19 ms·

Apple brass discussed disclosing 128M iPhone hack, then decided not to

413 points by throwawaysea 5y ago

spaetzleesser 5y ago
It seems once you are sufficiently big and rich a lot things that are required for smaller players become optional.
Jyaif 5y ago
> Schiller and the other people receiving the email wanted to figure out how to shore up its protections in light of their discovery that the static analyzer Apple used wasn’t effective against the newly discovered method. Yes, I totally believe that Apple did not know about NSInvocation and the half a dozen other ways to dynamically call methods.
- kevinh 5y ago
  The email is linked there and you can read it. Just because one team at Apple is aware of potential vulnerabilities doesn't mean that everyone at the company is equally aware.
  - stephc_int13 5y ago
    Top management is responsible, lack of technical competence or knowledge is not valid defense. This is their job to know.
    - deleted 5y ago
      [deleted]
    - IntelMiner 5y ago
      As loathe as I am to defend Apple on any points Top management isn't there to act as some infinite well of knowledge, they're there to speak about issues that have been distilled down to them on a higher level with other relevant teams What you're effectively saying is that Apple's "VP of Software" or something not knowing every line of source code in IOS is "not a valid defense"
      - stephc_int13 5y ago
        What I am saying is that in a general sense, in any hierarchical organisation, the boss has largest part of the responsibility share, no matter what. And then top management etc.
- deleted 5y ago
  [deleted]
RcouF1uZ4gsC 5y ago
> The infections were the result of legitimate developers writing apps using a counterfeit copy of Xcode, Apple’s iOS and OS X app development tool. The repackaged tool dubbed XcodeGhost surreptitiously inserted malicious code alongside normal app functions. > XcodeGhost billed itself as faster to download in China, compared with Xcode available from Apple. For developers to have run the counterfeit version, they would have had to click through a warning delivered by Gatekeeper, the macOS security feature that requires apps to be digitally signed by a known developer. Seems like a real world version of the Trusting Trust attack where the compiler is inserting malicious code.
- smbv 5y ago
  Maybe it's time to reread Reflections on Trusting Trust[0] [0] https://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-tho...
- medstrom 5y ago
  The full Trusting Trust attack would be if you'd use XcodeGhost to compile Xcode and it actually makes another XcodeGhost that just looks like Xcode, right? Preferably you do this to the developer responsible for uploading the compiled Xcode to central download servers. After a while no one has the real Xcode anymore, it's been lost to time, but no one knows this.
stephc_int13 5y ago
Well, this Epic lawsuit seems to turn into a nightmare on multiple fronts for the PR guys at Apple...
- ksec 5y ago
  Speaking of PR guys at Apple, I really miss the day when Apple PR were run by Katie Cotton. The genius in PR and marketing. >Well, this Epic lawsuit... And this is the issue that no one seems to be getting. Epic will lose. As a gaming company they never really have a case, I do admire them to have the courage to go against the largest cooperation in modern history. But it provide enough materials for their end goal for other parties, whether that is EU or US regulators.
  - wallwarp 5y ago
    The Dutch East India Trading Company wants to know your location. ;)
    - dylan604 5y ago
      I guess that depends on your definition of "modern history". Yes, Apple has a lot of cash, but is their current top corp based on value mean they are bigger in influence/effect on people's lives than others in history. I'm thinking AT&T pre-breakup, Standard Oil, rail roads, etc. I understand what the point the GP was making. It just sent me down a tangential bit of thinking. Ugh, and on a Saturday!
      - matwood 5y ago
        Interesting thoughts. I think a lot of this comparing Apple to the companies you listed is the wrong way to think about them. First, it's not just Apple. The App Store/ecosystem concept is a newish concept, and probably needs completely new types of regulation outside of anti-trust. Apple, Google, MS, Sony, Nintendo, etc... are for the most part monopolies in their respective worlds, but fail at the traditional monopoly definition. Waiting for a company to achieve an AT&T or Standard Oil level level of power is an outdated way of thinking. Apple also doesn't have anywhere near that level of power.
superjan 5y ago
The article is about apple failing to detect a huge number of apps that accidentally contained malware. I would not call this an iPhone hack though.
- djmips 5y ago
  Probably it's this kind of thinking that allowed for such a thing to occur. Not all gates were equally secure.
