6 ms·

"How can you use it for targeted attacks?" Just insert a known CSAM image on target's device. Done. I presume this could be used against a rival political par

by fsloth 5y ago

"How can you use it for targeted attacks?" Just insert a known CSAM image on target's device. Done. I presume this could be used against a rival political party to ruin their reputation - insert bunch of CSAM images on their devices. "Party X is revealed as an abuse ring". This goes oh-so-very-nicely with Qanon conspiracy theories which even don't require any evidence to propagate widely. Wait for Apple to find the images. When police investigation is opened, make it very public. Start a social media campaign at the same time. It's enough to fabricate evidence only for a while - the public perception of the individual or the group will be perpetually altered, even though it would surface later that the CSAM material was inserted by hostile third party. You have to think about what nation state entities that are now clients of Pegasus and so on could do with this. Not how safe the individual component is.

kreitje 5y ago
FL Rep Randy Fine filed a report with the Florida Department of Law Enforcement that the sheriff was going to plant CSAM on his computer and arrest him for it. They are even in the same political party. https://www.reddit.com/r/321/comments/jt32rs/fdle_report_between_randy_fine_and_wayne_ivey/ https://www.reddit.com/r/321/comments/jt32rs/fdle_report_bet...
JimBard2 5y ago
Indeed this is not new and has probably been happening for many years already. There are services advertising on dark net markets to “ruin someone’s life” which means you pay some Ukrainian guy $300 in Bitcoin and he plants CSAM on a target’s computer.
JKCalhoun 5y ago
> Just insert a known CSAM image on target's device. Or maybe thirty. You have to surpass the threshold. Also, if Twitter, Google, Microsoft are already deploying CSAM scanning in their services .... why are we not hearing about all the "swatting"?
- short_sells_poo 5y ago
  Who cares that Bad Company XYZ already well known for not caring about customer privacy does it? Wouldn't you want to push back against even more increasing surveillance? Apply was beating the drum of privacy while it was convenient, wouldn't you want to hold their feet to the fire now that they seemed to do a U-turn?
  - sweetheart 5y ago
    Their point is that the attack vector being described isn’t new, as CSAM could already be weaponized against folks, and we never really ever hear if that happening. So the OP is simply saying that perhaps it’s not an issue we need to worry about. I happen to agree with them.
    - short_sells_poo 5y ago
      So in your mind, because so far we've seen no evidence that this has been abused, it's nothing to worry about going forward? And that making an existing situation even more widespread is also completely OK?
      - colejohnson66 5y ago
        It’s that the situation can’t be a “slippery slope” if there’s no evidence of there being one prior
      - sweetheart 5y ago
        > So in your mind, because so far we've seen no evidence that this has been abused, it's nothing to worry about going forward? Yeah, basically. It doesn't seem like people actually use CSAM to screw over innocent folks, so I don't think we need to worry about it. What Apple is doing doesn't really make that any easier, so it's either already a problem, or not a problem. > And that making an existing situation even more widespread is also completely OK? I don't know if I'd say any of this is "completely OK", as I don't think I've fully formed my opinion on this whole Apple CSAM debate, but I at least agree with OP that I don't think we need to suddenly worry about people weaponizing CSAM all of a sudden when it's been an option for years now with no real stories of anyone actually being victimized.
russdpale 5y ago
You don't have to add a real picture, just add the hash of a benign, (new) cat picture to the db, then put the cat picture on the phone, then release a statement saying the person has popped up on your list. By the time the truth comes out the damage is done.
hannasanarion 5y ago
> I presume this could be used against a rival political party to ruin their reputation - insert bunch of CSAM images on their devices. Okay, and then what? You think people will just look at this cute picture of a dog and be like "welp, the computer says it's a photo of child abuse, so we're taking you to jail anyway"?
sam0x17 5y ago
> Just insert a known CSAM image on target's device. Done. You don't even need to go that far. You just need to generate 31 false positive images and send them to an innocent user.
- cyanite 5y ago
  But how will you do that without access to the non-blinded hash table? Then you need access to that first. Also, “sending” them to a user isn’t enough; they need to be stored in the photo library, and iCloud Photo Library needs to be enabled.
cyanite 5y ago
> Just insert a known CSAM image on target's device. Done. What do you mean “just”? That’s not usually very simple. It needs to go into the actual photo library. Also, you need like 30 of them inserted. > I presume this could be used against a rival political party Yes, but it’s not much different from now, since most cloud photo providers scan for this cloud-side. So that’s more an argument against scanning all together.
- tick_tock_tick 5y ago
  > It needs to go into the actual photo library. iMessage photos received are automatically synced so no. Finding 30 photos take zero time at all on Tor. Hell finding a .onion site that doesn't have CP randomly spammed is harder.....
  - bsql 5y ago
    iMessage photos do not automatically add photos to your photo library. Yes they’re synced between devices but afaik Apple isn’t deploying this hashing technology on iMessages between devices. Only for iCloud photos in the photo library.
- lowkey_ 5y ago
  WhatsApp for example automatically stores images you receive in your Photos library, so that removes a step, and those will thus be automatically uploaded to iCloud. The one failsafe would be Apple's manual reviewers, but we haven't heard much about that process yet.
FabHK 5y ago
> "How can you use it for targeted attacks?" > Just insert a known CSAM image on target's device. Done. Yes, but then the hash collision (topic of this article) is irrelevant.
ribosometronome 5y ago
How is this different from server side scanning, the policy de jour that Apple was trying to move away from?

