5 ms·

Expectation : Political rivals and enemies of powerful people will be taken out because c-ild pornography will be found in their phone. Pegasus can already moni

Expectation : Political rivals and enemies of powerful people will be taken out because c-ild pornography will be found in their phone. Pegasus can already monitor and exfiltrate every ounce of data right now, it won't be that hard to insert compromising images on the infected device. Any news about "c-ild porn" being found on someone's phone is suspect now. This has been done before : 1) https://www.deccanchronicle.com/technology/in-other-news/120117/beware-hackers-are-planting-child-porn-on-peoples-computers.html https://www.deccanchronicle.com/technology/in-other-news/120... 2) https://www.independent.co.uk/news/uk/crime/handyman-planted-child-porn-colleague-s-computer-2037439.html https://www.independent.co.uk/news/uk/crime/handyman-planted... 3) https://www.theatlantic.com/notes/2015/09/how-easily-can-hackers-plant-evidence-contd/405133/ https://www.theatlantic.com/notes/2015/09/how-easily-can-hac... 4) https://www.nytimes.com/2016/12/09/world/europe/vladimir-putin-russia-fake-news-hacking-cybersecurity.html https://www.nytimes.com/2016/12/09/world/europe/vladimir-put... 5) https://www.cnet.com/tech/services-and-software/a-child-porn-planting-virus-threat-or-bad-defense/ https://www.cnet.com/tech/services-and-software/a-child-porn...

bko 5y ago
Isn't it weird how it is weaponized against political enemies but the one person everyone knows did engage in exploitation was protected for decades?
- newsclues 5y ago
  Selective prosecution.
- draw_down 5y ago
  More par for the course, I’d say.
- dijit 5y ago
  I don't think that's weird. Those people are not political enemies, they're allies for whatever regime and their support is important. Better to keep someone powerful in your pocket than to oust them and let someone uncorruptible or uncompromising assume the power vacuum.
  - LeoNatan25 5y ago
    No one is “ uncorruptible or uncompromising”. They just have to start looking from scratch.
    - dijit 5y ago
      There are many people who are incorruptible or uncompromising, we usually dislike them. Maybe "not sympathetic" would prevent me from being nerd sniped. :)
hanklazard 5y ago
And as an extra horrible side-effect, the use of these kinds of attacks in the political arena will “vindicate” believers of the QAnon conspiracy.
Crontab 5y ago
I remember reading the evil handyman story (link 2) a while ago and it scared me into using FDE. (Of course, FDE doesn't solve malware and things like that.)
coldtea 5y ago
You think such a thing can happen to the best of all possible worlds, where the powerful always abide by the law and never have politicians in their pockets, and the state only serves and never defames, threatens, or blackmails people?
Rd6n6 5y ago
That image planting virus concept is the scariest thing. Could you trigger this system and get the police alerted with spam mms with images or spam email with images, or targeted ads that get the gray blob images into your tmp files? Or does it have to be an actual script downloading images, say, one per week in secret until it triggers?
- robertoandred 5y ago
  No, you couldn't. This is only checking images you upload to your iCloud photo library. Why would you save tons of gray blobs to your photo library? Why would gray blobs look like child porn? Why would Apple reviewers think gray blobs are child porn? Why would the NCMEC think gray blobs are child porn? Why would law enforcement spend time arresting someone for gray blobs?
  - deleted 5y ago
    [deleted]
  - nullc 5y ago
    The grey blob is a proof of concept. The existence of the original image is proof that not all images which produce the target hash are grey blobs. Since the grey blob exists, I believe it is fully possible to construct natural(-ish) images that have a selected hash. So, you should perhaps instead imagine attackers that modify lawful nude images to have matching hashes with child porn images. With that in mind, most of your questions are answered, except perhaps for "Why would the NCMEC think"-- and the answer would be "because its porn and the computer says its child porn". Of course, an attacker could just as well use REAL child porn. But there are logistic advantages in having to do less handling of unlawful material, and it's less likely that the target will notice. Imagine: if the target already has nude images on their host the attacker might use those as the templates. I doubt most people would notice if their nude image collection was replaced with noisier versions of the same stuff. And even if they did notice, "someone is trying to frame me for child porn" wouldn't be their first guess. :)
    - robertoandred 5y ago
raxxorrax 5y ago
That you felt the need to kill the 'h' in child is telling enough. Let's face it, security policy from the last 20 years was created by idiots. Plain borderline mentally inhibited idiots. All the surviellance introduced so much mistrust in some states that no terrorist could have ever dreamed of. There is no rational cost-benefit analysis, only propaganda about some Ivan being allegedly worse. Yes, great metric... Sorry for the rant.
deleted 5y ago
[deleted]
snarf21 5y ago
I'm against this change from Apple but weren't they already doing this scanning in iCloud? Couldn't someone use it the same way against a "political rival and enemies of powerful people"?
- cyanite 5y ago
  All major cloud photo library providers do this scan server side, yes. This way offers more privacy for the end user… but evidently most people don’t realize that.

