43 ms·

Despite the hype, iPhone security no match for NSO spyware (2021)

289 points by Scramblejams 5y ago

tomjonesey 5y ago
_8j50 5y ago
I don't understand why they can't compare android vs iOS. Can't people use Signal instead of iMessage? If they are criticizing iMessage then shouldn't the default messenger on android be used as a fair comparison? My 0.2$ on this topic: prevention is nice but not good enough against a persistent or unknown threat. Mobile devices lack EDR coverage, even enterprises install an MDR and forget about it. I want every child process, network connection and interprocess call that falls out of baseline logged. Compromises happen, discovering them months later is the big issue at hand. If you're a journalist or dissident then you or your benefactors should be able to purchase a mobile endpoint security monitoring service that will actively monitor for exploitation and prevent known threats based on good intel. Crowdstrike is the only company that comes close to supporting this.
- neximo64 5y ago
  How can you be so sure NSO don't have an in into Signal? After all, it still takes an OS to run Signal.
  - sorry_outta_gas 5y ago
    Yeah if you can inject into the libraries on the system app isn't to important, just log whatever is sent to uitextfield or whatever and some info about the process; or be lazy and just take screenshots
    - _8j50 5y ago
      Yes. That would be a comparison I am interested in. Are there vulnerable and exploitable system libs and components on iOS? How does that fare compared to android?
  - artinmg 5y ago
    Well you can’t necessarily, because who’s to say what various methods they’ve discovered. However, if we were to use the most famous recent example that relied on an unknown sender transmitting a GIF containing the compromise, Signal does have some additional protection in that it doesn’t receive messages from unknown senders by default. Rather the recipient must accept the message explicitly.
    - Sharlin 5y ago
      Honestly, even after accepting the message there should be another confirmation step before viewing any and all non-textual content.
  - _8j50 5y ago
    I don't but the article was saying iphone is less secure and signal has better restrictions on who can text you than imessage. So use signal on iphone? How does imessage reflect badly on the whole OS especially when compared to a non-default app like signal.
    - Tagbert 5y ago
      Well, the article said that in their sample, fewer Android phones showed evidence of attack but they also said that Android does less event logging and they could not know if there were other attacks that they did not catch. Not really a definitive answer.
      - alphabettsy 5y ago
        Could it also be that most of their potential targets use iPhones?
  - fsflover 5y ago
    > After all, it still takes an OS to run Signal. Which is why I find it suspicous that Signal do not provide the client for non-Android and non-iOS systems, both not very secure.
- 369548684892826 5y ago
  > 0.2$ Do you mean 0.02 or is inflation really running that high?
  - giantrobot 5y ago
    Maybe they work for Verizon[0]? [0] https://m.youtube.com/watch?v=MShv_74FNWU https://m.youtube.com/watch?v=MShv_74FNWU
- lnxg33k1 5y ago
  I would quote myself from another thread where I said that Apple is only about design, but since we're talking security, I see always apple as exploiting having a very low market share for desktop and nil market share as server, but in terms of practical security I see posts like this: https://www.forbes.com/sites/adriankingsleyhughes/2012/04/25/apple-10-years-behind-microsoft-when-it-comes-to-security/ https://www.forbes.com/sites/adriankingsleyhughes/2012/04/25... But I also like to share these kind of posts when I want to make example about like the absolute lack of knowledge in terms of security of apple, like having the guts to release to public a system where password files / shadow and sudoers are world writable just shows that they really have no idea what they're doing And I wouldn't consider myself a fanboy or like justify this kind of posts like mine as "HN is notoriously against apple" I would more likely say that HN audience is a bit into tech, and if you are into tech and understand how systems work then you can't just ignore these kind of things when you see them so you forcefully end up just trying to dodge a system like apple
- octoberfranklin 5y ago
  Because "we're a tiny bit better than the other half of the duopoly" is avoiding the issue.
- TheDong 5y ago
  Even if you install Signal, you'll still have iMessage installed and processing messages sent to your apple ID. iMessage on iOS is part of the OS, and does some message handling in kernelspace. Yes, it has blastdoor, but even since blastdoor sandboxing has been introduced, there have been multiple iMessage CVEs which lead to a full device compromise. See this project zero post for more about iMessage [0]. What I'm trying to say here, is that on an iPhone, no matter what messenger you use, some iMessage exploits can pwn that messenger anyway since iMessage cannot be disabled, and has privileged OS level access. On the other hand, android does have "google messenger" or whatever the OEM installed, and it may not be uninstallable, but it's sandboxed away from the OS in the same way every other app is. There have been exploits based on kernel-space processing of media attachments on android too, but those actually did depend on the app being used, so if you switched SMS apps to one which rejected such an attachment, or otherwise processed it differently, you actually could be secure. Said another way, on android you actually can turn off the default messenger and use signal for SMS. On iOS, that's not so realistic. [0]: https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...
  - YeBanKo 5y ago
    iMessage can be disabled, but not uninstalled.
- saagarjha 5y ago
  > I want every child process, network connection and interprocess call that falls out of baseline logged. This would be a nice thing to have, yeah > If you're a journalist or dissident then you or your benefactors should be able to purchase a mobile endpoint security monitoring service that will actively monitor for exploitation and prevent known threats based on good intel. Crowdstrike is the only company that comes close to supporting this. lol no. Commercial EDR software sucks whether it is Crowdstrike or Carbon Black or Cylance.
  - _8j50 5y ago
    > lol no. Commercial EDR software sucks whether it is Crowdstrike or Carbon Black or Cylance. That's like saying commercial firewalls suck. Do you mean the UI perhaps? They all allow you to specify detection rules like with ids and fw but the out of the box stuff is good enough to catch APTs but obviously not perfect. Althougj out of those I can only recommend crowdstrike falcon, defender ATP is also decent. Red teamers have bypasses for some, it's a cat and mouse game but can you find one instance where an actual threat actor intentionally evaded an EDR?
- ignoramous 5y ago
