4 ms·

This is a super interesting problem! It applies to basically all desktop autoupdaters. Note that App Stores are in a better place -- as far as I know they don

This is a super interesting problem! It applies to basically all desktop autoupdaters. Note that App Stores are in a better place -- as far as I know they don't make it possible to target users with malicious updates, you'd have to push the malicious update to everyone at once. Some anonymity wins for desktop apps are downloading updates over Tor (to prevent the update server knowing who you are by your IP) or Bittorrent (to prevent the ability to offer an update to someone without offering it to everyone), and checking that you're being offered a binary whose hash is published publicly (e.g. to a blockchain). But then you start hitting increased code surface problems and those systems not working on some networks. I think Tor's Firefox browser does the anonymous Tor update thing; that's probably the best in class here.

novok 7y ago
Well the app store can be compelled to push unique updates. It's more work, but it isn't an impossibility.
- cjbprime 7y ago
  Do you have an example of how?
  - saagarjha 7y ago
    Presumably you'd be able to if you put a selection of engineers at gunpoint.
    - cjbprime 7y ago
      I mean, we're talking about engineers from two different companies at this point, right? Presumably the Foo App engineers have to prepare and sign a malware version of Foo and then you have to go coerce a bunch of Apple engineers to send the iOS update to specific phones. Once your conspiracy theory involves multiple uncoordinated groups, the chance of it remaining secret basically goes to zero. Once you stop holding people at gunpoint they're going to tell someone what you did. Once it's known that Apple targeted malware at some of its users, its reputation will crash. So Apple would probably resist this as strongly as it can, which is probably pretty strongly given that it's the most valuable public company in the entire world. Am I missing something? This is not sounding like a plausible conspiracy theory so far.
      - saagarjha 7y ago
        Why to talk to the Foo App people when you can make your own malware version of Foo App?
      - sneak 7y ago
        It's not a conspiracy theory if the proposed scenario is the DOJ says to Apple in a lawful wiretap order "you must push this wiretapped messaging app update to phone identified by IMEI 12345". Wiretaps and stored comms records subpoenas are commonplace things, and the DOJ is entirely capable of contracting someone to quickly produce a specially-modified wiretap version of any app available on the app store (it's not a terribly difficult technical hurdle), even the ones that aren't open source. Whether or not Apple would cooperate by providing the appropriate app signature and shipping it to the phone or not is another question. There is of course the legal argument that creating a cryptographic signature against their will is compelled speech and thus they have the right to fight or refuse. Personally, I doubt they'd fight very hard, provided the whole thing were kept secret (which would be in the interest of both Apple and the DOJ). Apple knows quite well that you can't fight city hall (or the CCP). The wiretapped iCloud servers in China are a perfect example of Apple's reputation remaining intact despite shipping a nationwide backdoor for a government to millions of their iPhone and iPad customers. After all, they'd always have the standard "we received a lawful wiretap order, signed by a federal judge, appropriately limited in scope to a single suspect, with which we were legally required to comply" fallback.
        cjbprime 7y ago
        Jeez, I guess so. We're pretty far off track: when I wrote that "[app stores] don't make it possible to target users with malicious updates" up there, what I was talking about was that the app stores aren't giving Foo App's developers the power to push individualized malware to their users, which is a power that Foo App has through its own desktop autoupdater system. App stores raise the bar from "Foo App decides to own you" to "The DoJ is able to convince a company with the legal firepower of Apple to sign and deliver a backdoored version of someone else's app". This is.. not a small difference in user risk.
  - sneak 7y ago
    Apple's desktop OS updaters have historically had the ability, serverside, to target specific serial numbers or MAC addresses to receive certain firmware updates. I would be surprised if they don't have similar functionality on the iOS side of things.

novok 7y ago

Well the app store can be compelled to push unique updates. It's more work, but it isn't an impossibility.

cjbprime 7y ago
Do you have an example of how?
- saagarjha 7y ago
  Presumably you'd be able to if you put a selection of engineers at gunpoint.
  - cjbprime 7y ago
    I mean, we're talking about engineers from two different companies at this point, right? Presumably the Foo App engineers have to prepare and sign a malware version of Foo and then you have to go coerce a bunch of Apple engineers to send the iOS update to specific phones. Once your conspiracy theory involves multiple uncoordinated groups, the chance of it remaining secret basically goes to zero. Once you stop holding people at gunpoint they're going to tell someone what you did. Once it's known that Apple targeted malware at some of its users, its reputation will crash. So Apple would probably resist this as strongly as it can, which is probably pretty strongly given that it's the most valuable public company in the entire world. Am I missing something? This is not sounding like a plausible conspiracy theory so far.
    - saagarjha 7y ago
      Why to talk to the Foo App people when you can make your own malware version of Foo App?
    - sneak 7y ago
      It's not a conspiracy theory if the proposed scenario is the DOJ says to Apple in a lawful wiretap order "you must push this wiretapped messaging app update to phone identified by IMEI 12345". Wiretaps and stored comms records subpoenas are commonplace things, and the DOJ is entirely capable of contracting someone to quickly produce a specially-modified wiretap version of any app available on the app store (it's not a terribly difficult technical hurdle), even the ones that aren't open source. Whether or not Apple would cooperate by providing the appropriate app signature and shipping it to the phone or not is another question. There is of course the legal argument that creating a cryptographic signature against their will is compelled speech and thus they have the right to fight or refuse. Personally, I doubt they'd fight very hard, provided the whole thing were kept secret (which would be in the interest of both Apple and the DOJ). Apple knows quite well that you can't fight city hall (or the CCP). The wiretapped iCloud servers in China are a perfect example of Apple's reputation remaining intact despite shipping a nationwide backdoor for a government to millions of their iPhone and iPad customers. After all, they'd always have the standard "we received a lawful wiretap order, signed by a federal judge, appropriately limited in scope to a single suspect, with which we were legally required to comply" fallback.
      - cjbprime 7y ago
        Jeez, I guess so. We're pretty far off track: when I wrote that "[app stores] don't make it possible to target users with malicious updates" up there, what I was talking about was that the app stores aren't giving Foo App's developers the power to push individualized malware to their users, which is a power that Foo App has through its own desktop autoupdater system. App stores raise the bar from "Foo App decides to own you" to "The DoJ is able to convince a company with the legal firepower of Apple to sign and deliver a backdoored version of someone else's app". This is.. not a small difference in user risk.
- sneak 7y ago
  Apple's desktop OS updaters have historically had the ability, serverside, to target specific serial numbers or MAC addresses to receive certain firmware updates. I would be surprised if they don't have similar functionality on the iOS side of things.