- pmontra 5y ago
  Not accidentally. A malicious third party version of XCode injected the malware into the apps and Apple's vetting system failed to detect it. Apple eventually discovered it and decided not to warn its customers.
  - superjan 5y ago
    I mean accidental in the sense that the developer was not acting in bad faith. I don’t mean to defend Apple, it just annoys me that this is advertised as an iPhone hack.
    - xmprt 5y ago
      Apple is claiming that their App Store is secure and rigorous. If developers (maliciously or not) were able to add code like this to their apps then doesn't that mean someone was able to hack the App Store verification process? And if they were, is it not Apple's responsibility to inform their users that their devices might have malicious apps?
      - katbyte 5y ago
        That it happened is not a valid data point, it should be compared to other stores and what % are malicious apps. Now not disclosing it is on them but at the same time, it was the apps who were hacked and I can see it falling to them to disclose?
simion314 5y ago
I remember there are some laws about disclosing breaches. Did this happened before those laws or the letter of the law does not apply in this specific case. For the anti-regulation guys, please explain how free market helps in this or similar cases and why a law to demand transparency for this cases is also evil. (I am still waiting on other threads an explanation that regulation that only forces transparency and what is tracked and shared is bad and free market solves it better)
- nemothekid 5y ago
  I'm not sure the law applies to Apple in this case. It wasn't Apple that was hacked. Another way of looking at it is if Facebook was hacked, and the hacker put malicious code into the Facebook iOS app and Apple notices, it's Facebook that is the liable party; Apple just noticed.
  - lupire 5y ago
    What company had full control over whether the Facebook software is installed on my phone?
    - nemothekid 5y ago
      You? I’m not sure what point you are making. Apple does not preload apps onto your phone.
      - simion314 5y ago
        Apple/Google restrict what apps are in the Store , they and their fans will say that the locked store is for security. When Apple/Google review fails (it will never be a perfect review process), reasonable people would say that Apple/Google would not only remove the malware from the store but they would also at least notify the victims.
  - Dah00n 5y ago
    Apple controls and approve Appstore apps. If it were in the app Apple is clearly also a party since they are paid to approve it. It's only s matter of time before the EU will smack Apple down.
CyberRabbi 5y ago
When it comes to insecurity of your mobile device, this is just the tip of the iceberg.
- gruez 5y ago
  >insecurity How? This is a simple case of "code execution results in code execution". iOS is already sandboxed, so the impact was limited. I'm not sure what you'd expect apple to do, other than have some sort of system that can detect arbitrary malicious code.
  - CyberRabbi 5y ago
    Check the liner notes of your monthly OS updates for sandbox escape and RCE fixes and you’ll understand the prevalence of the problem I’m trying to describe. Couple that with the fact that mobile OS software configurations are relatively highly standardized and very sensitive and valuable personal information is usually stored on mobile devices.
lawnchair_larry 5y ago
The headline is pretty much a lie here.
moralestapia 5y ago
Oh, the stuff that's coming out of this lawsuit is gold.
- dylan604 5y ago
  Knowing that court cases are usually an airing of everyone's dirty laundry, I kind of wish the FBI did not drop their case against Apple.
onedognight 5y ago
According to the article from Apple[0], WeChat 6.2.6 and DiDi Taxi 4.1.0, among many others, were affected. [0] https://web.archive.org/web/20151101142446/http://www.apple.com:80/cn/xcodeghost https://web.archive.org/web/20151101142446/http://www.apple....
spitfire 5y ago
So a few weeks ago I started an overnight copy of some files to my APFS encrypted backup disk. I came down in the morning to fine the filesystem corrupted. iBooks won't sync ePub files I add manually. <A bunch of other niggles, too many to list> Now we find out Apple cares more about its image, than quality. I've been wanting to move away from Apple for a while, but this finalises it. I'll be doing one final upgrade to the ARM chips, then putting effort into moving away. Including funding projects if needed. This is a really bad look for Apple. It's clear they're not worthy of my trust.
- stephc_int13 5y ago
  Software has never been their forte, unfortunately.
  - spitfire 5y ago
    Funny thing it was. I consider the current apple to have started with Jobs at NeXT. From Nextstep through to snow leopard they were fantastic and getting better every release. Not so much now, they've found a cash cow and seem to be entranced by it.
