13 ms·

The CIA Campaign to Steal Apple's Secrets (2015)

223 points by colinprince 8y ago

sarcasmatwork 8y ago
Sounds like domestic terrorism.. is it not?
- pytyper2 8y ago
  If you redefine terrorism to remove the dependence on violence, unless I missed something in the article? I don't personally believe that trying to find security flaws terrorism.
  - OrgNet 8y ago
    they aren't just trying to find security flaws... they probably buy/find most of them so that they can use them (it might scare and/or terrorize some people to be watched and controlled at all times)
    - village-idiot 8y ago
      That still wouldn’t be terrorism. It would be something else, potentially harassment or general authoritarianism.
- sdinsn 8y ago
  Quite a strange definition of terrorism you have there. When Uber stole Google's self driving secrets, do you think Uber was committing a terrorist act?
- pretendscholar 8y ago
  People seem to have a really hard time using the terms terrorism and genocide correctly.
- village-idiot 8y ago
  No, it quite clearly isn’t.
dang 8y ago
Discussed at the time: https://news.ycombinator.com/item?id=9176538 https://news.ycombinator.com/item?id=9176538.
tgb29 8y ago
I hope the CIA steals Apple's ability to innovate
- C1sc0cat 8y ago
  cough A12 cough
nickelcitymario 8y ago
Nothing in this article is surprising. I mean, honestly, if you don't think the CIA is actively trying to gain access to your devices, WTF do you think they do all day? I'd be more concerned if the intelligence agencies of the world WEREN'T doing this. It's their purpose. It's what we pay them for with our taxes. Of course we should also always root for tech companies to stay one step ahead. But infosec is an arms race, and I sure hope my own country's intelligence agencies (CSIS and the CSE in Canada) are doing their best to stay ahead of, say, North Korea or Russia. (Please note: I'm not saying violating our privacy is OK, any more than I'm saying it's cool to launch nuclear weapons. But if anyone's going to have the ability to hack my phone or launch a nuke, I want it to be the people on my own team. This seems like basic self-interest and survival strategy.)
- whatshisface 8y ago
  >WTF do you think they do all day? One would hope that they were trying to gain access to someone else's devices, as opposed to turning the guns towards their own citizens and economy. If a soldier showed up at my door and pointed their gun at me, my reaction wouldn't be "of course you're doing that, your job is to point guns."
  - penagwin 8y ago
    Somethings like spying on American phone calls (or just their "metadata") I agree with. But somethings like breaking encryption, exploiting iPhones, etc. while they may be used against Americans can also be used against others. Essentially there's an arms race, and we use our tax money to sponsor our government in this race, with the hopes that they'll side with us. There really isn't another option unless you want to give a private entity this power, or not participate in the race (which I don't advise).
    - JustSomeNobody 8y ago
      > Somethings like spying on American phone calls (or just their "metadata") I agree with. > But somethings like breaking encryption, exploiting iPhones, etc. while they may be used against Americans can also be used against others. Both of these can have a chilling effect on free speech, therefore I'm against the CIA doing this to citizens. The potential threat against citizens nowhere near outweighs the need to uphold our constitution.
CalChris 8y ago
How is pen testing of iPhones stealing Apple's secrets? Does Apple know these holes are there and they're keeping them secret? I'll grant you that if the CIA broke into Apple and stole keys, that would stealing along with breaking and entering or the cybercrime equivalent. But that's not what the article says.
- mlindner 8y ago
  Yeah this article is a bit ridiculous. Pen testing is what security researchers do. It's a proverbial mountain out of a molehill. The Intercept longs for its Snowden glory days.
  - ixtli 8y ago
    Not to nitpick but this is from 2015, which was right around the time when journalists were able to dig into how companies like microsoft and apple worked with the CIA/NSA to violate privacy, happily or otherwise.
- joezydeco 8y ago
  What about moles? Could the CIA hire someone, or many people, to attempt to get hired by Apple and spend years working their way into the higher echelons of the company?
  - CalChris 8y ago
    They could do that but that wasn't what the article was about.
- DINKDINK 8y ago
  >How is pen testing of iPhones stealing Apple's secrets? Did you read the article? The CIA -- in addition to pentesting -- is trying to exfiltrate GID keys of Apple devices. That is quite literally, trying to steal Apple's secrets -- not checking which systems have vulnerabilities.