  > I don't understand why they can't compare android vs iOS. Matthew Green et al already did: https://securephones.io https://securephones.io > If you're a journalist or dissident then you or your benefactors should be able to purchase a mobile endpoint security monitoring service that will actively monitor for exploitation and prevent known threats based on good intel. I am actively building one such open source app (for Android). We are half-way there. One my friends was editor-in-chief at a big media company and his frustrations made it clear to me that they were sitting ducks. Though, securing folks in high risk profession is not easy, at all. But one ought to start somewhere. And it is clear, the eventual solution needs to be external to the phones themselves.
  - faeyanpiraat 5y ago
    Why not make a phone which is secure by default?
    - ignoramous 5y ago
      Easier said than done because of the attack surface, but I do think the industry will respond given Androids are the most widely-deployed, always-connected, computers in use out there. I don't think just securing the hardware is enough (though, even that isn't fully done), the software itself remains hard to tame. Add to the fact that folks (including attackers) can "install" arbitrary things on their Androids, the problem gets only worse. Then, there's the social and legislative aspects as well. For example, no one can raid your home without a search warrant, that's illegal. Similar thing needs to exist in the digital space. This at least thwarts illegal spyware, if not the law enforcement themselves from snooping about people's digital lives.
      - faeyanpiraat 5y ago
        Okay so the real issue here is that people want convenience, which requires "N" number of features, which results in an attack surface of "too large to make it secure".
neonate 5y ago
https://archive.is/22UCa https://archive.is/22UCa
spideymans 5y ago
Regarding the headline, it is absurdly unrealistic to expect that any consumer-grade software can defend itself from state-funded hackers. Not even the entirety American intelligence apparatus can defend itself against state hackers. Why would we expect lowly iOS (or any other consumer software) to do better? If you have reason to believe you're targeted by state-backed intelligence agencies, you really oughta be working under the assumption that they can see everything you're doing.
- fortran77 5y ago
  But this isn’t state funded. It’s a relatively small private company.
- wmf 5y ago
  "Consumer-grade" iOS probably has a larger R&D budget than all mil-spec competitors combined. iOS also has a larger attack surface but it's not obvious to me that it's a lost cause.
  - spicybright 5y ago
    It doesn't mean they spend all that budget on hardening against attacks. The vast majority is for user experience, flashy+useful end user features, etc.
    - dmitriid 5y ago
      And actual military grade security would stand in the way of so much of that. Consumer products are in a he unenviable position of trying to combine things that don't combine well.
      - joe_the_user 5y ago
        If being hacked makes someone feel bad, consumer products are in an unenviable position. If making money makes some feel good, consumer product are in an enviable position.
    - 5y ago
tomComb 5y ago
Focussing on this article (from 2021-07) now doesn't make sense. This topic (Pegasus) is getting attention now because the NYTimes just published a fairly major investigation of NSO, Pegasus, and related politics. (Maybe WaPo wants to piggyback on that?) The Battle for the World’s Most Powerful Cyberweapon (2022-01-28) A Times investigation reveals how Israel reaped diplomatic gains around the world from NSO’s Pegasus spyware — a tool America itself purchased but is now trying to ban. https://www.nytimes.com/2022/01/28/magazine/nso-group-israel-spyware.html https://www.nytimes.com/2022/01/28/magazine/nso-group-israel... https://archive.fo/rkxPo https://archive.fo/rkxPo
olliej 5y ago
Security of a platform is a numbers game. If the cost of developing an exploit is lower than the market value of selling that exploit (either raw or productized), then the platform will be broken. All companies can do is increase that cost - ideally to infinity (eg unbreakable). There are numerous ways to do that, and at this point I think it’s reasonable to think that the cost being hit is time rather than money. There’s only a finite amount of engineering time available and how to spread that is hard. You could say that “everyone should be working on security”, but that doesn’t work because then people don’t upgrade (I recall multiple articles saying that people were updating to get even something as trivial as new emojis, but obviously other big features matter as well). You could say “rewrite the unsafe code in a safe language”, which is not something that could be done in any reasonable amount of time, especially while retaining ABI compatibility. So google, apple, ms, etc try to make the correct trade offs and improve the overall security posture of their platforms, but as long as there’s a market of organisations with functionally unlimited budgets the best they can do in the near future is increase the cost.
- imwillofficial 5y ago
  Security of a platform is FAR more complex than “a numbers game” State actors are willing to spend near limitless money for a vuln with zero return on investment.
  - olliej 5y ago
    That's a common misconception - a government may technically have infinite money, but they're still comparing the cost of things. At some point (for example) sending people to put bugs in someone's house is cheaper, or 24 hour surveillance becomes cheaper. The goal of the defender is to push the cost of attacking the software above the cost of doing something else.
    - imwillofficial 5y ago
      Having worked in government places like this. I can say you’re 100% wrong.
- 5y ago
ctime 5y ago
Disable iCloud, iMessage and be super selective about what app or sites (in Safari) you allow to have rendering. Minimize code paths. In other words, never provide inputs for unsolicited execution.
BaconPackets 5y ago
Anyone knows dev working within that industry? Any insight in the rationalization of creating tools to essentially spy on the whole wide world? Always curious to see how we can rationalize these kind of purpose in life.
- gambiting 5y ago
  Usually 1) money 2) the belief that if you don't build it then someone else will, so might as well be paid for it first At least I imagine that's the only way people who build spyware and blockchain technologies can sleep at night.
  - sandis 5y ago
    so 1) money
    - gambiting 5y ago
      I mean, there are people who work for ideological reasons instead(hackers working for FBI/MI5 despite low pay for instance), and in sure there are people in Israel who take this job to do the service to their country and such, and not just the salary.
  - amelius 5y ago
    Other options may include the intellectual challenge, using the spyware for personal gains, and holding a grudge against Google/Apple.
    - dannyw 5y ago
      LOVEINT (spooks spying on their romantic interests, present or past) isn't unheard of.
  - thehappypm 5y ago
