechnica.com/tech-policy/2017/03/feds-brooklyn-prosecutor-forged-judges-signatures-to-wiretap-lover/ https://arstechnica.com/tech-policy/2017/03/feds-brooklyn-pr... when searching.) Note that I'm not arguing that Apple should have complied, that the court should have said a particular thing, or anything like that (did enough arguing last year when the case was going on). All I'm saying is the comparison is invalid, and the author doesn't know the technical details and is therefore wrong.
princekolt 9y ago
This is assuming that whole thing is free of bugs, which is never going to be the case. Just like the fastest code is the code that is never executed, the safest code is the code that is never written in the first place.
- ikeboy 9y ago
  If the device firmware that checks for signatures has a bug then it can already be exploited by anyone who can find it. Creating a new iOS version in no way increases the attack surface. If you think it does then you probably don't understand how the technicalities work, or I'm misunderstanding you (in which case please sketch a scenario where Apple doing what was requested increases attack surface).
  - princekolt 9y ago
    Indeed the attack surface is the same, but now there is an extra incentive to crack the signing process, because you will be able to run an open version of the OS. Cracking the signing process now is useless because the OS image is still the original. Now, cracking the signing process so that it authorizes a third-party-modified version of the OS is something else completely, but I'm not sure it would make any difference if the attack is done with physical access. It could be useful for remote attacks.
    - ikeboy 9y ago
      So your scenario is >code gets leaked >incentive to find bugs in signing increased >bug in signing found Offhand I would think the value of an exploitable signing bug is an order of magnitude greater than the cost of making a custom software. At the very least it trivially allows jailbreaks, which puts it in the million dollar range depending on how exploitable it is, and I think creating iOS software that skips the passcode would at worst be in the low six figure range if it didn't need signing, more likely mid five figure. Saurik said it could be done in a week by a talented programmer (see https://news.ycombinator.com/item?id=11153022 https://news.ycombinator.com/item?id=11153022), so even though the supply of such programmers is limited I'm still confident the total cost would be 5 figures. So the additional incentive would be pretty insignificant compared to the existing incentive.

by ikeboy 9y ago

Matt3o12_ 9y ago

If the started that, local law enforcement companies would also ask to have their govOS signed by apple to be installed on a particular device. How do you make sure that a) the link from the local law enforcement branch is authentic and has not been compromised, b) make sure that the person requesting such an update is actually authorized to do so (and not just some criminal how gained access to the law enforcement computers). Not matter what you do, there is still a very good chance that somehow unauthorized people get access to sign an OS for any of apple's devices device they want. It might not result in such a huge attacked but nonetheless, there is still damaged to be done.

ikeboy 9y ago
The right answer here is they need a valid writ from a court, just like the FBI had. We don't have much of an issue with criminals getting wiretaps through faking subpoenas to phone companies (although I did find https://arstechnica.com/tech-policy/2017/03/feds-brooklyn-prosecutor-forged-judges-signatures-to-wiretap-lover/ https://arstechnica.com/tech-policy/2017/03/feds-brooklyn-pr... when searching.) Note that I'm not arguing that Apple should have complied, that the court should have said a particular thing, or anything like that (did enough arguing last year when the case was going on). All I'm saying is the comparison is invalid, and the author doesn't know the technical details and is therefore wrong.

princekolt 9y ago

This is assuming that whole thing is free of bugs, which is never going to be the case. Just like the fastest code is the code that is never executed, the safest code is the code that is never written in the first place.

ikeboy 9y ago
If the device firmware that checks for signatures has a bug then it can already be exploited by anyone who can find it. Creating a new iOS version in no way increases the attack surface. If you think it does then you probably don't understand how the technicalities work, or I'm misunderstanding you (in which case please sketch a scenario where Apple doing what was requested increases attack surface).
- princekolt 9y ago
  Indeed the attack surface is the same, but now there is an extra incentive to crack the signing process, because you will be able to run an open version of the OS. Cracking the signing process now is useless because the OS image is still the original. Now, cracking the signing process so that it authorizes a third-party-modified version of the OS is something else completely, but I'm not sure it would make any difference if the attack is done with physical access. It could be useful for remote attacks.
  - ikeboy 9y ago
    So your scenario is >code gets leaked >incentive to find bugs in signing increased >bug in signing found Offhand I would think the value of an exploitable signing bug is an order of magnitude greater than the cost of making a custom software. At the very least it trivially allows jailbreaks, which puts it in the million dollar range depending on how exploitable it is, and I think creating iOS software that skips the passcode would at worst be in the low six figure range if it didn't need signing, more likely mid five figure. Saurik said it could be done in a week by a talented programmer (see https://news.ycombinator.com/item?id=11153022 https://news.ycombinator.com/item?id=11153022), so even though the supply of such programmers is limited I'm still confident the total cost would be 5 figures. So the additional incentive would be pretty insignificant compared to the existing incentive.