  - 8y ago
tgragnato 8y ago
> The security researchers also claimed they had created a modified version of Apple’s proprietary software development tool, Xcode, which could sneak surveillance backdoors into any apps or programs created using the tool. Xcode, which is distributed by Apple to hundreds of thousands of developers, is used to create apps that are sold through Apple’s App Store. > The modified version of Xcode, the researchers claimed, could enable spies to steal passwords and grab messages on infected devices. Researchers also claimed the modified Xcode could “force all iOS applications to send embedded data to a listening post.” It remains unclear how intelligence agencies would get developers to use the poisoned version of Xcode. Sounds suspiciously like XCodeGhost: https://en.wikipedia.org/wiki/XcodeGhost https://en.wikipedia.org/wiki/XcodeGhost. This is probably worth a reference to Ken Thompson's "Reflections on Trusting Trust".
jokoon 8y ago
One thing is sure, is that the Snowden leaks really made me realize that countries won't bother with morals to improve national security and advance its capabilities, but in the end, it's just another debate that Machiavel has answers for. I think that communication technologies, and high speed internet becoming so widespread, created a big new battlefield which is particular because it's not so violent and ugly. There aren't clear military laws about the internet like there is for other battlefield like the geneva convention, and that's makes all of this so interesting.
exabrial 8y ago
Dear CIA: I have information regarding top secret Apple swipe to unlock technology patent.....
auslander 8y ago
Apparently they had no problems with Android devices.
nickpsecurity 8y ago
"“Apple led the way with secure coprocessors in phones, with fingerprint sensors, with encrypted messages. If you can attack Apple, then you can probably attack anyone.”" They really didn't. There were cryptophones, such as Cryptophone, doing secure messaging and stuff before Apple. Julian Assange used one IIRC. High-assurance security did stuff like Sectera Edge with some side-channel shielding, too. Then, there were companies like OK Labs building minimal, trusted, computing bases into phones with stuff like Android sandboxed in user-mode. Sensitive stuff ran outside. Then, Apple got into the game. They could still copy some of these techniques for improved security on top of what they're doing already. https://www.cryptophone.de/ https://www.cryptophone.de/ https://web.archive.org/web/20080408152145/http://www.gdc4s.com/content/detail.cfm?item=32640fd9-0213-4330-a742-55106fbaff32 https://web.archive.org/web/20080408152145/http://www.gdc4s.... https://web.archive.org/web/20110219075132/http://www.ok-labs.com/solutions/secure-hypercell-technology https://web.archive.org/web/20110219075132/http://www.ok-lab...
- jasonvorhe 8y ago
  Apple still led the way: Because Apple did it, Android vendors followed suit. Cryptophone and the other products were a niche market and no one really knows if they are good enough to withstand a nation state attack or if they are just good enough to provide better opsec for companies than regular phones did.
_robbywashere 8y ago
It’s funny because it appears, looking at the history of data leaks, security breaches etc - our biggest threat appears to be our insecurity Perhaps they should work the other way, assisting people and entities of this country to be MORE secure, not LESS.
otakucode 8y ago
>Brennan said the CIA reorganization will be modeled after the agency’s Counterterrorism Center, which runs the U.S. targeted killing and drone program. I always like to remind people when this comes up - The CIA is a civilian agency. They are not military. They have no legal right to engage in anything remotely resembling military action. Their only legal behavior is to collect international intelligence, though they seem to be capable only of doing everything outside their mandate and not within it. Why they weren't disbanded after the USSR imploded into bankruptcy 2 weeks after they had delivered a report claiming that the USSR was 'not a paper tiger' and 'growing stronger every day' and that they would continue to present the largest threat to the US on the global stage for the foreseeable future I have no idea. Most amateurs could have told you the USSR was on its last legs after years of scientists and members of their military reporting not being paid for years at a time. But the CIA was absolutely certain that they were doing great. And they should know, they had devoted stupendous resources to their intelligence work there. But, nope, they didn't see it coming at all.