    National security, which in Israel’s case means ethnic security.
Veserv 5y ago
Well of course. Apple has only certified iOS to provide resistance against attackers with a basic attack potential. Why should it be any wonder that their security is inadequate against moderately or even highly skilled attackers? Here we can see their certifications under the Common Criteria: https://support.apple.com/guide/sccc/security-certifications-for-ios-scccfa917cb49/web https://support.apple.com/guide/sccc/security-certifications... For iOS 14, their most recently certified version, we see under their Security Target under Security Assurance Requirements on page 82: https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CERTS/st_vid11146-st.pdf https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CE... They conform to the AVA_VAN.1 requirement. The official guidance for what qualifies as conforming to the AVA_VAN.1 requirement for their protection profile is described on page 136: https://www.niap-ccevs.org/MMO/PP/pp_md_v3.1.pdf https://www.niap-ccevs.org/MMO/PP/pp_md_v3.1.pdf “The evaluator shall conduct penetration testing, based on the identified potential vulnerabilities, to determine that the TOE is resistant to attacks performed by an attacker possessing Basic attack potential.” Which is consistent with the text of the Common Criteria standard on page 170: https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3.1R4.pdf https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3... Which by page 31 of the same document corresponds to EAL1 under the old EAL model. To reach "resistant to attacks performed by an attacker possessing Moderate attack potential" would require conformance to AVA_VAN.4, 3 entire levels higher than their certification (corresponding to EAL5 under the old EAL model) and 1 level higher than any Apple, Google, Microsoft, or Linux system ever created and which has been deemed economically infeasible for them to ever retrofit onto their existing products as stated on page 38 of the same document.
- barsonme 5y ago
  I’m not sure Common Criteria has much to do with it. Companies only get CC certification so their devices or applications can be used by certain government organizations. And so no company is going to target a cert level higher than the minimum they need to meet whatever business requirements are driving them to get CC certified. And CC certainly isn’t a good reference for good security and cryptography engineering practices. It’s not bad, but it misses a lot.
  - 5y ago
deleted 5y ago
[deleted]
AniseAbyss 5y ago
Call me paranoid but US intelligence community is crawling all over Silicon Valley.
- viktorcode 5y ago
  Are you implying there are backdoors in iOS and Android, thanks to US intelligence?
ipnon 5y ago
The infamous "SSL Added and removed here! :^)" slide[0] should have been proof to everyone that no one is safe from $THREE_LETTER_AGENCY or their international equivalents. The ubiquity of standardized smartphones at the highest levels of government means that unfathomable budgets are dedicated to cracking them with the urgency of national security as their motivation. The world's security blocks are incentivized to share their cracking tools within their spheres of influence, and the trivial margin of reproduction for software means that these tools escape from their security apparatus and proliferate like a virus on the outside. They're simply too useful to remain in the dark. If cracking your phone is possible and a cyber power wants to know what's on it, then your phone is as good as unlocked. [0] https://img.washingtonpost.com/rf/image_1484w/2010-2019/WashingtonPost/2013/10/30/Local/Images/GOOGLE-CLOUD-EXPLOITATION1383148810.jpg?uuid=X09V1kF8EeOwKN6SLXo_Rw https://img.washingtonpost.com/rf/image_1484w/2010-2019/Wash...
- cmeacham98 5y ago
  Not sure if that's the best example, because by my understanding Google had taken immense efforts to fix this hole, and now always treats the network as if there's hostile actors on the line. It's pretty much a success story of a civilian company against the NSA. (I make no comment about if the NSA has found other ways into Google or Google has willingly let them in, I do not know the answers to those questions)
  - mike_d 5y ago
    That is an extremely naive viewpoint. When the NSA develops a capability they don't just sit around spinning in their office chairs until it stops working. There is constant development effort to ensure continued access to the information they need.
    - ipnon 5y ago
      This comment would have been just as effective without the ad hominem to begin.
- octoberfranklin 5y ago
johnnyApplePRNG 5y ago
I'm starting to question whether the whole FBI/Apple encryption dispute [0] was a farce from the very start? An effort to get us all to assume that iphones were these impenetrable digital bastions of freedom? "Well if they FBI can't even access a terrorists information, surely my questionable messages are safe!" Turns out all they needed to do was send the phone a txt message? [0] https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_dispute https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_d...
- feupan 5y ago
  I wouldn't exclude it, it worked well. Let's not forget that they eventually still unlocked the phone with a similar tool anyway. It's only possible that these tools weren't as readily available on 2015.
  - johnnyApplePRNG 5y ago
    Really! They unlocked it in the end?! I was only following the mainstream news headlines back then... not paying super close attention... but I failed to read that part. I assumed they were never able to access it to this very day. Along with 99% of the rest of North America who can only read so much about computer security I am sure.
    - feupan 5y ago
      From Wikipedia: > On March 28, the government announced that the FBI had unlocked the iPhone and withdrew its request. > The unidentified method used to unlock Farook's phone - costing more than $1 million to obtain - quit working once Apple updated their operating system.
  - viktorcode 5y ago
    The tools were available at the time, but FBI preferred Apple to compromise their security model instead.
- dc-programmer 5y ago
wly_cdgr 5y ago
That's what happens when marketing squares up against reality
mikewarot 5y ago
