2 ms·

This all depends on what gag orders are in place if the Apple source was off on having precise information of who discovered what etc. To me the language of all

by qaq 8y ago

This all depends on what gag orders are in place if the Apple source was off on having precise information of who discovered what etc. To me the language of all Apple communications so far look to be very carefully worded same for DHS.

danaris 8y ago
Gag orders can only force companies not to say the truth. They can't force them to lie. They certainly can't compel them to make such clear, specific, long-winded, and persistent denials of claims like these. That kind of thing's the stuff of conspiracy theories and Hollywood plots.
- qaq 8y ago
  Which part of all statements made so far would be a lie if an issue was discovered by some unit under DHS or a 3d party entity?
  - mistersquid 8y ago
    With regard to DHS, Apple's Congressional Letter states: > On Saturday night, the U.S. Department of Homeland Security joined the U.K.'s National Cyber Security Centre in saying they have no reason to doubt the statements we've made.
    - qaq 8y ago
      If DHS has an active investigation how them saying they have no doubts about statements Apple made be a lie. Apple stated: 1) They have not found the chips 2) They are not aware of FBI investigation 3)They are not seeing any evidence of exfiltration, cc based on their security systems
      - mistersquid 8y ago
        I responded to your question: > Which part of all statements made so far would be a lie if an issue was discovered by some unit under DHS or a 3d party entity? If the DHS says "they have no reason to doubt the statements [Apple] have made", it means that no issue was discovered by a "unit under DHS". Otherwise, the DHS would have reason to doubt Apple's statements about being compromised.
bun_at_work 8y ago
I think you make a reasonable point here, but it doesn't change the facts about what reasonable attack surfaces are, made elsewhere. For example, why place a detectable piece of hardware onto the MoBo, instead of just installing malicious firmware? The hardware piece is going to be limited in capabilities and much easier to detect. Given the level of access required for this "hack," it makes more sense to just write the bad firmware to do all the tricks. Especially since, as far as I understand, the malicious chip modifies the firmware anyway. There are far too many reasons to be skeptical of the article, and the parties involved have motives that are very easy to trust.
- qaq 8y ago
  I agree that would make way more sense in general but who knows maybe Apple is reflashing them with verified image or some other procedure that would make that not a workable approach.
- 394549 8y ago
  > For example, why place a detectable piece of hardware onto the MoBo, instead of just installing malicious firmware? Because the supply-chain may be verifying the integrity of the firmware? Firmware is "detectable" too. It's detection is probably easier because so much of computing is software focused nowadays. Hardware implants have certain advantages: no one may be looking for them and they're extremely resistant to removal attempts.

by qaq 8y ago

danaris 8y ago

Gag orders can only force companies not to say the truth. They can't force them to lie. They certainly can't compel them to make such clear, specific, long-winded, and persistent denials of claims like these. That kind of thing's the stuff of conspiracy theories and Hollywood plots.

qaq 8y ago
Which part of all statements made so far would be a lie if an issue was discovered by some unit under DHS or a 3d party entity?
- mistersquid 8y ago
  With regard to DHS, Apple's Congressional Letter states: > On Saturday night, the U.S. Department of Homeland Security joined the U.K.'s National Cyber Security Centre in saying they have no reason to doubt the statements we've made.
  - qaq 8y ago
    If DHS has an active investigation how them saying they have no doubts about statements Apple made be a lie. Apple stated: 1) They have not found the chips 2) They are not aware of FBI investigation 3)They are not seeing any evidence of exfiltration, cc based on their security systems
    - mistersquid 8y ago
      I responded to your question: > Which part of all statements made so far would be a lie if an issue was discovered by some unit under DHS or a 3d party entity? If the DHS says "they have no reason to doubt the statements [Apple] have made", it means that no issue was discovered by a "unit under DHS". Otherwise, the DHS would have reason to doubt Apple's statements about being compromised.

bun_at_work 8y ago

I think you make a reasonable point here, but it doesn't change the facts about what reasonable attack surfaces are, made elsewhere. For example, why place a detectable piece of hardware onto the MoBo, instead of just installing malicious firmware? The hardware piece is going to be limited in capabilities and much easier to detect. Given the level of access required for this "hack," it makes more sense to just write the bad firmware to do all the tricks. Especially since, as far as I understand, the malicious chip modifies the firmware anyway. There are far too many reasons to be skeptical of the article, and the parties involved have motives that are very easy to trust.

qaq 8y ago
I agree that would make way more sense in general but who knows maybe Apple is reflashing them with verified image or some other procedure that would make that not a workable approach.
394549 8y ago
> For example, why place a detectable piece of hardware onto the MoBo, instead of just installing malicious firmware? Because the supply-chain may be verifying the integrity of the firmware? Firmware is "detectable" too. It's detection is probably easier because so much of computing is software focused nowadays. Hardware implants have certain advantages: no one may be looking for them and they're extremely resistant to removal attempts.