8 ms·

Here's a fun conspiracy theory proposed entirely in jest: Apple doesn't want to patch zero-days used by US authorities in order to alleviate pressure on its en

Here's a fun conspiracy theory proposed entirely in jest: Apple doesn't want to patch zero-days used by US authorities in order to alleviate pressure on its encryption practices. So they really only want to fix zero-days that are known broadly or get media attention. And they don't want to give too much incentive to researchers to report zero-days to Apple instead of selling them to the highest bidder (which may ultimately be the largest governments with the greatest ability to regulate Apple).

threeseed 5y ago
So then explain this page: https://support.apple.com/en-au/HT201222 https://support.apple.com/en-au/HT201222 Why would they bother fixing any of the bugs ?
jjcon 5y ago
> alleviate pressure on its encryption practices. Apple is not that different from the status quo on end to end encryption as to necessitate a conspiracy (probably even in jest ). They have no icloud encryption, no photos encryption, no device backup encryption etc etc.
- dev_tty01 5y ago
  One small correction. They do have backup encryption. As a matter of fact, your various account passwords are only backed up if you keep the encrypt option turned on. https://support.apple.com/en-us/HT205220 https://support.apple.com/en-us/HT205220 As far as the original article, I agree completely that not paying and crediting these folks in a timely manner is just stupid and will reduce Apple security long term.
  - heavyset_go 5y ago
    Apple holds the keys to encrypted iCloud backups.
    - dev_tty01 5y ago
      Yes, they do have some way of using your iCloud account credentials to get to the backup key. Given the level of customer support needed for forgotten backup keys, they have probably chosen this as the lesser of two evils. If you don't like that "feature," don't do iCloud backups. I do direct backups as described in the support link. Apple doesn't have those keys.
      - ballenf 5y ago
        I do wonder how much longer local, machine-based backups will continue to be supported. Could easily see a future model dropping the cable entirely, dropping local backup and modestly upping the free iCloud storage.
        selectodude 5y ago
        iPhones have supported Wifi backup to local computer for a decade now.
        kayodelycaon 5y ago
        That automatically syncs when both your laptop and phone are plugged in and on the same WiFi network. (I think you need power nap enabled if you're using an Intel Mac.)
      - sneak 5y ago
        It doesn't matter if you don't do iCloud backups. All of your iMessages will be backed up to Apple in ways that Apple/FBI can read because iCloud Backup (not e2e) is on on every device held by the people you are iMessaging with.
        novok 5y ago
        Depending on how cheap your friends are, they might not have effective backups because they wont spend money for the iCloud space to have enough space for their backups in the first place.
- ballenf 5y ago
  Would that still apply if a target has iCloud backup turned off?
rlt 5y ago
Next level conspiracy theory: Apple employs, knowingly or unknowingly, CIA/NSA agents who intentionally introduce these bugs.
- deleted 5y ago
  [deleted]
- tptacek 5y ago
  It would indeed be a next-level conspiracy theory to suggest the NSA planted an employee at Apple to introduce a GameCenter bug that lets you read a cache of contacts, rather than, you know, just taking the whole device over, which is what "zero day" usually implies.
  - 0des 5y ago
    zero day only implies that it is novel, day 0 of something being in the wild.
    - akerl_ 5y ago
      The first day that anything is available is technically “day 0”, but if I told you I had a PS5 zero day you’d assume I’d discovered a major compromise of the PS5, not that I’d managed to purchase a console the day they went on sale.
    - tptacek 5y ago
      That's true, but the implication of "zero day" in a new story is code execution, because those are the only zero days that make the news. You can just read this thread and see that several people commenting here clearly believe these bugs were comparable to code execution. The article, uh, does not go out of its way to clear up the ambiguity.
tptacek 5y ago
This is indeed silly, because the zero-day vulnerabilities that the IC exploits provide full kernel-level access to devices, and this just lets you read contacts from an app you install from the app store (which does local API-level surveillance already) on the device.
paxys 5y ago
If Apple was complicit in US authorities breaking into their devices they wouldn't be doing so via publicly exploitable vulnerabilities. Bugs making their way into the "wrong" hands decreases trust in their ecosystem. It makes much more sense to just add a backdoor.
smoldesu 5y ago
You've got the wrong ideas. The government isn't using the same exploits as you and me, their backdoors are hidden much better and offer far more comprehensive control than just a silly Gamecenter vuln.
tempfs 5y ago
Believe me when I say that all major tech companies have spooks in their ranks. They don't really need to insert backdoors or ignore bugs. They have human assets in the teams. Ask anyone who works in one of these organisations and they will attest to how many former IC people fill the ranks in certain areas.

