8 ms·

Ok normally I’d just let something like this go but I just have to pull my hair out when I see a comment like this. The attack surface of software as complicat

Ok normally I’d just let something like this go but I just have to pull my hair out when I see a comment like this. The attack surface of software as complicated as a modern operating system (iOS or MacOS, etc.) is simply too large to lockdown without dramatically hurting the user experience (assuming you could actually achieve a lockdown in the first place!!). Let’s, just for a second, propose that apple went full Monty and locked the whole shebang down with the kind of tech they’d need to resist NSO. That’s more custom silicon, signed binaries everywhere, even fewer per app permissions, literally treating any piece of software running on the device as a potential threat vector even more than they already do. What would this get you? The BoM cost would go up, a lot. The cost of writing software would go up, a lot. And perhaps worst of all: it would only raise the cost of a chain of exploits, not eradicate it. Right now a chain of exploits is ~$5M on iOS. What if it was $50M? Would that actually stop a nation state? I’m sorry but there’s no world where Apple can make perfect security. Finally, the cost of this lawsuit is a drop in the ocean compared to what they already spend trying to secure the software and hardware in iOS devices.

Sporktacular 5y ago
"Right now a chain of exploits is ~$5M on iOS. What if it was $50M? Would that actually stop a nation state?" Yes, some states yes it would. That could make it unaffordable for many of NSOs clients. The result would not be perfect, just better.
fsflover 5y ago
> The attack surface of software as complicated as a modern operating system (iOS or MacOS, etc.) is simply too large to lockdown without dramatically hurting the user experience (assuming you could actually achieve a lockdown in the first place!!). https://qubes-os.org https://qubes-os.org
- tptacek 5y ago
  You talk to a lot of people who use Qubes day to day? I do. What have you heard about how Qubes life is?
  - fsflover 5y ago
    I am gladly using Qubes myself as a daily driver. Can't recommend it enough.
    - tptacek 5y ago
      Hey, my Qubes friends keep using it too. I'm not saying it's un-usable. Is dys-usable a word?
      - fsflover 5y ago
        This is a vague and unconstructive criticism. Perhaps you could say something more to the point. In my opinion, most of the HN audience would be able to use it to their benefit.
        tptacek 5y ago
        That might be true! But it's not very relevant to the NSO problem, because the mass market will not be able to use it.
rStar 5y ago
> I’m sorry but there’s no world where Apple can make perfect security i think everyone knows that perfect security is not possible, the operative word being ‘perfect’. i think what we want is for apple to ‘actually try’ to provide security, in some way that results in security order of magnitudes better than we enjoy today, which would still be miles and miles away from ‘perfect’, vulnerable to nation state actors etc etc etc
- kelnos 5y ago
  > i think what we want is for apple to ‘actually try’ to provide security, in some way that results in security order of magnitudes better than we enjoy today That's a pretty tall order, and would likely result in a device that is much more expensive and has a user experience that users would not like. Assuming "orders of magnitude better" is even possible, of which I am skeptical.
- josh2600 5y ago
  Can you point to a single instance of a cellphone vendor who takes security more seriously than Apple? Put a different way, is there any device with a high monthly active user count that has a higher cost to purchase a black market exploit than the iPhone? Apple can always do better. It should also scare the living hell out of us that they’re currently the best in the world. My point is that if Apple can’t secure your phones, who can? It’s enough to make one think about security through obscurity.
  - fsflover 5y ago
    > is there any device with a high monthly active user count that has a higher cost to purchase a black market exploit than the iPhone? This is unfair, because there is a duopoly and the only alternative on mass market is Android. Of course in such circumstances the exploits will be expensive, even if security is awful. Ignoring this, Purism takes security more seriously, because they give the user full control over the OS with possibility to replace/reinstall or harden it. In contrast to that, rarely updated iMessage is impossible to uninstall on iOs.