    - robertoandred 5y ago
      Those are some serious rose-tinted glasses you've got on there.
  - uniqueid 5y ago
    Apple was the gold standard for software for most of the first 35 years (excepting a few years after 1995) of its existence. Apple used to hold a reputation for building the best software in the industry. On a side note, sometimes getting older feels like being in a Twilight Zone episode. Like I woke up and, for some reason everyone is calling records and 45s 'vinyls'. Or I mention 'Cary Grant' and people just stare at me blankly because his memory has been erased from existence. This Apple comment is one of those moments: it feels like yesterday Apple's talent for software was common knowledge, and suddenly today I'm in a parallel universe where Apple has always created buggy garbage.
harikb 5y ago
Wait, why is this Apple’s fault? > The infections were the result of legitimate developers writing apps using a counterfeit copy of Xcode, Apple’s iOS and OS X app development tool. The repackaged tool dubbed XcodeGhost surreptitiously inserted malicious code alongside normal app functions. This was shown by Ken Thompson is 1984 I thought [1] 1. http://wiki.c2.com/?TheKenThompsonHack http://wiki.c2.com/?TheKenThompsonHack
- josephcsible 5y ago
  The breach wasn't Apple's fault, but the cover-up is.
  - deleted 5y ago
    [deleted]
- Siira 5y ago
  Why was there a counterfeit Xcode in the first place? Reminds me of how hard it is to download Xcode with the crappy App Store when not having the connection Apple engineers enjoy ...
  - katbyte 5y ago
    Because “it downloaded faster in China” apparently?
- lazide 5y ago
  Besides it maybe not being Apple’s fault (except for not telling anyone) - it is maybe Apple’s fault because they explicitly state they are reviewing apps, and did not catch this issue. So they obviously have a huge blind spot and their customers were impacted because of it. Considering the scope and scale of the App Store and the massive revenues from it, it is also pretty hard to believe some better scanning or analysis software wouldn’t have caught this pre-emptively? Since I remember the ‘Apple was not doing true binary level review’ coming up when I talked to an iOS developer literally a decade ago about the App Store (back in Android 1.1 SDK days) - he even mentioned this type of attack as a possibility - and they obviously haven’t changed that, there are probably a ton more like this out there that have slipped under the radar due to smaller scope, or less clear impact.
iJohnDoe 5y ago
Anyone that has been in the industry long enough and has worked with Apple in any capacity knows that Apple is hostile to their users and their partners. Apple always does what is in the best interest of Apple. Everything else is just marketing.
- goalieca 5y ago
  > Apple always does what is in the best interest of Apple. Everything else is just marketing. I don’t truly believe Apple is interested in user privacy as a core value but it is a hell of a differentiator compared to Google. On this topic, my interests and theirs happen to align for the time being.
  - tmashb 5y ago
    Approach and hypocrisy matters. Apple did boast about privacy and security many times before...
    - deleted 5y ago
      [deleted]
  - Siira 5y ago
    You can't win in a duopoly.
    - kwere 5y ago
      yeah but with buzz marketing you can catch the fat cutsomer and avoid antitrust oversee
  - NicoJuicy 5y ago
    Remember iAd? Didn't work, so they try something else to differentiate. If this wouldn't work, they will just adjust targets.
    - simondotau 5y ago
xucheng 5y ago
If I remembered correctly, this incident was actually widely reported in China when it broke out. It was cause by many iOS developers in China chose to download a counterfeit version of Xcode because the network connection from China to any foreign servers are so bad. Though, it is true that Apple never disclosed the full list of compromised Apps or how many users are affected. Also, I am not sure that sending Emails to affected users would be effective. Most of affected users come from China, and a significant portion of them use phone number instead of Email to register App Store account.
IkmoIkmo 5y ago
The following was posted on Macrumors. Definitely not a perfect user-first response from Apple, but didn't seem terrible either. Particularly because Apple wasn't the source of the issue, the issue was people downloading an unofficial XCode tool not made or hosted by Apple. Apple discovered it (just like many researchers did) and made various (non-perfect) efforts to mitigate it. And according to Macrumors, the attack did not really lead to any serious consequences. Not sure if that's true but I haven't seen any evidence to the contrary either. > Apple did ultimately inform users that downloaded XcodeGhost apps, and also published a list of the top 25 most popular apps that were compromised. Apple removed all of the infected apps from the App Store , and provided information to developers to help them validate Xcode going forward. > XcodeGhost was a widespread attack, but it was not effective or dangerous. At the time, Apple said that it had no information to suggest that the malware was ever used for any malicious purpose nor that sensitive personal data was stolen, but it did collect app bundle identifiers, network details, and device names and types.
