5 ms·

OK so no material details are provided in this letter. I am not aware of a single f500 company that was not breached at some point so we have not found any serv

by qaq 8y ago

OK so no material details are provided in this letter. I am not aware of a single f500 company that was not breached at some point so we have not found any servers because we have various security tools installed is not really meaningful. Scanning outbound connections is not a meaningful defense in this case there are legitimate outbound connections going to say China and given China's ability to capture any inbound traffic there are def. ways to ex-filtrate data without raising any flags.

danaris 8y ago
...But as I understand it, the Bloomberg report states that specific pieces of hardware were found by Apple, and Apple states that they have found no such thing.
- qaq 8y ago
  This all depends on what gag orders are in place if the Apple source was off on having precise information of who discovered what etc. To me the language of all Apple communications so far look to be very carefully worded same for DHS.
  - danaris 8y ago
    Gag orders can only force companies not to say the truth. They can't force them to lie. They certainly can't compel them to make such clear, specific, long-winded, and persistent denials of claims like these. That kind of thing's the stuff of conspiracy theories and Hollywood plots.
    - qaq 8y ago
      Which part of all statements made so far would be a lie if an issue was discovered by some unit under DHS or a 3d party entity?
      - mistersquid 8y ago
        With regard to DHS, Apple's Congressional Letter states: > On Saturday night, the U.S. Department of Homeland Security joined the U.K.'s National Cyber Security Centre in saying they have no reason to doubt the statements we've made.
        qaq 8y ago
        If DHS has an active investigation how them saying they have no doubts about statements Apple made be a lie. Apple stated: 1) They have not found the chips 2) They are not aware of FBI investigation 3)They are not seeing any evidence of exfiltration, cc based on their security systems
        mistersquid 8y ago
        I responded to your question: > Which part of all statements made so far would be a lie if an issue was discovered by some unit under DHS or a 3d party entity? If the DHS says "they have no reason to doubt the statements [Apple] have made", it means that no issue was discovered by a "unit under DHS". Otherwise, the DHS would have reason to doubt Apple's statements about being compromised.
  - bun_at_work 8y ago
    I think you make a reasonable point here, but it doesn't change the facts about what reasonable attack surfaces are, made elsewhere. For example, why place a detectable piece of hardware onto the MoBo, instead of just installing malicious firmware? The hardware piece is going to be limited in capabilities and much easier to detect. Given the level of access required for this "hack," it makes more sense to just write the bad firmware to do all the tricks. Especially since, as far as I understand, the malicious chip modifies the firmware anyway. There are far too many reasons to be skeptical of the article, and the parties involved have motives that are very easy to trust.
    - qaq 8y ago
      I agree that would make way more sense in general but who knows maybe Apple is reflashing them with verified image or some other procedure that would make that not a workable approach.
    - 394549 8y ago
      > For example, why place a detectable piece of hardware onto the MoBo, instead of just installing malicious firmware? Because the supply-chain may be verifying the integrity of the firmware? Firmware is "detectable" too. It's detection is probably easier because so much of computing is software focused nowadays. Hardware implants have certain advantages: no one may be looking for them and they're extremely resistant to removal attempts.
throwawaymath 8y ago
What would it take to convince you that there are no rogue chips, malware or security compromise? I don't personally know if the Bloomberg story is false. But I do know that, so far, it's essentially unsubstantiated. So let's assume for the sake of argument that the Bloomberg story is incorrect. What would you expect a company to do other than issue a strongly worded denial and explain their side of the story? What would you have them do, publish their entire network logs and supply chain security assessment notes just because an unsubstantiated story claims they were compromised? In essence: it sounds to me like you're demanding evidence to disprove an accusation that doesn't have any evidence. That doesn't strike me as a fair or rational way to ascertain truth. Now I have a few responses to your specific points: > I am not aware of a single f500 company that was not breached at some point Most Fortune 500 companies have not suffered a breach. Every single company in the world has critical/high severity vulnerabilities in any given software product at any given time; this is the essential nature of software in 2018. A breach is something categorically different: it consists of a technical security vulnerability which has been demonstrably exploited to achieve tangible data compromise and exfiltration. Unless you have access to information I don't, no, most Fortune 500 companies have not experienced this. Consider that tech journalism has begun to conflate security vulnerabilities and actual data breaches in recent years. > Scanning outbound connections is not a meaningful defense in this case there are legitimate outbound connections going to say China and given China's ability to capture any inbound traffic there are def. ways to ex-filtrate data without raising any flags. This kind of claim borders on fantasy and conspiracy theory. Apple employs more security engineers than most companies in the world employ people period. If your threat model provides your adversary with vague omnipotence such that they can exfiltrate data undetected across countries under the nose of one of the most capable information security teams in the world for months at a time, then the entire discussion is moot. If you honestly believe that's a reasonable thing to believe then our disagreement is fundamentally insoluble. Do you honestly believe it's reasonable to say no material details were provided in this letter when you're talking about data exfiltration from Apple with no material details of how China would do that? You can't just give fantastical powers of exploitation to an adversary because they're a country. If we bring this down to reality we have the following observations: 1. The attributes and capabilities you're assuming of the adversary in this story are not only unproven, they're unfalsifiable. We can talk about what could be possible all day long, whether it's the NSA, China, Russia, chemtrails, 9/11, etc. I can also claim there's an invisible 0day that can compromise our entire electrical grid sitting on my desktop. Prove me wrong? 2. Bloomberg's story is essentially unsubstantiated. The sources are anonymous and several claims rely on a single source. At least one source has come forward to disagree with the story as written. 3. Every company involved in Bloomberg's story has issued vehement denials. If your response to a denial is, "But there could be a gag order!" then I'm frankly curious what level of evidence you think is required to refute an accusation that has no evidence.
gameswithgo 8y ago
how could they provide material details? xray every server they have?
- qaq 8y ago
  That def. would be taken seriously. So far they are basically stating they believe there is no issue because they deployed advanced security systems and they see no evidence of basically cc or exfiltration. For unknown attack signature an ML engine would be used they are few % of 100% detection rate. A state level APT can easily have a lab that basically has samples of 10 leading sensors that would be basically covering 99% of the F500 market and they can test their tools against those sensors.