This is a failure of the security model underlying the operating system design. Operating Systems exist to securely multiplex the resources of a system and make them fairly and reliably available to the user of that system. In order to do so, the first order of business is that the system should observe the principle of least privilege. That is, it should grant no privileges by default, and only grant access to the resources required for a task to complete. iOS, Android, Linux, Unix, Windows, pretty much any modern operating system makes zero provisions for enforcing the principle of least privilege. Analogy: You owe someone $5 for an ice cream cone. Do you hand over your wallet and all of your 2fa credentials to that person, and hope they only take $5? No, you reach into your wallet, and extract a $5 bill. That is a capability that gives the holder $5 of spending power. If you don't have a $5, you could give them $20, but your maximum loss would be that token. You don't have to worry about losing your title to your car during the transaction. There is no equivalent mechanism for the average user to securely tell the OS to run this program with these resources, and trust that nothing else will happen, nor hidden surprises persist. --- Note that the crude "grant access to X" flags present in some phone OSs are NOT capabilities, though them might have that same overloaded name. --- Note that wallets aren't seen to be impractical, and people have been using them for a very long time. If you're tempted to say that an OS can't reflect that simplicity and ease of use, you just need to give people a few iterations to get it right. --- We need capability based security. We'll keep having these stories until we get it deployed widely.
- simonh 5y ago
  > Analogy: You owe someone $5 for an ice cream cone. Do you hand over your wallet and all of your 2fa credentials to that person, and hope they only take $5? We do this all the time with online transactions. Just because the website says $5, in principle when they charge your bank they could ask for as much as they like.
  - mikewarot 5y ago
    Which points to a design problem with credit card transactions. They should be able to generate a one time use number for giving X money in a single transaction. I've heard of some experiments in that direction, which is hopeful.
arpa 5y ago
Unexpected! Both options in duopoly are insecure! Very surprised!!! /s
aenis 5y ago
Security is very hard in companies driven by marketing. Even if "security" is a feature being marketed. Having security by design means moving much slower, having code reviews done by paranoiacs who care not one bit about features, and constantly thinking about reducing attack surfaces. Paranoiacs will start with "do we need to handle any user messages at all? that's untrusted data!", much less "do we need to support ALL SORTS of image formats, including some handled by obscure, obsolete libraries that noone truly knows how they work?". The fact that the messaging application allowed untrusted data to escape the sandbox via obscure data processing libraries they didn't write themselves is a proof of lack of internal software risk assessment process. I hope they learned their lesson and code is now reviewed by people not incentivised to rubber stamp everything the moment in lands on their desks.
- pm90 5y ago
  > I hope they learned their lesson and code is now reviewed by people not incentivised to rubber stamp everything the moment in lands on their desks. Almost certain they did not learn any lesson. Like you say, they’re marketing security. If they had made investments we would have heard of it (big hires, security rampup etc). Anecdotal, but It seems like Apple’s DNA is still very hardware focused. People in my friends group have all interviewed there but none of them accepted offers because they would never match other Big Tech.
  - grapescheesee 5y ago
    Nonprofessional observation from. "Anecdotal, but It seems like Apple’s DNA is still very hardware focused. People in my friends group have all interviewed there but none of them accepted offers because they would never match other Big Tech." It seems most of the real magic, long term R&D ROI, and difficult hires. Now rest in the switch from OEM to in house made chips. I would be interested in others perceptions of this. A modern phone is built on tech from chips like a Z80. However now the amount of chemical engineers, electrical engineers, process, and so on has changes so dramatically. We have large teams of people becoming so specialized the first stack software is far more times the abstraction it was year by year. Security is hard. Just like quality, they both take back seats more and more often since they generally only hurt ROI.
schwanky 5y ago
Despite the hype, iPhone security no match for NSA court-and-gag orders. The continuing denial that U.S. intelligence agencies are all up in Apple, Google, Microsoft, Facebook etc. is surprising. It's always easier to shift blame onto someone else, especially on other cyber terrorists.
aborsy 5y ago
Why can’t Apple build a security team like NSO (in fact a much larger one), finding these vulnerabilities? If others can, so does Apple. If it’s based on resources, Apple is far ahead (even large governments don’t put so much resources into one application, let alone small companies). In fact, Apple’s valuation is incomparable relative to NSO’s and Mossad’s. And why don’t US politicians protect US citizens? If there is something else at play, it’s good to highlight it at some point. But I doubt it will be acknowledged to public till decades later.
inglor 5y ago
I keep seeing comments about how NSO is Israeli state funded. I think it's not entirely incorrect (am Israeli, know people who work at NSO and people at 8200) - but the relationship is quite sinister and not something the Israeli public was aware of. As in - NSO's ties to the Israeli government were filled with corruption and NSO was using its own technology in exchange on Israeli citizens. There is (quite a big) public inquiry and people from NSO will likely (finally) go to jail. It's quite a big scandal here https://www.calcalistech.com/ctech/articles/0,7340,L-3927410,00.html https://www.calcalistech.com/ctech/articles/0,7340,L-3927410...
- inglor 5y ago
  Also note the US government has been using companies like NSO to push its own political agenda since it lets it sell this sort of technology to allies (like Saudi Arabia) without scrutiny. This is following two other scandals relating to NSO in Israel that are getting quite a lot of press here. For example the inquiry suggests that police members used Pegasus to spy on opposition leaders who opposed Netanyahu a-la-Watergate. To be clear this _is_ a watergate level scandal here and you'd be hard pressed to find a news website in Israel not mentioning NSO on the homepage. (Edit: noted I didn't post any citations like https://www.haaretz.com/israel-news/.premium-netanyahu-gave-greenlight-to-saudi-arabia-to-use-nso-spyware-report-says-1.10573831 https://www.haaretz.com/israel-news/.premium-netanyahu-gave-... or https://www.jpost.com/international/article-694887 https://www.jpost.com/international/article-694887 but happy to post references on any of the above since it's very easy to find these references (it's all over the news) and I personally dislike NSO)
headass 5y ago
I’m curious to see an update since after pegasus broke apple put out patches to curb it
datavirtue 5y ago
Stallman was right. Way ahead of his time. Closed source is immoral.
jokoon 5y ago
There are two kinds of security. Security against scammers, and security against governments. I just wish there would be industrial standards for basic security, I don't care protecting myself against governments (yet). There are very few people who can be targeted by governments, so I will always be suspicious of people who can evade government surveillance, unless if you're a journalist, of course.