- londons_explore 5y ago
  > Apple said that it had no information to suggest that the malware was ever used So in other words, it was used only on a few high value targets, rather than being used to serve up ads to all 128M users. Still not much better...
- egberts1 5y ago
  ya think Mac could have a poor hash tag matching for security of its executables, such as Xcode?
  - LogicX 5y ago
    Not according to the article: “For developers to have run the counterfeit version, they would have had to click through a warning delivered by Gatekeeper, the macOS security feature that requires apps to be digitally signed by a known developer.” Worked just fine. Developers circumvented it. Should’ve been the red flag.
jader201 5y ago
What is “Apple brass”? I see only one other mention of it in the article (aside from the title) with zero additional context, and surprised to see zero occurrences of it here. A Google search of “Apple brass” turns up nothing, as well, besides other references to this article. Am I the only one that has never heard this term, and also curious by its reference in the article’s headline?
- pygatea 5y ago
  “Brass” in this context means “leadership.” See: https://idioms.thefreedictionary.com/top+brass https://idioms.thefreedictionary.com/top+brass
  - FridayoLeary 5y ago
    Not a new product. I was inclined for a moment to think it was ("We will now introduce the all-new Apple Brass!")
  - kshacker 5y ago
    It is not a snapshot of then when the issue happened, but I would equate it to https://www.apple.com/leadership/ https://www.apple.com/leadership/
- dwighttk 5y ago
  unspecified people in charge at Apple
- gpm 5y ago
  "Brass" is synonymous with "leadership" in this context, it has a bit of a military connotation, but can be used elsewhere as well.
  - jader201 5y ago
    TIL. Have never heard of this before.
    - 5y ago
inetknght 5y ago
This only comes to light because of the discovery process during a lawsuit. Where's the regulations to protect consumers? Oh right, the US regulators don't protect consumers. At all. Even though that's what they're supposed to do.
- musicale 5y ago
  The 128M number seems to be new, but XCodeGhost was widely reported at the time (e.g. in the New York Times, BBC News, Wired, InfoWorld, Mac sites like 9to5Mac, and of course Ars Technica itself.) More references at: https://en.wikipedia.org/wiki/XcodeGhost https://en.wikipedia.org/wiki/XcodeGhost Here's what Apple[1] said[2] at the time: "We've removed the apps from the App Store that we know have been created with this counterfeit software," said Apple spokeswoman Christine Monaghan. "We are working with the developers to make sure they're using the proper version of Xcode to rebuild their apps," said Christine Monaghan. [1] https://www.bbc.com/news/technology-34311203 https://www.bbc.com/news/technology-34311203 [2] https://developer.apple.com/news/?id=09222015a https://developer.apple.com/news/?id=09222015a
1f60c 5y ago
As for why anyone would download this "counterfeit" copy of Xcode (quoting from TFA): > XcodeGhost billed itself as faster to download in China, compared with Xcode available from Apple. For developers to have run the counterfeit version, they would have had to click through a warning delivered by Gatekeeper, the macOS security feature that requires apps to be digitally signed by a known developer.
- nerbert 5y ago
  Amazing.
  - dannyw 5y ago
    Have you tried downloading large non-GFW files from China? You want to spend 6 hours updating xcode each time with a 1 in 3 chance of errors and failures?
    - asiachick 5y ago
      Ir happens often when downloading electron from github while in Japan. Quite often I'll 'npm install' and then it's a 2hour download for what should be 20 seconds. All other western sites are working fine, just github's large binary files. Verified from multiple machines on multiple different networks around the city. Have reported the issue multiple times to github and they always claim "nothing we can do, not our problem"
    - nerbert 5y ago
      That's where the GFW starts to undermine the competitivity of China on the world stage.
_kbh_ 5y ago
This attack sounds remarkably close to a type of malware from the CIA that the intercept wrote an article about. https://www.schneier.com/blog/archives/2015/03/how_the_cia_mig.html https://www.schneier.com/blog/archives/2015/03/how_the_cia_m...
deleted 5y ago
[deleted]