by qaq 8y ago

danaris 8y ago

...But as I understand it, the Bloomberg report states that specific pieces of hardware were found by Apple, and Apple states that they have found no such thing.

qaq 8y ago
This all depends on what gag orders are in place if the Apple source was off on having precise information of who discovered what etc. To me the language of all Apple communications so far look to be very carefully worded same for DHS.
- danaris 8y ago
  Gag orders can only force companies not to say the truth. They can't force them to lie. They certainly can't compel them to make such clear, specific, long-winded, and persistent denials of claims like these. That kind of thing's the stuff of conspiracy theories and Hollywood plots.
  - qaq 8y ago
    Which part of all statements made so far would be a lie if an issue was discovered by some unit under DHS or a 3d party entity?
    - mistersquid 8y ago
      With regard to DHS, Apple's Congressional Letter states: > On Saturday night, the U.S. Department of Homeland Security joined the U.K.'s National Cyber Security Centre in saying they have no reason to doubt the statements we've made.
      - qaq 8y ago
        If DHS has an active investigation how them saying they have no doubts about statements Apple made be a lie. Apple stated: 1) They have not found the chips 2) They are not aware of FBI investigation 3)They are not seeing any evidence of exfiltration, cc based on their security systems
        mistersquid 8y ago
        I responded to your question: > Which part of all statements made so far would be a lie if an issue was discovered by some unit under DHS or a 3d party entity? If the DHS says "they have no reason to doubt the statements [Apple] have made", it means that no issue was discovered by a "unit under DHS". Otherwise, the DHS would have reason to doubt Apple's statements about being compromised.
- bun_at_work 8y ago
  I think you make a reasonable point here, but it doesn't change the facts about what reasonable attack surfaces are, made elsewhere. For example, why place a detectable piece of hardware onto the MoBo, instead of just installing malicious firmware? The hardware piece is going to be limited in capabilities and much easier to detect. Given the level of access required for this "hack," it makes more sense to just write the bad firmware to do all the tricks. Especially since, as far as I understand, the malicious chip modifies the firmware anyway. There are far too many reasons to be skeptical of the article, and the parties involved have motives that are very easy to trust.
  - qaq 8y ago
    I agree that would make way more sense in general but who knows maybe Apple is reflashing them with verified image or some other procedure that would make that not a workable approach.
  - 394549 8y ago
    > For example, why place a detectable piece of hardware onto the MoBo, instead of just installing malicious firmware? Because the supply-chain may be verifying the integrity of the firmware? Firmware is "detectable" too. It's detection is probably easier because so much of computing is software focused nowadays. Hardware implants have certain advantages: no one may be looking for them and they're extremely resistant to removal attempts.