289 points by Scramblejams 5y ago

I don't understand why they can't compare android vs iOS. Can't people use Signal instead of iMessage? If they are criticizing iMessage then shouldn't the default messenger on android be used as a fair comparison? My 0.2$ on this topic: prevention is nice but not good enough against a persistent or unknown threat. Mobile devices lack EDR coverage, even enterprises install an MDR and forget about it. I want every child process, network connection and interprocess call that falls out of baseline logged. Compromises happen, discovering them months later is the big issue at hand. If you're a journalist or dissident then you or your benefactors should be able to purchase a mobile endpoint security monitoring service that will actively monitor for exploitation and prevent known threats based on good intel. Crowdstrike is the only company that comes close to supporting this.

neximo64 5y ago
How can you be so sure NSO don't have an in into Signal? After all, it still takes an OS to run Signal.
- sorry_outta_gas 5y ago
  Yeah if you can inject into the libraries on the system app isn't to important, just log whatever is sent to uitextfield or whatever and some info about the process; or be lazy and just take screenshots
  - _8j50 5y ago
    Yes. That would be a comparison I am interested in. Are there vulnerable and exploitable system libs and components on iOS? How does that fare compared to android?
- artinmg 5y ago
  Well you can’t necessarily, because who’s to say what various methods they’ve discovered. However, if we were to use the most famous recent example that relied on an unknown sender transmitting a GIF containing the compromise, Signal does have some additional protection in that it doesn’t receive messages from unknown senders by default. Rather the recipient must accept the message explicitly.
  - Sharlin 5y ago
    Honestly, even after accepting the message there should be another confirmation step before viewing any and all non-textual content.
- _8j50 5y ago
  I don't but the article was saying iphone is less secure and signal has better restrictions on who can text you than imessage. So use signal on iphone? How does imessage reflect badly on the whole OS especially when compared to a non-default app like signal.
  - Tagbert 5y ago
    Well, the article said that in their sample, fewer Android phones showed evidence of attack but they also said that Android does less event logging and they could not know if there were other attacks that they did not catch. Not really a definitive answer.
    - alphabettsy 5y ago
      Could it also be that most of their potential targets use iPhones?
- fsflover 5y ago
  > After all, it still takes an OS to run Signal. Which is why I find it suspicous that Signal do not provide the client for non-Android and non-iOS systems, both not very secure.
369548684892826 5y ago
> 0.2$ Do you mean 0.02 or is inflation really running that high?
- giantrobot 5y ago
  Maybe they work for Verizon[0]? [0] https://m.youtube.com/watch?v=MShv_74FNWU https://m.youtube.com/watch?v=MShv_74FNWU
lnxg33k1 5y ago
I would quote myself from another thread where I said that Apple is only about design, but since we're talking security, I see always apple as exploiting having a very low market share for desktop and nil market share as server, but in terms of practical security I see posts like this: https://www.forbes.com/sites/adriankingsleyhughes/2012/04/25/apple-10-years-behind-microsoft-when-it-comes-to-security/ https://www.forbes.com/sites/adriankingsleyhughes/2012/04/25... But I also like to share these kind of posts when I want to make example about like the absolute lack of knowledge in terms of security of apple, like having the guts to release to public a system where password files / shadow and sudoers are world writable just shows that they really have no idea what they're doing And I wouldn't consider myself a fanboy or like justify this kind of posts like mine as "HN is notoriously against apple" I would more likely say that HN audience is a bit into tech, and if you are into tech and understand how systems work then you can't just ignore these kind of things when you see them so you forcefully end up just trying to dodge a system like apple
octoberfranklin 5y ago
Because "we're a tiny bit better than the other half of the duopoly" is avoiding the issue.
TheDong 5y ago
Even if you install Signal, you'll still have iMessage installed and processing messages sent to your apple ID. iMessage on iOS is part of the OS, and does some message handling in kernelspace. Yes, it has blastdoor, but even since blastdoor sandboxing has been introduced, there have been multiple iMessage CVEs which lead to a full device compromise. See this project zero post for more about iMessage [0]. What I'm trying to say here, is that on an iPhone, no matter what messenger you use, some iMessage exploits can pwn that messenger anyway since iMessage cannot be disabled, and has privileged OS level access. On the other hand, android does have "google messenger" or whatever the OEM installed, and it may not be uninstallable, but it's sandboxed away from the OS in the same way every other app is. There have been exploits based on kernel-space processing of media attachments on android too, but those actually did depend on the app being used, so if you switched SMS apps to one which rejected such an attachment, or otherwise processed it differently, you actually could be secure. Said another way, on android you actually can turn off the default messenger and use signal for SMS. On iOS, that's not so realistic. [0]: https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...
- YeBanKo 5y ago
  iMessage can be disabled, but not uninstalled.
saagarjha 5y ago
> I want every child process, network connection and interprocess call that falls out of baseline logged. This would be a nice thing to have, yeah > If you're a journalist or dissident then you or your benefactors should be able to purchase a mobile endpoint security monitoring service that will actively monitor for exploitation and prevent known threats based on good intel. Crowdstrike is the only company that comes close to supporting this. lol no. Commercial EDR software sucks whether it is Crowdstrike or Carbon Black or Cylance.
- _8j50 5y ago
  > lol no. Commercial EDR software sucks whether it is Crowdstrike or Carbon Black or Cylance. That's like saying commercial firewalls suck. Do you mean the UI perhaps? They all allow you to specify detection rules like with ids and fw but the out of the box stuff is good enough to catch APTs but obviously not perfect. Althougj out of those I can only recommend crowdstrike falcon, defender ATP is also decent. Red teamers have bypasses for some, it's a cat and mouse game but can you find one instance where an actual threat actor intentionally evaded an EDR?
ignoramous 5y ago
> I don't understand why they can't compare android vs iOS. Matthew Green et al already did: https://securephones.io https://securephones.io > If you're a journalist or dissident then you or your benefactors should be able to purchase a mobile endpoint security monitoring service that will actively monitor for exploitation and prevent known threats based on good intel. I am actively building one such open source app (for Android). We are half-way there. One my friends was editor-in-chief at a big media company and his frustrations made it clear to me that they were sitting ducks. Though, securing folks in high risk profession is not easy, at all. But one ought to start somewhere. And it is clear, the eventual solution needs to be external to the phones themselves.
- faeyanpiraat 5y ago
  Why not make a phone which is secure by default?
  - ignoramous 5y ago
    Easier said than done because of the attack surface, but I do think the industry will respond given Androids are the most widely-deployed, always-connected, computers in use out there. I don't think just securing the hardware is enough (though, even that isn't fully done), the software itself remains hard to tame. Add to the fact that folks (including attackers) can "install" arbitrary things on their Androids, the problem gets only worse. Then, there's the social and legislative aspects as well. For example, no one can raid your home without a search warrant, that's illegal. Similar thing needs to exist in the digital space. This at least thwarts illegal spyware, if not the law enforcement themselves from snooping about people's digital lives.
    - faeyanpiraat 5y ago
      Okay so the real issue here is that people want convenience, which requires "N" number of features, which results in an attack surface of "too large to make it secure".