413 points by throwawaysea 5y ago

It seems once you are sufficiently big and rich a lot things that are required for smaller players become optional.

> Schiller and the other people receiving the email wanted to figure out how to shore up its protections in light of their discovery that the static analyzer Apple used wasn’t effective against the newly discovered method. Yes, I totally believe that Apple did not know about NSInvocation and the half a dozen other ways to dynamically call methods.

kevinh 5y ago
The email is linked there and you can read it. Just because one team at Apple is aware of potential vulnerabilities doesn't mean that everyone at the company is equally aware.
- stephc_int13 5y ago
  Top management is responsible, lack of technical competence or knowledge is not valid defense. This is their job to know.
  - deleted 5y ago
    [deleted]
  - IntelMiner 5y ago
    As loathe as I am to defend Apple on any points Top management isn't there to act as some infinite well of knowledge, they're there to speak about issues that have been distilled down to them on a higher level with other relevant teams What you're effectively saying is that Apple's "VP of Software" or something not knowing every line of source code in IOS is "not a valid defense"
    - stephc_int13 5y ago
      What I am saying is that in a general sense, in any hierarchical organisation, the boss has largest part of the responsibility share, no matter what. And then top management etc.
deleted 5y ago
[deleted]

RcouF1uZ4gsC 5y ago

> The infections were the result of legitimate developers writing apps using a counterfeit copy of Xcode, Apple’s iOS and OS X app development tool. The repackaged tool dubbed XcodeGhost surreptitiously inserted malicious code alongside normal app functions. > XcodeGhost billed itself as faster to download in China, compared with Xcode available from Apple. For developers to have run the counterfeit version, they would have had to click through a warning delivered by Gatekeeper, the macOS security feature that requires apps to be digitally signed by a known developer. Seems like a real world version of the Trusting Trust attack where the compiler is inserting malicious code.

smbv 5y ago
Maybe it's time to reread Reflections on Trusting Trust[0] [0] https://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-tho...
medstrom 5y ago
The full Trusting Trust attack would be if you'd use XcodeGhost to compile Xcode and it actually makes another XcodeGhost that just looks like Xcode, right? Preferably you do this to the developer responsible for uploading the compiled Xcode to central download servers. After a while no one has the real Xcode anymore, it's been lost to time, but no one knows this.

stephc_int13 5y ago

Well, this Epic lawsuit seems to turn into a nightmare on multiple fronts for the PR guys at Apple...

ksec 5y ago
Speaking of PR guys at Apple, I really miss the day when Apple PR were run by Katie Cotton. The genius in PR and marketing. >Well, this Epic lawsuit... And this is the issue that no one seems to be getting. Epic will lose. As a gaming company they never really have a case, I do admire them to have the courage to go against the largest cooperation in modern history. But it provide enough materials for their end goal for other parties, whether that is EU or US regulators.
- wallwarp 5y ago
  The Dutch East India Trading Company wants to know your location. ;)
  - dylan604 5y ago
    I guess that depends on your definition of "modern history". Yes, Apple has a lot of cash, but is their current top corp based on value mean they are bigger in influence/effect on people's lives than others in history. I'm thinking AT&T pre-breakup, Standard Oil, rail roads, etc. I understand what the point the GP was making. It just sent me down a tangential bit of thinking. Ugh, and on a Saturday!
    - matwood 5y ago
      Interesting thoughts. I think a lot of this comparing Apple to the companies you listed is the wrong way to think about them. First, it's not just Apple. The App Store/ecosystem concept is a newish concept, and probably needs completely new types of regulation outside of anti-trust. Apple, Google, MS, Sony, Nintendo, etc... are for the most part monopolies in their respective worlds, but fail at the traditional monopoly definition. Waiting for a company to achieve an AT&T or Standard Oil level level of power is an outdated way of thinking. Apple also doesn't have anywhere near that level of power.

superjan 5y ago

The article is about apple failing to detect a huge number of apps that accidentally contained malware. I would not call this an iPhone hack though.