bko 5y ago

Isn't it weird how it is weaponized against political enemies but the one person everyone knows did engage in exploitation was protected for decades?

newsclues 5y ago
Selective prosecution.
draw_down 5y ago
More par for the course, I’d say.
dijit 5y ago
I don't think that's weird. Those people are not political enemies, they're allies for whatever regime and their support is important. Better to keep someone powerful in your pocket than to oust them and let someone uncorruptible or uncompromising assume the power vacuum.
- LeoNatan25 5y ago
  No one is “ uncorruptible or uncompromising”. They just have to start looking from scratch.
  - dijit 5y ago
    There are many people who are incorruptible or uncompromising, we usually dislike them. Maybe "not sympathetic" would prevent me from being nerd sniped. :)

hanklazard 5y ago

And as an extra horrible side-effect, the use of these kinds of attacks in the political arena will “vindicate” believers of the QAnon conspiracy.

Crontab 5y ago

I remember reading the evil handyman story (link 2) a while ago and it scared me into using FDE. (Of course, FDE doesn't solve malware and things like that.)

coldtea 5y ago

You think such a thing can happen to the best of all possible worlds, where the powerful always abide by the law and never have politicians in their pockets, and the state only serves and never defames, threatens, or blackmails people?

Rd6n6 5y ago

That image planting virus concept is the scariest thing. Could you trigger this system and get the police alerted with spam mms with images or spam email with images, or targeted ads that get the gray blob images into your tmp files? Or does it have to be an actual script downloading images, say, one per week in secret until it triggers?

robertoandred 5y ago
No, you couldn't. This is only checking images you upload to your iCloud photo library. Why would you save tons of gray blobs to your photo library? Why would gray blobs look like child porn? Why would Apple reviewers think gray blobs are child porn? Why would the NCMEC think gray blobs are child porn? Why would law enforcement spend time arresting someone for gray blobs?
- deleted 5y ago
  [deleted]
- nullc 5y ago
  The grey blob is a proof of concept. The existence of the original image is proof that not all images which produce the target hash are grey blobs. Since the grey blob exists, I believe it is fully possible to construct natural(-ish) images that have a selected hash. So, you should perhaps instead imagine attackers that modify lawful nude images to have matching hashes with child porn images. With that in mind, most of your questions are answered, except perhaps for "Why would the NCMEC think"-- and the answer would be "because its porn and the computer says its child porn". Of course, an attacker could just as well use REAL child porn. But there are logistic advantages in having to do less handling of unlawful material, and it's less likely that the target will notice. Imagine: if the target already has nude images on their host the attacker might use those as the templates. I doubt most people would notice if their nude image collection was replaced with noisier versions of the same stuff. And even if they did notice, "someone is trying to frame me for child porn" wouldn't be their first guess. :)
  - robertoandred 5y ago

raxxorrax 5y ago

That you felt the need to kill the 'h' in child is telling enough. Let's face it, security policy from the last 20 years was created by idiots. Plain borderline mentally inhibited idiots. All the surviellance introduced so much mistrust in some states that no terrorist could have ever dreamed of. There is no rational cost-benefit analysis, only propaganda about some Ivan being allegedly worse. Yes, great metric... Sorry for the rant.

deleted 5y ago

[deleted]

snarf21 5y ago

I'm against this change from Apple but weren't they already doing this scanning in iCloud? Couldn't someone use it the same way against a "political rival and enemies of powerful people"?

cyanite 5y ago
All major cloud photo library providers do this scan server side, yes. This way offers more privacy for the end user… but evidently most people don’t realize that.