4 ms·

OS makers have that magic software and seem to keep it secure enough. They can update your device and potentially hack if it they want to. If you think that's a

OS makers have that magic software and seem to keep it secure enough. They can update your device and potentially hack if it they want to. If you think that's a bad idea, what alternative would you propose for automatic security updates?

TaylorAlexander 7y ago
Linux distros can all be configured to update automatically. This does not require external control - the machine is capable of checking update servers on its own and updating if configured to do so. I don’t see how external control would be required for automatic updates.
- fwip 7y ago
  Automatic updates give the update server the ability to compromise your machine.
  - kitotik 7y ago
    But at least you get to choose who is on the list of potential suppliers.
  - TaylorAlexander 7y ago
    Most software updates risk compromising your machine, no? I’m talking about whether external control is required for software updates to occur. As with Windows, where Microsoft can replace software on your machine at any time. On Ubuntu, canonical can add backdoored software to their repositories but they can’t forcibly install software on your machine AFAIK. Maybe I just misunderstood the comment I was responding to.
    - rickycook 7y ago
      well they kinda can... if they do any update to include software, that software can be anything... update systemd to include remote execution, or to install any package they want (but why would it be a package??)
  - olliej 7y ago
    you're right, an automatic update could install malicious software, but the common request has been to have software that law enforcement can use with any device. e.g. law inforcement gets a tool "BreakEveryonesSecurity.exe/app" that can talk to any device they find. For that to work all devices have to be pre-compromised. Another work for pre-compromised is "insecure".
leggomylibro 7y ago
The "magic software" is, at its core, just strong encryption and an unbroken chain of trust. You trust your OS updates because your machine trusts the certificate it is presented with. Your machine trusts that certificate because it is signed by an authority which is in your machine's local list of trusted authorities. If people mess up that list of trusted certificate authorities, it can easily compromise the system. Remember this? https://en.wikipedia.org/wiki/Superfish#Lenovo_security_incident https://en.wikipedia.org/wiki/Superfish#Lenovo_security_inci... Now imagine if, instead of having an identifiable certificate authority which accidentally allowed third parties to intercept and modify your encrypted traffic, that were an undetectable feature of the encryption algorithm. If that were the case, no matter how much you trusted the entity that understands the nature of the backdoor, you would not trust your OS.
- lopmotr 7y ago
  So the problem is more about transparency and reliability of the software than about government access? I don't think so though because otherwise anyone proposing government backdoors would neutralize opposition by saying let's make it a front door, we'll have our certificate trusted by those same CAs and be open about it.
olliej 7y ago
No, that's a misrepresentation of how these things work. An iOS device cannot install an update without an unlock, and any updates it does push are signed by an apple key, and does not make software with compromised security. Apple then designs the system so that someone hacking Apple doesn't give them the ability to hack iOS devices. The way apple achieves this is to make the phones require a user unlock to update the device or to connect to another machine. The only way to make magic software work would be for apple to deliberately compromise the device security. The moment they did that, that would mean there was a tool that would only need to be leaked once to compromise all apple devices. The solution is to not design a broken security model. I assume the high end android devices are similar, but given android phones are still being shipped without a Secure Enclave I can imagine there are some trivially compromised devices. So then let's get to how the update itself works. The device gets a user unlock to occur (iirc if you have automatic updates enabled this means that your device has to have been unlocked in the last 24 hours?[1]). The device pulls an update from an apple server, verifies both the server it pulls from, and the bundle itself. No one else can publish or mitm the update. There's no magic software that can just be passed around - you would need to compromise apple itself, and compromise it to the point that you can get the updates signed by their production signing keys without anyone noticing. If you're really unsure how all this works feel free to read their documentation: https://www.apple.com/business/site/docs/iOS_Security_Guide.pdf https://www.apple.com/business/site/docs/iOS_Security_Guide.... [1] I re-read the white paper's update mechanism and it sounds like it always requires an unlock before updating. So it's not a hysteresis. So automatic update is gated on an unlock before bed and asking permission to perform the update.
- lopmotr 7y ago
  I understand how it works but you said we can't trust anyone with magic software. I assume you count secret keys as part of that magic software. Apple has such software and keys, so we can't trust Apple. Perhaps you really meant "we can't trust anyone except Apple, Microsoft, Google, Samsung, Lenovo, etc."? If you don't count secret keys, then are you happy for governments to have their own OS update keys and use their own servers that are quietly accessed by devices? That's not quite applicable to this story though which seems to be just observing network traffic.