neonate 5y ago

https://archive.is/22UCa https://archive.is/22UCa

spideymans 5y ago

Regarding the headline, it is absurdly unrealistic to expect that any consumer-grade software can defend itself from state-funded hackers. Not even the entirety American intelligence apparatus can defend itself against state hackers. Why would we expect lowly iOS (or any other consumer software) to do better? If you have reason to believe you're targeted by state-backed intelligence agencies, you really oughta be working under the assumption that they can see everything you're doing.

fortran77 5y ago
But this isn’t state funded. It’s a relatively small private company.
wmf 5y ago
"Consumer-grade" iOS probably has a larger R&D budget than all mil-spec competitors combined. iOS also has a larger attack surface but it's not obvious to me that it's a lost cause.
- spicybright 5y ago
  It doesn't mean they spend all that budget on hardening against attacks. The vast majority is for user experience, flashy+useful end user features, etc.
  - dmitriid 5y ago
    And actual military grade security would stand in the way of so much of that. Consumer products are in a he unenviable position of trying to combine things that don't combine well.
    - joe_the_user 5y ago
      If being hacked makes someone feel bad, consumer products are in an unenviable position. If making money makes some feel good, consumer product are in an enviable position.
  - 5y ago

tomComb 5y ago

Focussing on this article (from 2021-07) now doesn't make sense. This topic (Pegasus) is getting attention now because the NYTimes just published a fairly major investigation of NSO, Pegasus, and related politics. (Maybe WaPo wants to piggyback on that?) The Battle for the World’s Most Powerful Cyberweapon (2022-01-28) A Times investigation reveals how Israel reaped diplomatic gains around the world from NSO’s Pegasus spyware — a tool America itself purchased but is now trying to ban. https://www.nytimes.com/2022/01/28/magazine/nso-group-israel-spyware.html https://www.nytimes.com/2022/01/28/magazine/nso-group-israel... https://archive.fo/rkxPo https://archive.fo/rkxPo

olliej 5y ago

Security of a platform is a numbers game. If the cost of developing an exploit is lower than the market value of selling that exploit (either raw or productized), then the platform will be broken. All companies can do is increase that cost - ideally to infinity (eg unbreakable). There are numerous ways to do that, and at this point I think it’s reasonable to think that the cost being hit is time rather than money. There’s only a finite amount of engineering time available and how to spread that is hard. You could say that “everyone should be working on security”, but that doesn’t work because then people don’t upgrade (I recall multiple articles saying that people were updating to get even something as trivial as new emojis, but obviously other big features matter as well). You could say “rewrite the unsafe code in a safe language”, which is not something that could be done in any reasonable amount of time, especially while retaining ABI compatibility. So google, apple, ms, etc try to make the correct trade offs and improve the overall security posture of their platforms, but as long as there’s a market of organisations with functionally unlimited budgets the best they can do in the near future is increase the cost.

imwillofficial 5y ago
Security of a platform is FAR more complex than “a numbers game” State actors are willing to spend near limitless money for a vuln with zero return on investment.
- olliej 5y ago
  That's a common misconception - a government may technically have infinite money, but they're still comparing the cost of things. At some point (for example) sending people to put bugs in someone's house is cheaper, or 24 hour surveillance becomes cheaper. The goal of the defender is to push the cost of attacking the software above the cost of doing something else.
  - imwillofficial 5y ago
    Having worked in government places like this. I can say you’re 100% wrong.
5y ago

ctime 5y ago

Disable iCloud, iMessage and be super selective about what app or sites (in Safari) you allow to have rendering. Minimize code paths. In other words, never provide inputs for unsolicited execution.

BaconPackets 5y ago

Anyone knows dev working within that industry? Any insight in the rationalization of creating tools to essentially spy on the whole wide world? Always curious to see how we can rationalize these kind of purpose in life.

gambiting 5y ago
Usually 1) money 2) the belief that if you don't build it then someone else will, so might as well be paid for it first At least I imagine that's the only way people who build spyware and blockchain technologies can sleep at night.
- sandis 5y ago
  so 1) money
  - gambiting 5y ago
    I mean, there are people who work for ideological reasons instead(hackers working for FBI/MI5 despite low pay for instance), and in sure there are people in Israel who take this job to do the service to their country and such, and not just the salary.
- amelius 5y ago
  Other options may include the intellectual challenge, using the spyware for personal gains, and holding a grudge against Google/Apple.
  - dannyw 5y ago
    LOVEINT (spooks spying on their romantic interests, present or past) isn't unheard of.
- thehappypm 5y ago
  National security, which in Israel’s case means ethnic security.

