7 ms·

Apple makes more in profit per year than the US IC budget. Their annual revenue is slightly lower than the entire GDP of Israel, where NSO is based. It is far

Apple makes more in profit per year than the US IC budget. Their annual revenue is slightly lower than the entire GDP of Israel, where NSO is based. It is far less unrealistic than you think.

olliej 5y ago
Core difference though is one side has to find a few bugs, the other side has to make zero mistakes.
- tyrfing 5y ago
  That is mostly true, but I hate to see the narrative that it's insecure due to lack of resources. It's easy to miss the ridiculous scale of these big tech companies.
  - olliej 5y ago
    The problem is not money, there is only so much any one engineer can do, and there are only so many engineers you can have working on anything. No one can "solve" security simply by buying more engineers, what is needed is time.
    - lern_too_spel 5y ago
      NSO can only pay so much for a vulnerability, and that amount is bounded by the budgets of its clients. Apple could choose to outspend NSO for those vulnerabilities.
      - saagarjha 5y ago
        But can Apple outspend all NSOs? Including the various government-backed entities?
        olliej 5y ago
        The problem is time rather than money - there are a finite number of engineering hours in a year, the only way to increase that is to add more engineers, but adding more engineers very rapidly starts costing time rather than helping.
        saagarjha 5y ago
        I think the strategy suggested here was “why doesn’t Apple just buy all of NSO’s exploits”, to which I responded that doing this for all threat actors is infeasible. I think you’re talking about actually solving the security issues, which is blocked by things that aren’t just money, I agree.
        jagger27 5y ago
        Government-backed entities can also make promises that Apple's money can't buy. Who knows what kind of back room deals are made that involve citizenship, safe passage, dropped criminal charges, etc.
        saagarjha 5y ago
        Indeed.
        lern_too_spel 5y ago
        Big governments aren't selling their espionage services, so they're arguably less important to handle. Moreover, there is likely duplication in exploits between these groups such that buying private sector exploits and patching them will likely take a few government exploits out with them.
        saagarjha 5y ago
        I wouldn’t argue that. Plus, note that there are many NSOs, and stamping them all out gets harder as you shut more of them down because prices go up.
  - nicce 5y ago
    Resources get surprisingly low if you share them for every possible attack interface. (If you even know them all) On Apple’s scale, there are quite many. Attackers need to find only one buggy interface.
- richardw 5y ago
  Thought experiment: Apple could hire nine NSO equivalent teams to do what NSO does. Then fix the bugs they find. This is not a guarantee there are no bugs, but if finding them is crucial to fixing them, NSO is now 1/10 likely to be the team that finds them and 10 times less likely to maintain unique access to the secret. Scale numbers to make better financial sense. Now, one would think there are already more non-NSO security researchers than NSO have, who earn money from bounties and report issues to Apple. Yet NSO has a business model. How?
  - olliej 5y ago
    You're assuming apple doesn't already have that. What we see in the news, etc is an example of survivor bias: you don't see the bugs that apple finds in anything they haven't released.
    - judge2020 5y ago
      For reference, Apple has four red team positions currently open[0], and I imagine these are rolling openings (ie. recreated every 6 months or so for listing refinement). 0: https://jobs.apple.com/en-us/search?search=%22red%20team%22&sort=relevance&location=united-states-USA https://jobs.apple.com/en-us/search?search=%22red%20team%22&...
  - fortran77 5y ago
    > Yet NSO has a business model. How? Because Apple's security is actually pretty bad, making their job easy.
  - throwaway_4ever 5y ago
    > Apple could hire nine NSO equivalent teams to do what NSO does. No they can’t. If Apple could, they would deploy their war chest billions to do so. People often make the mistake of thinking some objective is money-constrained, and a place like Microsoft could’ve just thrown the most money at mobile in 2008 to be the best mobile OS. The Israeli’s in these national security level positions work like their life depends on it because they literally believe it does. Good luck replicating that with a gazillion teams of cushy big tech Silicon Valley positions.
- fsflover 5y ago
  This is not how security works. Reasonable security can be achieved by compartmentalization, so you don't have to make all code flawless. See: https://qubes-os.org https://qubes-os.org
  - olliej 5y ago
    macOS and ios are heavily compartmentalized - but attackers are still able to get through. Extreme compartmentalization through virtualisation is also insufficient, as it just becomes a matter of “is there a bug in the hyper visor”, to which the answer is yes: every major VM system has had multiple escapes, as another commenter pointed out even your example of qubes os has had them. I know how hard security is. I know how hard writing bug free code is. Brushing that aside and saying “just do X and bugs don’t matter”, assumes that somehow the people implementing support for X are immune to the same problems faced by other developers.
    - fsflover 5y ago
      > macOS and ios are heavily compartmentalized iOS isn't. The vulnerability in iMessage led to the whole system compromize. > every major VM system has had multiple escapes Qubes uses hardware (VT-d) virtualization, which AFAIK was last time broken by the Qubes founder in 2003: https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software).
      - olliej 5y ago
        We’re working on a security definition which means “control of system”. That means escaping the compartment: for iMessage that means escaping the sandbox. The most recent one on the PZ blog is a multiparty series and I don’t believe they’ve described how NSO gets from code execution to actually escaping the sandbox. If being able to escape the sandboxing means “not compartmentalized” then if anyone escapes the VM in qubes then qubes is also not compartmentalized. The difference is how extreme the compartmentalization is. macOS and iOS use sandboxing which is much lighter weight than a full VM, but is not as strong a boundary as a full VM. However saying that they’re not a form of compartmentalization is plainly false. Every other virtualisation system also uses hardware virtualisation. They’ve been popped. I don’t think it’s unreasonable to suspect that qubes has not had the same degree of offensive interest as, say, VMware.