djmips 5y ago
Probably it's this kind of thinking that allowed for such a thing to occur. Not all gates were equally secure.
pmontra 5y ago
Not accidentally. A malicious third party version of XCode injected the malware into the apps and Apple's vetting system failed to detect it. Apple eventually discovered it and decided not to warn its customers.
- superjan 5y ago
  I mean accidental in the sense that the developer was not acting in bad faith. I don’t mean to defend Apple, it just annoys me that this is advertised as an iPhone hack.
  - xmprt 5y ago
    Apple is claiming that their App Store is secure and rigorous. If developers (maliciously or not) were able to add code like this to their apps then doesn't that mean someone was able to hack the App Store verification process? And if they were, is it not Apple's responsibility to inform their users that their devices might have malicious apps?
    - katbyte 5y ago
      That it happened is not a valid data point, it should be compared to other stores and what % are malicious apps. Now not disclosing it is on them but at the same time, it was the apps who were hacked and I can see it falling to them to disclose?

simion314 5y ago

I remember there are some laws about disclosing breaches. Did this happened before those laws or the letter of the law does not apply in this specific case. For the anti-regulation guys, please explain how free market helps in this or similar cases and why a law to demand transparency for this cases is also evil. (I am still waiting on other threads an explanation that regulation that only forces transparency and what is tracked and shared is bad and free market solves it better)

nemothekid 5y ago
I'm not sure the law applies to Apple in this case. It wasn't Apple that was hacked. Another way of looking at it is if Facebook was hacked, and the hacker put malicious code into the Facebook iOS app and Apple notices, it's Facebook that is the liable party; Apple just noticed.
- lupire 5y ago
  What company had full control over whether the Facebook software is installed on my phone?
  - nemothekid 5y ago
    You? I’m not sure what point you are making. Apple does not preload apps onto your phone.
    - simion314 5y ago
      Apple/Google restrict what apps are in the Store , they and their fans will say that the locked store is for security. When Apple/Google review fails (it will never be a perfect review process), reasonable people would say that Apple/Google would not only remove the malware from the store but they would also at least notify the victims.
- Dah00n 5y ago
  Apple controls and approve Appstore apps. If it were in the app Apple is clearly also a party since they are paid to approve it. It's only s matter of time before the EU will smack Apple down.

CyberRabbi 5y ago

When it comes to insecurity of your mobile device, this is just the tip of the iceberg.

gruez 5y ago
>insecurity How? This is a simple case of "code execution results in code execution". iOS is already sandboxed, so the impact was limited. I'm not sure what you'd expect apple to do, other than have some sort of system that can detect arbitrary malicious code.
- CyberRabbi 5y ago
  Check the liner notes of your monthly OS updates for sandbox escape and RCE fixes and you’ll understand the prevalence of the problem I’m trying to describe. Couple that with the fact that mobile OS software configurations are relatively highly standardized and very sensitive and valuable personal information is usually stored on mobile devices.

lawnchair_larry 5y ago

The headline is pretty much a lie here.

moralestapia 5y ago

Oh, the stuff that's coming out of this lawsuit is gold.

dylan604 5y ago
Knowing that court cases are usually an airing of everyone's dirty laundry, I kind of wish the FBI did not drop their case against Apple.

onedognight 5y ago

According to the article from Apple[0], WeChat 6.2.6 and DiDi Taxi 4.1.0, among many others, were affected. [0] https://web.archive.org/web/20151101142446/http://www.apple.com:80/cn/xcodeghost https://web.archive.org/web/20151101142446/http://www.apple....

spitfire 5y ago

So a few weeks ago I started an overnight copy of some files to my APFS encrypted backup disk. I came down in the morning to fine the filesystem corrupted. iBooks won't sync ePub files I add manually. <A bunch of other niggles, too many to list> Now we find out Apple cares more about its image, than quality. I've been wanting to move away from Apple for a while, but this finalises it. I'll be doing one final upgrade to the ARM chips, then putting effort into moving away. Including funding projects if needed. This is a really bad look for Apple. It's clear they're not worthy of my trust.