223 points by colinprince 8y ago

sarcasmatwork 8y ago

Sounds like domestic terrorism.. is it not?

pytyper2 8y ago
If you redefine terrorism to remove the dependence on violence, unless I missed something in the article? I don't personally believe that trying to find security flaws terrorism.
- OrgNet 8y ago
  they aren't just trying to find security flaws... they probably buy/find most of them so that they can use them (it might scare and/or terrorize some people to be watched and controlled at all times)
  - village-idiot 8y ago
    That still wouldn’t be terrorism. It would be something else, potentially harassment or general authoritarianism.
sdinsn 8y ago
Quite a strange definition of terrorism you have there. When Uber stole Google's self driving secrets, do you think Uber was committing a terrorist act?
pretendscholar 8y ago
People seem to have a really hard time using the terms terrorism and genocide correctly.
village-idiot 8y ago
No, it quite clearly isn’t.

dang 8y ago

Discussed at the time: https://news.ycombinator.com/item?id=9176538 https://news.ycombinator.com/item?id=9176538.

tgb29 8y ago

I hope the CIA steals Apple's ability to innovate

C1sc0cat 8y ago
cough A12 cough

nickelcitymario 8y ago

Nothing in this article is surprising. I mean, honestly, if you don't think the CIA is actively trying to gain access to your devices, WTF do you think they do all day? I'd be more concerned if the intelligence agencies of the world WEREN'T doing this. It's their purpose. It's what we pay them for with our taxes. Of course we should also always root for tech companies to stay one step ahead. But infosec is an arms race, and I sure hope my own country's intelligence agencies (CSIS and the CSE in Canada) are doing their best to stay ahead of, say, North Korea or Russia. (Please note: I'm not saying violating our privacy is OK, any more than I'm saying it's cool to launch nuclear weapons. But if anyone's going to have the ability to hack my phone or launch a nuke, I want it to be the people on my own team. This seems like basic self-interest and survival strategy.)

whatshisface 8y ago
>WTF do you think they do all day? One would hope that they were trying to gain access to someone else's devices, as opposed to turning the guns towards their own citizens and economy. If a soldier showed up at my door and pointed their gun at me, my reaction wouldn't be "of course you're doing that, your job is to point guns."
- penagwin 8y ago
  Somethings like spying on American phone calls (or just their "metadata") I agree with. But somethings like breaking encryption, exploiting iPhones, etc. while they may be used against Americans can also be used against others. Essentially there's an arms race, and we use our tax money to sponsor our government in this race, with the hopes that they'll side with us. There really isn't another option unless you want to give a private entity this power, or not participate in the race (which I don't advise).
  - JustSomeNobody 8y ago
    > Somethings like spying on American phone calls (or just their "metadata") I agree with. > But somethings like breaking encryption, exploiting iPhones, etc. while they may be used against Americans can also be used against others. Both of these can have a chilling effect on free speech, therefore I'm against the CIA doing this to citizens. The potential threat against citizens nowhere near outweighs the need to uphold our constitution.

CalChris 8y ago

How is pen testing of iPhones stealing Apple's secrets? Does Apple know these holes are there and they're keeping them secret? I'll grant you that if the CIA broke into Apple and stole keys, that would stealing along with breaking and entering or the cybercrime equivalent. But that's not what the article says.

mlindner 8y ago
Yeah this article is a bit ridiculous. Pen testing is what security researchers do. It's a proverbial mountain out of a molehill. The Intercept longs for its Snowden glory days.
- ixtli 8y ago
  Not to nitpick but this is from 2015, which was right around the time when journalists were able to dig into how companies like microsoft and apple worked with the CIA/NSA to violate privacy, happily or otherwise.
joezydeco 8y ago
What about moles? Could the CIA hire someone, or many people, to attempt to get hired by Apple and spend years working their way into the higher echelons of the company?
- CalChris 8y ago
  They could do that but that wasn't what the article was about.
DINKDINK 8y ago
>How is pen testing of iPhones stealing Apple's secrets? Did you read the article? The CIA -- in addition to pentesting -- is trying to exfiltrate GID keys of Apple devices. That is quite literally, trying to steal Apple's secrets -- not checking which systems have vulnerabilities.
- 8y ago