throwawaymath 8y ago

What would it take to convince you that there are no rogue chips, malware or security compromise? I don't personally know if the Bloomberg story is false. But I do know that, so far, it's essentially unsubstantiated. So let's assume for the sake of argument that the Bloomberg story is incorrect. What would you expect a company to do other than issue a strongly worded denial and explain their side of the story? What would you have them do, publish their entire network logs and supply chain security assessment notes just because an unsubstantiated story claims they were compromised? In essence: it sounds to me like you're demanding evidence to disprove an accusation that doesn't have any evidence. That doesn't strike me as a fair or rational way to ascertain truth. Now I have a few responses to your specific points: > I am not aware of a single f500 company that was not breached at some point Most Fortune 500 companies have not suffered a breach. Every single company in the world has critical/high severity vulnerabilities in any given software product at any given time; this is the essential nature of software in 2018. A breach is something categorically different: it consists of a technical security vulnerability which has been demonstrably exploited to achieve tangible data compromise and exfiltration. Unless you have access to information I don't, no, most Fortune 500 companies have not experienced this. Consider that tech journalism has begun to conflate security vulnerabilities and actual data breaches in recent years. > Scanning outbound connections is not a meaningful defense in this case there are legitimate outbound connections going to say China and given China's ability to capture any inbound traffic there are def. ways to ex-filtrate data without raising any flags. This kind of claim borders on fantasy and conspiracy theory. Apple employs more security engineers than most companies in the world employ people period. If your threat model provides your adversary with vague omnipotence such that they can exfiltrate data undetected across countries under the nose of one of the most capable information security teams in the world for months at a time, then the entire discussion is moot. If you honestly believe that's a reasonable thing to believe then our disagreement is fundamentally insoluble. Do you honestly believe it's reasonable to say no material details were provided in this letter when you're talking about data exfiltration from Apple with no material details of how China would do that? You can't just give fantastical powers of exploitation to an adversary because they're a country. If we bring this down to reality we have the following observations: 1. The attributes and capabilities you're assuming of the adversary in this story are not only unproven, they're unfalsifiable. We can talk about what could be possible all day long, whether it's the NSA, China, Russia, chemtrails, 9/11, etc. I can also claim there's an invisible 0day that can compromise our entire electrical grid sitting on my desktop. Prove me wrong? 2. Bloomberg's story is essentially unsubstantiated. The sources are anonymous and several claims rely on a single source. At least one source has come forward to disagree with the story as written. 3. Every company involved in Bloomberg's story has issued vehement denials. If your response to a denial is, "But there could be a gag order!" then I'm frankly curious what level of evidence you think is required to refute an accusation that has no evidence.

gameswithgo 8y ago

how could they provide material details? xray every server they have?

qaq 8y ago
That def. would be taken seriously. So far they are basically stating they believe there is no issue because they deployed advanced security systems and they see no evidence of basically cc or exfiltration. For unknown attack signature an ML engine would be used they are few % of 100% detection rate. A state level APT can easily have a lab that basically has samples of 10 leading sensors that would be basically covering 99% of the F500 market and they can test their tools against those sensors.