stephc_int13 5y ago
Software has never been their forte, unfortunately.
- spitfire 5y ago
  Funny thing it was. I consider the current apple to have started with Jobs at NeXT. From Nextstep through to snow leopard they were fantastic and getting better every release. Not so much now, they've found a cash cow and seem to be entranced by it.
  - robertoandred 5y ago
    Those are some serious rose-tinted glasses you've got on there.
- uniqueid 5y ago
  Apple was the gold standard for software for most of the first 35 years (excepting a few years after 1995) of its existence. Apple used to hold a reputation for building the best software in the industry. On a side note, sometimes getting older feels like being in a Twilight Zone episode. Like I woke up and, for some reason everyone is calling records and 45s 'vinyls'. Or I mention 'Cary Grant' and people just stare at me blankly because his memory has been erased from existence. This Apple comment is one of those moments: it feels like yesterday Apple's talent for software was common knowledge, and suddenly today I'm in a parallel universe where Apple has always created buggy garbage.

harikb 5y ago

Wait, why is this Apple’s fault? > The infections were the result of legitimate developers writing apps using a counterfeit copy of Xcode, Apple’s iOS and OS X app development tool. The repackaged tool dubbed XcodeGhost surreptitiously inserted malicious code alongside normal app functions. This was shown by Ken Thompson is 1984 I thought [1] 1. http://wiki.c2.com/?TheKenThompsonHack http://wiki.c2.com/?TheKenThompsonHack

josephcsible 5y ago
The breach wasn't Apple's fault, but the cover-up is.
- deleted 5y ago
  [deleted]
Siira 5y ago
Why was there a counterfeit Xcode in the first place? Reminds me of how hard it is to download Xcode with the crappy App Store when not having the connection Apple engineers enjoy ...
- katbyte 5y ago
  Because “it downloaded faster in China” apparently?
lazide 5y ago
Besides it maybe not being Apple’s fault (except for not telling anyone) - it is maybe Apple’s fault because they explicitly state they are reviewing apps, and did not catch this issue. So they obviously have a huge blind spot and their customers were impacted because of it. Considering the scope and scale of the App Store and the massive revenues from it, it is also pretty hard to believe some better scanning or analysis software wouldn’t have caught this pre-emptively? Since I remember the ‘Apple was not doing true binary level review’ coming up when I talked to an iOS developer literally a decade ago about the App Store (back in Android 1.1 SDK days) - he even mentioned this type of attack as a possibility - and they obviously haven’t changed that, there are probably a ton more like this out there that have slipped under the radar due to smaller scope, or less clear impact.

iJohnDoe 5y ago

Anyone that has been in the industry long enough and has worked with Apple in any capacity knows that Apple is hostile to their users and their partners. Apple always does what is in the best interest of Apple. Everything else is just marketing.

goalieca 5y ago
> Apple always does what is in the best interest of Apple. Everything else is just marketing. I don’t truly believe Apple is interested in user privacy as a core value but it is a hell of a differentiator compared to Google. On this topic, my interests and theirs happen to align for the time being.
- tmashb 5y ago
  Approach and hypocrisy matters. Apple did boast about privacy and security many times before...
  - deleted 5y ago
    [deleted]
- Siira 5y ago
  You can't win in a duopoly.
  - kwere 5y ago
    yeah but with buzz marketing you can catch the fat cutsomer and avoid antitrust oversee
- NicoJuicy 5y ago
  Remember iAd? Didn't work, so they try something else to differentiate. If this wouldn't work, they will just adjust targets.
  - simondotau 5y ago

xucheng 5y ago

If I remembered correctly, this incident was actually widely reported in China when it broke out. It was cause by many iOS developers in China chose to download a counterfeit version of Xcode because the network connection from China to any foreign servers are so bad. Though, it is true that Apple never disclosed the full list of compromised Apps or how many users are affected. Also, I am not sure that sending Emails to affected users would be effective. Most of affected users come from China, and a significant portion of them use phone number instead of Email to register App Store account.

IkmoIkmo 5y ago

The following was posted on Macrumors. Definitely not a perfect user-first response from Apple, but didn't seem terrible either. Particularly because Apple wasn't the source of the issue, the issue was people downloading an unofficial XCode tool not made or hosted by Apple. Apple discovered it (just like many researchers did) and made various (non-perfect) efforts to mitigate it. And according to Macrumors, the attack did not really lead to any serious consequences. Not sure if that's true but I haven't seen any evidence to the contrary either. > Apple did ultimately inform users that downloaded XcodeGhost apps, and also published a list of the top 25 most popular apps that were compromised. Apple removed all of the infected apps from the App Store , and provided information to developers to help them validate Xcode going forward. > XcodeGhost was a widespread attack, but it was not effective or dangerous. At the time, Apple said that it had no information to suggest that the malware was ever used for any malicious purpose nor that sensitive personal data was stolen, but it did collect app bundle identifiers, network details, and device names and types.