tgragnato 8y ago

> The security researchers also claimed they had created a modified version of Apple’s proprietary software development tool, Xcode, which could sneak surveillance backdoors into any apps or programs created using the tool. Xcode, which is distributed by Apple to hundreds of thousands of developers, is used to create apps that are sold through Apple’s App Store. > The modified version of Xcode, the researchers claimed, could enable spies to steal passwords and grab messages on infected devices. Researchers also claimed the modified Xcode could “force all iOS applications to send embedded data to a listening post.” It remains unclear how intelligence agencies would get developers to use the poisoned version of Xcode. Sounds suspiciously like XCodeGhost: https://en.wikipedia.org/wiki/XcodeGhost https://en.wikipedia.org/wiki/XcodeGhost. This is probably worth a reference to Ken Thompson's "Reflections on Trusting Trust".

jokoon 8y ago

One thing is sure, is that the Snowden leaks really made me realize that countries won't bother with morals to improve national security and advance its capabilities, but in the end, it's just another debate that Machiavel has answers for. I think that communication technologies, and high speed internet becoming so widespread, created a big new battlefield which is particular because it's not so violent and ugly. There aren't clear military laws about the internet like there is for other battlefield like the geneva convention, and that's makes all of this so interesting.

exabrial 8y ago

Dear CIA: I have information regarding top secret Apple swipe to unlock technology patent.....

auslander 8y ago

Apparently they had no problems with Android devices.

nickpsecurity 8y ago

"“Apple led the way with secure coprocessors in phones, with fingerprint sensors, with encrypted messages. If you can attack Apple, then you can probably attack anyone.”" They really didn't. There were cryptophones, such as Cryptophone, doing secure messaging and stuff before Apple. Julian Assange used one IIRC. High-assurance security did stuff like Sectera Edge with some side-channel shielding, too. Then, there were companies like OK Labs building minimal, trusted, computing bases into phones with stuff like Android sandboxed in user-mode. Sensitive stuff ran outside. Then, Apple got into the game. They could still copy some of these techniques for improved security on top of what they're doing already. https://www.cryptophone.de/ https://www.cryptophone.de/ https://web.archive.org/web/20080408152145/http://www.gdc4s.com/content/detail.cfm?item=32640fd9-0213-4330-a742-55106fbaff32 https://web.archive.org/web/20080408152145/http://www.gdc4s.... https://web.archive.org/web/20110219075132/http://www.ok-labs.com/solutions/secure-hypercell-technology https://web.archive.org/web/20110219075132/http://www.ok-lab...

jasonvorhe 8y ago
Apple still led the way: Because Apple did it, Android vendors followed suit. Cryptophone and the other products were a niche market and no one really knows if they are good enough to withstand a nation state attack or if they are just good enough to provide better opsec for companies than regular phones did.

_robbywashere 8y ago

It’s funny because it appears, looking at the history of data leaks, security breaches etc - our biggest threat appears to be our insecurity Perhaps they should work the other way, assisting people and entities of this country to be MORE secure, not LESS.

otakucode 8y ago

>Brennan said the CIA reorganization will be modeled after the agency’s Counterterrorism Center, which runs the U.S. targeted killing and drone program. I always like to remind people when this comes up - The CIA is a civilian agency. They are not military. They have no legal right to engage in anything remotely resembling military action. Their only legal behavior is to collect international intelligence, though they seem to be capable only of doing everything outside their mandate and not within it. Why they weren't disbanded after the USSR imploded into bankruptcy 2 weeks after they had delivered a report claiming that the USSR was 'not a paper tiger' and 'growing stronger every day' and that they would continue to present the largest threat to the US on the global stage for the foreseeable future I have no idea. Most amateurs could have told you the USSR was on its last legs after years of scientists and members of their military reporting not being paid for years at a time. But the CIA was absolutely certain that they were doing great. And they should know, they had devoted stupendous resources to their intelligence work there. But, nope, they didn't see it coming at all.