Veserv 5y ago

Well of course. Apple has only certified iOS to provide resistance against attackers with a basic attack potential. Why should it be any wonder that their security is inadequate against moderately or even highly skilled attackers? Here we can see their certifications under the Common Criteria: https://support.apple.com/guide/sccc/security-certifications-for-ios-scccfa917cb49/web https://support.apple.com/guide/sccc/security-certifications... For iOS 14, their most recently certified version, we see under their Security Target under Security Assurance Requirements on page 82: https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CERTS/st_vid11146-st.pdf https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CE... They conform to the AVA_VAN.1 requirement. The official guidance for what qualifies as conforming to the AVA_VAN.1 requirement for their protection profile is described on page 136: https://www.niap-ccevs.org/MMO/PP/pp_md_v3.1.pdf https://www.niap-ccevs.org/MMO/PP/pp_md_v3.1.pdf “The evaluator shall conduct penetration testing, based on the identified potential vulnerabilities, to determine that the TOE is resistant to attacks performed by an attacker possessing Basic attack potential.” Which is consistent with the text of the Common Criteria standard on page 170: https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3.1R4.pdf https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3... Which by page 31 of the same document corresponds to EAL1 under the old EAL model. To reach "resistant to attacks performed by an attacker possessing Moderate attack potential" would require conformance to AVA_VAN.4, 3 entire levels higher than their certification (corresponding to EAL5 under the old EAL model) and 1 level higher than any Apple, Google, Microsoft, or Linux system ever created and which has been deemed economically infeasible for them to ever retrofit onto their existing products as stated on page 38 of the same document.

barsonme 5y ago
I’m not sure Common Criteria has much to do with it. Companies only get CC certification so their devices or applications can be used by certain government organizations. And so no company is going to target a cert level higher than the minimum they need to meet whatever business requirements are driving them to get CC certified. And CC certainly isn’t a good reference for good security and cryptography engineering practices. It’s not bad, but it misses a lot.
- 5y ago

deleted 5y ago

[deleted]

AniseAbyss 5y ago

Call me paranoid but US intelligence community is crawling all over Silicon Valley.

viktorcode 5y ago
Are you implying there are backdoors in iOS and Android, thanks to US intelligence?

ipnon 5y ago

The infamous "SSL Added and removed here! :^)" slide[0] should have been proof to everyone that no one is safe from $THREE_LETTER_AGENCY or their international equivalents. The ubiquity of standardized smartphones at the highest levels of government means that unfathomable budgets are dedicated to cracking them with the urgency of national security as their motivation. The world's security blocks are incentivized to share their cracking tools within their spheres of influence, and the trivial margin of reproduction for software means that these tools escape from their security apparatus and proliferate like a virus on the outside. They're simply too useful to remain in the dark. If cracking your phone is possible and a cyber power wants to know what's on it, then your phone is as good as unlocked. [0] https://img.washingtonpost.com/rf/image_1484w/2010-2019/WashingtonPost/2013/10/30/Local/Images/GOOGLE-CLOUD-EXPLOITATION1383148810.jpg?uuid=X09V1kF8EeOwKN6SLXo_Rw https://img.washingtonpost.com/rf/image_1484w/2010-2019/Wash...

cmeacham98 5y ago
Not sure if that's the best example, because by my understanding Google had taken immense efforts to fix this hole, and now always treats the network as if there's hostile actors on the line. It's pretty much a success story of a civilian company against the NSA. (I make no comment about if the NSA has found other ways into Google or Google has willingly let them in, I do not know the answers to those questions)
- mike_d 5y ago
  That is an extremely naive viewpoint. When the NSA develops a capability they don't just sit around spinning in their office chairs until it stops working. There is constant development effort to ensure continued access to the information they need.
  - ipnon 5y ago
    This comment would have been just as effective without the ad hominem to begin.
octoberfranklin 5y ago

johnnyApplePRNG 5y ago

I'm starting to question whether the whole FBI/Apple encryption dispute [0] was a farce from the very start? An effort to get us all to assume that iphones were these impenetrable digital bastions of freedom? "Well if they FBI can't even access a terrorists information, surely my questionable messages are safe!" Turns out all they needed to do was send the phone a txt message? [0] https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_dispute https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_d...

feupan 5y ago
I wouldn't exclude it, it worked well. Let's not forget that they eventually still unlocked the phone with a similar tool anyway. It's only possible that these tools weren't as readily available on 2015.
- johnnyApplePRNG 5y ago
  Really! They unlocked it in the end?! I was only following the mainstream news headlines back then... not paying super close attention... but I failed to read that part. I assumed they were never able to access it to this very day. Along with 99% of the rest of North America who can only read so much about computer security I am sure.
  - feupan 5y ago
    From Wikipedia: > On March 28, the government announced that the FBI had unlocked the iPhone and withdrew its request. > The unidentified method used to unlock Farook's phone - costing more than $1 million to obtain - quit working once Apple updated their operating system.
- viktorcode 5y ago
  The tools were available at the time, but FBI preferred Apple to compromise their security model instead.
dc-programmer 5y ago

wly_cdgr 5y ago

That's what happens when marketing squares up against reality

mikewarot 5y ago

This is a failure of the security model underlying the operating system design. Operating Systems exist to securely multiplex the resources of a system and make them fairly and reliably available to the user of that system. In order to do so, the first order of business is that the system should observe the principle of least privilege. That is, it should grant no privileges by default, and only grant access to the resources required for a task to complete. iOS, Android, Linux, Unix, Windows, pretty much any modern operating system makes zero provisions for enforcing the principle of least privilege. Analogy: You owe someone $5 for an ice cream cone. Do you hand over your wallet and all of your 2fa credentials to that person, and hope they only take $5? No, you reach into your wallet, and extract a $5 bill. That is a capability that gives the holder $5 of spending power. If you don't have a $5, you could give them $20, but your maximum loss would be that token. You don't have to worry about losing your title to your car during the transaction. There is no equivalent mechanism for the average user to securely tell the OS to run this program with these resources, and trust that nothing else will happen, nor hidden surprises persist. --- Note that the crude "grant access to X" flags present in some phone OSs are NOT capabilities, though them might have that same overloaded name. --- Note that wallets aren't seen to be impractical, and people have been using them for a very long time. If you're tempted to say that an OS can't reflect that simplicity and ease of use, you just need to give people a few iterations to get it right. --- We need capability based security. We'll keep having these stories until we get it deployed widely.