TaylorAlexander 7y ago

Linux distros can all be configured to update automatically. This does not require external control - the machine is capable of checking update servers on its own and updating if configured to do so. I don’t see how external control would be required for automatic updates.

fwip 7y ago
Automatic updates give the update server the ability to compromise your machine.
- kitotik 7y ago
  But at least you get to choose who is on the list of potential suppliers.
- TaylorAlexander 7y ago
  Most software updates risk compromising your machine, no? I’m talking about whether external control is required for software updates to occur. As with Windows, where Microsoft can replace software on your machine at any time. On Ubuntu, canonical can add backdoored software to their repositories but they can’t forcibly install software on your machine AFAIK. Maybe I just misunderstood the comment I was responding to.
  - rickycook 7y ago
    well they kinda can... if they do any update to include software, that software can be anything... update systemd to include remote execution, or to install any package they want (but why would it be a package??)
- olliej 7y ago
  you're right, an automatic update could install malicious software, but the common request has been to have software that law enforcement can use with any device. e.g. law inforcement gets a tool "BreakEveryonesSecurity.exe/app" that can talk to any device they find. For that to work all devices have to be pre-compromised. Another work for pre-compromised is "insecure".

leggomylibro 7y ago

The "magic software" is, at its core, just strong encryption and an unbroken chain of trust. You trust your OS updates because your machine trusts the certificate it is presented with. Your machine trusts that certificate because it is signed by an authority which is in your machine's local list of trusted authorities. If people mess up that list of trusted certificate authorities, it can easily compromise the system. Remember this? https://en.wikipedia.org/wiki/Superfish#Lenovo_security_incident https://en.wikipedia.org/wiki/Superfish#Lenovo_security_inci... Now imagine if, instead of having an identifiable certificate authority which accidentally allowed third parties to intercept and modify your encrypted traffic, that were an undetectable feature of the encryption algorithm. If that were the case, no matter how much you trusted the entity that understands the nature of the backdoor, you would not trust your OS.

lopmotr 7y ago
So the problem is more about transparency and reliability of the software than about government access? I don't think so though because otherwise anyone proposing government backdoors would neutralize opposition by saying let's make it a front door, we'll have our certificate trusted by those same CAs and be open about it.

olliej 7y ago

No, that's a misrepresentation of how these things work. An iOS device cannot install an update without an unlock, and any updates it does push are signed by an apple key, and does not make software with compromised security. Apple then designs the system so that someone hacking Apple doesn't give them the ability to hack iOS devices. The way apple achieves this is to make the phones require a user unlock to update the device or to connect to another machine. The only way to make magic software work would be for apple to deliberately compromise the device security. The moment they did that, that would mean there was a tool that would only need to be leaked once to compromise all apple devices. The solution is to not design a broken security model. I assume the high end android devices are similar, but given android phones are still being shipped without a Secure Enclave I can imagine there are some trivially compromised devices. So then let's get to how the update itself works. The device gets a user unlock to occur (iirc if you have automatic updates enabled this means that your device has to have been unlocked in the last 24 hours?[1]). The device pulls an update from an apple server, verifies both the server it pulls from, and the bundle itself. No one else can publish or mitm the update. There's no magic software that can just be passed around - you would need to compromise apple itself, and compromise it to the point that you can get the updates signed by their production signing keys without anyone noticing. If you're really unsure how all this works feel free to read their documentation: https://www.apple.com/business/site/docs/iOS_Security_Guide.pdf https://www.apple.com/business/site/docs/iOS_Security_Guide.... [1] I re-read the white paper's update mechanism and it sounds like it always requires an unlock before updating. So it's not a hysteresis. So automatic update is gated on an unlock before bed and asking permission to perform the update.

lopmotr 7y ago
I understand how it works but you said we can't trust anyone with magic software. I assume you count secret keys as part of that magic software. Apple has such software and keys, so we can't trust Apple. Perhaps you really meant "we can't trust anyone except Apple, Microsoft, Google, Samsung, Lenovo, etc."? If you don't count secret keys, then are you happy for governments to have their own OS update keys and use their own servers that are quietly accessed by devices? That's not quite applicable to this story though which seems to be just observing network traffic.