by fsloth 5y ago

kreitje 5y ago

FL Rep Randy Fine filed a report with the Florida Department of Law Enforcement that the sheriff was going to plant CSAM on his computer and arrest him for it. They are even in the same political party. https://www.reddit.com/r/321/comments/jt32rs/fdle_report_between_randy_fine_and_wayne_ivey/ https://www.reddit.com/r/321/comments/jt32rs/fdle_report_bet...

JimBard2 5y ago

Indeed this is not new and has probably been happening for many years already. There are services advertising on dark net markets to “ruin someone’s life” which means you pay some Ukrainian guy $300 in Bitcoin and he plants CSAM on a target’s computer.

JKCalhoun 5y ago

> Just insert a known CSAM image on target's device. Or maybe thirty. You have to surpass the threshold. Also, if Twitter, Google, Microsoft are already deploying CSAM scanning in their services .... why are we not hearing about all the "swatting"?

short_sells_poo 5y ago
Who cares that Bad Company XYZ already well known for not caring about customer privacy does it? Wouldn't you want to push back against even more increasing surveillance? Apply was beating the drum of privacy while it was convenient, wouldn't you want to hold their feet to the fire now that they seemed to do a U-turn?
- sweetheart 5y ago
  Their point is that the attack vector being described isn’t new, as CSAM could already be weaponized against folks, and we never really ever hear if that happening. So the OP is simply saying that perhaps it’s not an issue we need to worry about. I happen to agree with them.
  - short_sells_poo 5y ago
    So in your mind, because so far we've seen no evidence that this has been abused, it's nothing to worry about going forward? And that making an existing situation even more widespread is also completely OK?
    - colejohnson66 5y ago
      It’s that the situation can’t be a “slippery slope” if there’s no evidence of there being one prior
    - sweetheart 5y ago
      > So in your mind, because so far we've seen no evidence that this has been abused, it's nothing to worry about going forward? Yeah, basically. It doesn't seem like people actually use CSAM to screw over innocent folks, so I don't think we need to worry about it. What Apple is doing doesn't really make that any easier, so it's either already a problem, or not a problem. > And that making an existing situation even more widespread is also completely OK? I don't know if I'd say any of this is "completely OK", as I don't think I've fully formed my opinion on this whole Apple CSAM debate, but I at least agree with OP that I don't think we need to suddenly worry about people weaponizing CSAM all of a sudden when it's been an option for years now with no real stories of anyone actually being victimized.

russdpale 5y ago

You don't have to add a real picture, just add the hash of a benign, (new) cat picture to the db, then put the cat picture on the phone, then release a statement saying the person has popped up on your list. By the time the truth comes out the damage is done.

hannasanarion 5y ago

> I presume this could be used against a rival political party to ruin their reputation - insert bunch of CSAM images on their devices. Okay, and then what? You think people will just look at this cute picture of a dog and be like "welp, the computer says it's a photo of child abuse, so we're taking you to jail anyway"?

sam0x17 5y ago

> Just insert a known CSAM image on target's device. Done. You don't even need to go that far. You just need to generate 31 false positive images and send them to an innocent user.

cyanite 5y ago
But how will you do that without access to the non-blinded hash table? Then you need access to that first. Also, “sending” them to a user isn’t enough; they need to be stored in the photo library, and iCloud Photo Library needs to be enabled.

cyanite 5y ago

> Just insert a known CSAM image on target's device. Done. What do you mean “just”? That’s not usually very simple. It needs to go into the actual photo library. Also, you need like 30 of them inserted. > I presume this could be used against a rival political party Yes, but it’s not much different from now, since most cloud photo providers scan for this cloud-side. So that’s more an argument against scanning all together.

tick_tock_tick 5y ago
> It needs to go into the actual photo library. iMessage photos received are automatically synced so no. Finding 30 photos take zero time at all on Tor. Hell finding a .onion site that doesn't have CP randomly spammed is harder.....
- bsql 5y ago
  iMessage photos do not automatically add photos to your photo library. Yes they’re synced between devices but afaik Apple isn’t deploying this hashing technology on iMessages between devices. Only for iCloud photos in the photo library.
lowkey_ 5y ago
WhatsApp for example automatically stores images you receive in your Photos library, so that removes a step, and those will thus be automatically uploaded to iCloud. The one failsafe would be Apple's manual reviewers, but we haven't heard much about that process yet.

FabHK 5y ago

> "How can you use it for targeted attacks?" > Just insert a known CSAM image on target's device. Done. Yes, but then the hash collision (topic of this article) is irrelevant.

ribosometronome 5y ago

How is this different from server side scanning, the policy de jour that Apple was trying to move away from?