  - ccouzens 5y ago
snowwrestler 5y ago
You’re not wrong about the impossibility of perfect security. But Apple is praising and promising to support independent security research in this press release. Meanwhile they have a reputation among independent security researchers for being standoffish, opaque, slow to respond, and even outright hostile in suing Corellium. They settled that suit but the reputation remains. Apple is the most valuable company in the world. They do not appear to have the best security program in the world. Whatever Citizen Lab can do, Apple should be able to do better; they have a lot more resources and expertise. I’m not doubting that Apple puts a lot of effort into securing their products. But it seems like they still have significant room for improvement.
- concinds 5y ago
  Seconded. There are many, many low hanging fruits that would substantially improve Apple users' security that Apple has not yet implemented, for example delivering Safari updates independently from macOS updates and having a seamless auto-update mechanism equivalent to every other modern browser. Apple repeatedly claims that most malware targets Android, which is true, but it includes Play Store adware and side-loaded malware; if you only take RCE exploits, which are the relevant class of malware here, one could argue Android is as secure, or more secure than iOS. I would argue the latter, given that Safari and iMessage (as well as integrated WebKit webviews, like Apple Music) seem like the primary attack vectors, and the ones used by NSO; and that security updates to those components, unlike the Android equivalents, are delayed to match Apple's preferred iOS release schedule, instead of being autoupdated separately and transparently to the user.
  - nicce 5y ago
    One could also argue, that as Apple is commonly branded as "secure" alternative, and therefore high profile targets are potentially using their products. This might mean that interest is much higher for attackers on that side. They might not care so much about Android. Increased interest and effort means that more likely something is found. Also, Apple's sandboxing settings and permission managing makes the most malware pretty useless with App store policies (no sideloading), so only RCE exploits are kinda useful. What it comes to iMessages, that is the most interesting channel with Safari to deliver exploits, iMessage without user interaction and Safari with some. All you need to know is that target is using iPhone. Other non-default applications as target introduces new challenges. iMessage and Safaring being part of OS updates might indicate, that they are handled differently compared to other apps - is security policy same, worse or better? Is there larger attack interface to system by using these apps?
tptacek 5y ago
I co-sign this whole comment and answer the rhetorical question: $50MM for an exploit chain would not stop a state-level adversary. Their alternatives for these kinds of operations is human intelligence; they'd pay more just in health benefits to staff those operations.
high_byte 5y ago
if it was 50m there would be significant increase in reports, for sure. problem is Apple has a reputation for not paying bounties...
matheusmoreira 5y ago
> literally treating any piece of software running on the device as a potential threat vector even more than they already do Sounds amazing. Every operating system should be designed this way. Only free software should have full access. Proprietary software cannot be trusted and must be regulated and controlled.
DSingularity 5y ago
Apple will advance the security of their platform more by suing NSO and lobbying the US gov to position the official view of the US gov regarding nation-state sponsorship for malicious software as reprehensible efforts which harm everyone (eg like biological/chemical weapons). If the US sanctioned Israel and critiqued them as reckless maybe less countries will support organizations like the NSO group.
Sporktacular 5y ago
It's not clear the user experience would have to suffer. Maybe there are more groups doing for software architecture what Signal did for messaging. Groups like Heisers' SEL4 and Qubes. As for expense, imagine how much more we would have paid today, in real and opportunity costs, if over the last 20 years everyone used this "no such thing a perfect security" fatalism as the excuse to not just do things a bit better.