londons_explore 5y ago
> Apple said that it had no information to suggest that the malware was ever used So in other words, it was used only on a few high value targets, rather than being used to serve up ads to all 128M users. Still not much better...
egberts1 5y ago
ya think Mac could have a poor hash tag matching for security of its executables, such as Xcode?
- LogicX 5y ago
  Not according to the article: “For developers to have run the counterfeit version, they would have had to click through a warning delivered by Gatekeeper, the macOS security feature that requires apps to be digitally signed by a known developer.” Worked just fine. Developers circumvented it. Should’ve been the red flag.

jader201 5y ago

What is “Apple brass”? I see only one other mention of it in the article (aside from the title) with zero additional context, and surprised to see zero occurrences of it here. A Google search of “Apple brass” turns up nothing, as well, besides other references to this article. Am I the only one that has never heard this term, and also curious by its reference in the article’s headline?

pygatea 5y ago
“Brass” in this context means “leadership.” See: https://idioms.thefreedictionary.com/top+brass https://idioms.thefreedictionary.com/top+brass
- FridayoLeary 5y ago
  Not a new product. I was inclined for a moment to think it was ("We will now introduce the all-new Apple Brass!")
- kshacker 5y ago
  It is not a snapshot of then when the issue happened, but I would equate it to https://www.apple.com/leadership/ https://www.apple.com/leadership/
dwighttk 5y ago
unspecified people in charge at Apple
gpm 5y ago
"Brass" is synonymous with "leadership" in this context, it has a bit of a military connotation, but can be used elsewhere as well.
- jader201 5y ago
  TIL. Have never heard of this before.
  - 5y ago

inetknght 5y ago

This only comes to light because of the discovery process during a lawsuit. Where's the regulations to protect consumers? Oh right, the US regulators don't protect consumers. At all. Even though that's what they're supposed to do.

musicale 5y ago
The 128M number seems to be new, but XCodeGhost was widely reported at the time (e.g. in the New York Times, BBC News, Wired, InfoWorld, Mac sites like 9to5Mac, and of course Ars Technica itself.) More references at: https://en.wikipedia.org/wiki/XcodeGhost https://en.wikipedia.org/wiki/XcodeGhost Here's what Apple[1] said[2] at the time: "We've removed the apps from the App Store that we know have been created with this counterfeit software," said Apple spokeswoman Christine Monaghan. "We are working with the developers to make sure they're using the proper version of Xcode to rebuild their apps," said Christine Monaghan. [1] https://www.bbc.com/news/technology-34311203 https://www.bbc.com/news/technology-34311203 [2] https://developer.apple.com/news/?id=09222015a https://developer.apple.com/news/?id=09222015a

1f60c 5y ago

As for why anyone would download this "counterfeit" copy of Xcode (quoting from TFA): > XcodeGhost billed itself as faster to download in China, compared with Xcode available from Apple. For developers to have run the counterfeit version, they would have had to click through a warning delivered by Gatekeeper, the macOS security feature that requires apps to be digitally signed by a known developer.

nerbert 5y ago
Amazing.
- dannyw 5y ago
  Have you tried downloading large non-GFW files from China? You want to spend 6 hours updating xcode each time with a 1 in 3 chance of errors and failures?
  - asiachick 5y ago
    Ir happens often when downloading electron from github while in Japan. Quite often I'll 'npm install' and then it's a 2hour download for what should be 20 seconds. All other western sites are working fine, just github's large binary files. Verified from multiple machines on multiple different networks around the city. Have reported the issue multiple times to github and they always claim "nothing we can do, not our problem"
  - nerbert 5y ago
    That's where the GFW starts to undermine the competitivity of China on the world stage.

_kbh_ 5y ago

This attack sounds remarkably close to a type of malware from the CIA that the intercept wrote an article about. https://www.schneier.com/blog/archives/2015/03/how_the_cia_mig.html https://www.schneier.com/blog/archives/2015/03/how_the_cia_m...

deleted 5y ago

[deleted]