simonh 5y ago
> Analogy: You owe someone $5 for an ice cream cone. Do you hand over your wallet and all of your 2fa credentials to that person, and hope they only take $5? We do this all the time with online transactions. Just because the website says $5, in principle when they charge your bank they could ask for as much as they like.
- mikewarot 5y ago
  Which points to a design problem with credit card transactions. They should be able to generate a one time use number for giving X money in a single transaction. I've heard of some experiments in that direction, which is hopeful.

arpa 5y ago

Unexpected! Both options in duopoly are insecure! Very surprised!!! /s

aenis 5y ago

Security is very hard in companies driven by marketing. Even if "security" is a feature being marketed. Having security by design means moving much slower, having code reviews done by paranoiacs who care not one bit about features, and constantly thinking about reducing attack surfaces. Paranoiacs will start with "do we need to handle any user messages at all? that's untrusted data!", much less "do we need to support ALL SORTS of image formats, including some handled by obscure, obsolete libraries that noone truly knows how they work?". The fact that the messaging application allowed untrusted data to escape the sandbox via obscure data processing libraries they didn't write themselves is a proof of lack of internal software risk assessment process. I hope they learned their lesson and code is now reviewed by people not incentivised to rubber stamp everything the moment in lands on their desks.

pm90 5y ago
> I hope they learned their lesson and code is now reviewed by people not incentivised to rubber stamp everything the moment in lands on their desks. Almost certain they did not learn any lesson. Like you say, they’re marketing security. If they had made investments we would have heard of it (big hires, security rampup etc). Anecdotal, but It seems like Apple’s DNA is still very hardware focused. People in my friends group have all interviewed there but none of them accepted offers because they would never match other Big Tech.
- grapescheesee 5y ago
  Nonprofessional observation from. "Anecdotal, but It seems like Apple’s DNA is still very hardware focused. People in my friends group have all interviewed there but none of them accepted offers because they would never match other Big Tech." It seems most of the real magic, long term R&D ROI, and difficult hires. Now rest in the switch from OEM to in house made chips. I would be interested in others perceptions of this. A modern phone is built on tech from chips like a Z80. However now the amount of chemical engineers, electrical engineers, process, and so on has changes so dramatically. We have large teams of people becoming so specialized the first stack software is far more times the abstraction it was year by year. Security is hard. Just like quality, they both take back seats more and more often since they generally only hurt ROI.

schwanky 5y ago

Despite the hype, iPhone security no match for NSA court-and-gag orders. The continuing denial that U.S. intelligence agencies are all up in Apple, Google, Microsoft, Facebook etc. is surprising. It's always easier to shift blame onto someone else, especially on other cyber terrorists.

aborsy 5y ago

Why can’t Apple build a security team like NSO (in fact a much larger one), finding these vulnerabilities? If others can, so does Apple. If it’s based on resources, Apple is far ahead (even large governments don’t put so much resources into one application, let alone small companies). In fact, Apple’s valuation is incomparable relative to NSO’s and Mossad’s. And why don’t US politicians protect US citizens? If there is something else at play, it’s good to highlight it at some point. But I doubt it will be acknowledged to public till decades later.

inglor 5y ago

I keep seeing comments about how NSO is Israeli state funded. I think it's not entirely incorrect (am Israeli, know people who work at NSO and people at 8200) - but the relationship is quite sinister and not something the Israeli public was aware of. As in - NSO's ties to the Israeli government were filled with corruption and NSO was using its own technology in exchange on Israeli citizens. There is (quite a big) public inquiry and people from NSO will likely (finally) go to jail. It's quite a big scandal here https://www.calcalistech.com/ctech/articles/0,7340,L-3927410,00.html https://www.calcalistech.com/ctech/articles/0,7340,L-3927410...

inglor 5y ago
Also note the US government has been using companies like NSO to push its own political agenda since it lets it sell this sort of technology to allies (like Saudi Arabia) without scrutiny. This is following two other scandals relating to NSO in Israel that are getting quite a lot of press here. For example the inquiry suggests that police members used Pegasus to spy on opposition leaders who opposed Netanyahu a-la-Watergate. To be clear this _is_ a watergate level scandal here and you'd be hard pressed to find a news website in Israel not mentioning NSO on the homepage. (Edit: noted I didn't post any citations like https://www.haaretz.com/israel-news/.premium-netanyahu-gave-greenlight-to-saudi-arabia-to-use-nso-spyware-report-says-1.10573831 https://www.haaretz.com/israel-news/.premium-netanyahu-gave-... or https://www.jpost.com/international/article-694887 https://www.jpost.com/international/article-694887 but happy to post references on any of the above since it's very easy to find these references (it's all over the news) and I personally dislike NSO)

headass 5y ago

I’m curious to see an update since after pegasus broke apple put out patches to curb it

datavirtue 5y ago

Stallman was right. Way ahead of his time. Closed source is immoral.

jokoon 5y ago

There are two kinds of security. Security against scammers, and security against governments. I just wish there would be industrial standards for basic security, I don't care protecting myself against governments (yet). There are very few people who can be targeted by governments, so I will always be suspicious of people who can evade government surveillance, unless if you're a journalist, of course.