threeseed 5y ago

So then explain this page: https://support.apple.com/en-au/HT201222 https://support.apple.com/en-au/HT201222 Why would they bother fixing any of the bugs ?

jjcon 5y ago

> alleviate pressure on its encryption practices. Apple is not that different from the status quo on end to end encryption as to necessitate a conspiracy (probably even in jest ). They have no icloud encryption, no photos encryption, no device backup encryption etc etc.

dev_tty01 5y ago
One small correction. They do have backup encryption. As a matter of fact, your various account passwords are only backed up if you keep the encrypt option turned on. https://support.apple.com/en-us/HT205220 https://support.apple.com/en-us/HT205220 As far as the original article, I agree completely that not paying and crediting these folks in a timely manner is just stupid and will reduce Apple security long term.
- heavyset_go 5y ago
  Apple holds the keys to encrypted iCloud backups.
  - dev_tty01 5y ago
    Yes, they do have some way of using your iCloud account credentials to get to the backup key. Given the level of customer support needed for forgotten backup keys, they have probably chosen this as the lesser of two evils. If you don't like that "feature," don't do iCloud backups. I do direct backups as described in the support link. Apple doesn't have those keys.
    - ballenf 5y ago
      I do wonder how much longer local, machine-based backups will continue to be supported. Could easily see a future model dropping the cable entirely, dropping local backup and modestly upping the free iCloud storage.
      - selectodude 5y ago
        iPhones have supported Wifi backup to local computer for a decade now.
        kayodelycaon 5y ago
        That automatically syncs when both your laptop and phone are plugged in and on the same WiFi network. (I think you need power nap enabled if you're using an Intel Mac.)
    - sneak 5y ago
      It doesn't matter if you don't do iCloud backups. All of your iMessages will be backed up to Apple in ways that Apple/FBI can read because iCloud Backup (not e2e) is on on every device held by the people you are iMessaging with.
      - novok 5y ago
        Depending on how cheap your friends are, they might not have effective backups because they wont spend money for the iCloud space to have enough space for their backups in the first place.
ballenf 5y ago
Would that still apply if a target has iCloud backup turned off?

rlt 5y ago

Next level conspiracy theory: Apple employs, knowingly or unknowingly, CIA/NSA agents who intentionally introduce these bugs.

deleted 5y ago
[deleted]
tptacek 5y ago
It would indeed be a next-level conspiracy theory to suggest the NSA planted an employee at Apple to introduce a GameCenter bug that lets you read a cache of contacts, rather than, you know, just taking the whole device over, which is what "zero day" usually implies.
- 0des 5y ago
  zero day only implies that it is novel, day 0 of something being in the wild.
  - akerl_ 5y ago
    The first day that anything is available is technically “day 0”, but if I told you I had a PS5 zero day you’d assume I’d discovered a major compromise of the PS5, not that I’d managed to purchase a console the day they went on sale.
  - tptacek 5y ago
    That's true, but the implication of "zero day" in a new story is code execution, because those are the only zero days that make the news. You can just read this thread and see that several people commenting here clearly believe these bugs were comparable to code execution. The article, uh, does not go out of its way to clear up the ambiguity.

tptacek 5y ago

This is indeed silly, because the zero-day vulnerabilities that the IC exploits provide full kernel-level access to devices, and this just lets you read contacts from an app you install from the app store (which does local API-level surveillance already) on the device.

paxys 5y ago

If Apple was complicit in US authorities breaking into their devices they wouldn't be doing so via publicly exploitable vulnerabilities. Bugs making their way into the "wrong" hands decreases trust in their ecosystem. It makes much more sense to just add a backdoor.

smoldesu 5y ago

You've got the wrong ideas. The government isn't using the same exploits as you and me, their backdoors are hidden much better and offer far more comprehensive control than just a silly Gamecenter vuln.

tempfs 5y ago

Believe me when I say that all major tech companies have spooks in their ranks. They don't really need to insert backdoors or ignore bugs. They have human assets in the teams. Ask anyone who works in one of these organisations and they will attest to how many former IC people fill the ranks in certain areas.