Sporktacular 5y ago

"Right now a chain of exploits is ~$5M on iOS. What if it was $50M? Would that actually stop a nation state?" Yes, some states yes it would. That could make it unaffordable for many of NSOs clients. The result would not be perfect, just better.

fsflover 5y ago

> The attack surface of software as complicated as a modern operating system (iOS or MacOS, etc.) is simply too large to lockdown without dramatically hurting the user experience (assuming you could actually achieve a lockdown in the first place!!). https://qubes-os.org https://qubes-os.org

tptacek 5y ago
You talk to a lot of people who use Qubes day to day? I do. What have you heard about how Qubes life is?
- fsflover 5y ago
  I am gladly using Qubes myself as a daily driver. Can't recommend it enough.
  - tptacek 5y ago
    Hey, my Qubes friends keep using it too. I'm not saying it's un-usable. Is dys-usable a word?
    - fsflover 5y ago
      This is a vague and unconstructive criticism. Perhaps you could say something more to the point. In my opinion, most of the HN audience would be able to use it to their benefit.
      - tptacek 5y ago
        That might be true! But it's not very relevant to the NSO problem, because the mass market will not be able to use it.

rStar 5y ago

> I’m sorry but there’s no world where Apple can make perfect security i think everyone knows that perfect security is not possible, the operative word being ‘perfect’. i think what we want is for apple to ‘actually try’ to provide security, in some way that results in security order of magnitudes better than we enjoy today, which would still be miles and miles away from ‘perfect’, vulnerable to nation state actors etc etc etc

kelnos 5y ago
> i think what we want is for apple to ‘actually try’ to provide security, in some way that results in security order of magnitudes better than we enjoy today That's a pretty tall order, and would likely result in a device that is much more expensive and has a user experience that users would not like. Assuming "orders of magnitude better" is even possible, of which I am skeptical.
josh2600 5y ago
Can you point to a single instance of a cellphone vendor who takes security more seriously than Apple? Put a different way, is there any device with a high monthly active user count that has a higher cost to purchase a black market exploit than the iPhone? Apple can always do better. It should also scare the living hell out of us that they’re currently the best in the world. My point is that if Apple can’t secure your phones, who can? It’s enough to make one think about security through obscurity.
- fsflover 5y ago
  > is there any device with a high monthly active user count that has a higher cost to purchase a black market exploit than the iPhone? This is unfair, because there is a duopoly and the only alternative on mass market is Android. Of course in such circumstances the exploits will be expensive, even if security is awful. Ignoring this, Purism takes security more seriously, because they give the user full control over the OS with possibility to replace/reinstall or harden it. In contrast to that, rarely updated iMessage is impossible to uninstall on iOs.
- ccouzens 5y ago

snowwrestler 5y ago

You’re not wrong about the impossibility of perfect security. But Apple is praising and promising to support independent security research in this press release. Meanwhile they have a reputation among independent security researchers for being standoffish, opaque, slow to respond, and even outright hostile in suing Corellium. They settled that suit but the reputation remains. Apple is the most valuable company in the world. They do not appear to have the best security program in the world. Whatever Citizen Lab can do, Apple should be able to do better; they have a lot more resources and expertise. I’m not doubting that Apple puts a lot of effort into securing their products. But it seems like they still have significant room for improvement.

concinds 5y ago
Seconded. There are many, many low hanging fruits that would substantially improve Apple users' security that Apple has not yet implemented, for example delivering Safari updates independently from macOS updates and having a seamless auto-update mechanism equivalent to every other modern browser. Apple repeatedly claims that most malware targets Android, which is true, but it includes Play Store adware and side-loaded malware; if you only take RCE exploits, which are the relevant class of malware here, one could argue Android is as secure, or more secure than iOS. I would argue the latter, given that Safari and iMessage (as well as integrated WebKit webviews, like Apple Music) seem like the primary attack vectors, and the ones used by NSO; and that security updates to those components, unlike the Android equivalents, are delayed to match Apple's preferred iOS release schedule, instead of being autoupdated separately and transparently to the user.
- nicce 5y ago
  One could also argue, that as Apple is commonly branded as "secure" alternative, and therefore high profile targets are potentially using their products. This might mean that interest is much higher for attackers on that side. They might not care so much about Android. Increased interest and effort means that more likely something is found. Also, Apple's sandboxing settings and permission managing makes the most malware pretty useless with App store policies (no sideloading), so only RCE exploits are kinda useful. What it comes to iMessages, that is the most interesting channel with Safari to deliver exploits, iMessage without user interaction and Safari with some. All you need to know is that target is using iPhone. Other non-default applications as target introduces new challenges. iMessage and Safaring being part of OS updates might indicate, that they are handled differently compared to other apps - is security policy same, worse or better? Is there larger attack interface to system by using these apps?

tptacek 5y ago

I co-sign this whole comment and answer the rhetorical question: $50MM for an exploit chain would not stop a state-level adversary. Their alternatives for these kinds of operations is human intelligence; they'd pay more just in health benefits to staff those operations.

high_byte 5y ago

if it was 50m there would be significant increase in reports, for sure. problem is Apple has a reputation for not paying bounties...

matheusmoreira 5y ago

> literally treating any piece of software running on the device as a potential threat vector even more than they already do Sounds amazing. Every operating system should be designed this way. Only free software should have full access. Proprietary software cannot be trusted and must be regulated and controlled.

DSingularity 5y ago

Apple will advance the security of their platform more by suing NSO and lobbying the US gov to position the official view of the US gov regarding nation-state sponsorship for malicious software as reprehensible efforts which harm everyone (eg like biological/chemical weapons). If the US sanctioned Israel and critiqued them as reckless maybe less countries will support organizations like the NSO group.

Sporktacular 5y ago

It's not clear the user experience would have to suffer. Maybe there are more groups doing for software architecture what Signal did for messaging. Groups like Heisers' SEL4 and Qubes. As for expense, imagine how much more we would have paid today, in real and opportunity costs, if over the last 20 years everyone used this "no such thing a perfect security" fatalism as the excuse to not just do things a bit better.