Apple makes more in profit per year than the US IC budget. Their annual revenue is slightly lower than the entire GDP of Israel, where NSO is based. It is far less unrealistic than you think.

olliej 5y ago

Core difference though is one side has to find a few bugs, the other side has to make zero mistakes.

tyrfing 5y ago
That is mostly true, but I hate to see the narrative that it's insecure due to lack of resources. It's easy to miss the ridiculous scale of these big tech companies.
- olliej 5y ago
  The problem is not money, there is only so much any one engineer can do, and there are only so many engineers you can have working on anything. No one can "solve" security simply by buying more engineers, what is needed is time.
  - lern_too_spel 5y ago
    NSO can only pay so much for a vulnerability, and that amount is bounded by the budgets of its clients. Apple could choose to outspend NSO for those vulnerabilities.
    - saagarjha 5y ago
      But can Apple outspend all NSOs? Including the various government-backed entities?
      - olliej 5y ago
        The problem is time rather than money - there are a finite number of engineering hours in a year, the only way to increase that is to add more engineers, but adding more engineers very rapidly starts costing time rather than helping.
        saagarjha 5y ago
        I think the strategy suggested here was “why doesn’t Apple just buy all of NSO’s exploits”, to which I responded that doing this for all threat actors is infeasible. I think you’re talking about actually solving the security issues, which is blocked by things that aren’t just money, I agree.
      - jagger27 5y ago
        Government-backed entities can also make promises that Apple's money can't buy. Who knows what kind of back room deals are made that involve citizenship, safe passage, dropped criminal charges, etc.
        saagarjha 5y ago
        Indeed.
      - lern_too_spel 5y ago
        Big governments aren't selling their espionage services, so they're arguably less important to handle. Moreover, there is likely duplication in exploits between these groups such that buying private sector exploits and patching them will likely take a few government exploits out with them.
        saagarjha 5y ago
        I wouldn’t argue that. Plus, note that there are many NSOs, and stamping them all out gets harder as you shut more of them down because prices go up.
- nicce 5y ago
  Resources get surprisingly low if you share them for every possible attack interface. (If you even know them all) On Apple’s scale, there are quite many. Attackers need to find only one buggy interface.
richardw 5y ago
Thought experiment: Apple could hire nine NSO equivalent teams to do what NSO does. Then fix the bugs they find. This is not a guarantee there are no bugs, but if finding them is crucial to fixing them, NSO is now 1/10 likely to be the team that finds them and 10 times less likely to maintain unique access to the secret. Scale numbers to make better financial sense. Now, one would think there are already more non-NSO security researchers than NSO have, who earn money from bounties and report issues to Apple. Yet NSO has a business model. How?
- olliej 5y ago
  You're assuming apple doesn't already have that. What we see in the news, etc is an example of survivor bias: you don't see the bugs that apple finds in anything they haven't released.
  - judge2020 5y ago
    For reference, Apple has four red team positions currently open[0], and I imagine these are rolling openings (ie. recreated every 6 months or so for listing refinement). 0: https://jobs.apple.com/en-us/search?search=%22red%20team%22&sort=relevance&location=united-states-USA https://jobs.apple.com/en-us/search?search=%22red%20team%22&...
- fortran77 5y ago
  > Yet NSO has a business model. How? Because Apple's security is actually pretty bad, making their job easy.
- throwaway_4ever 5y ago
  > Apple could hire nine NSO equivalent teams to do what NSO does. No they can’t. If Apple could, they would deploy their war chest billions to do so. People often make the mistake of thinking some objective is money-constrained, and a place like Microsoft could’ve just thrown the most money at mobile in 2008 to be the best mobile OS. The Israeli’s in these national security level positions work like their life depends on it because they literally believe it does. Good luck replicating that with a gazillion teams of cushy big tech Silicon Valley positions.
fsflover 5y ago
This is not how security works. Reasonable security can be achieved by compartmentalization, so you don't have to make all code flawless. See: https://qubes-os.org https://qubes-os.org
- olliej 5y ago
  macOS and ios are heavily compartmentalized - but attackers are still able to get through. Extreme compartmentalization through virtualisation is also insufficient, as it just becomes a matter of “is there a bug in the hyper visor”, to which the answer is yes: every major VM system has had multiple escapes, as another commenter pointed out even your example of qubes os has had them. I know how hard security is. I know how hard writing bug free code is. Brushing that aside and saying “just do X and bugs don’t matter”, assumes that somehow the people implementing support for X are immune to the same problems faced by other developers.
  - fsflover 5y ago
    > macOS and ios are heavily compartmentalized iOS isn't. The vulnerability in iMessage led to the whole system compromize. > every major VM system has had multiple escapes Qubes uses hardware (VT-d) virtualization, which AFAIK was last time broken by the Qubes founder in 2003: https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software).
    - olliej 5y ago
      We’re working on a security definition which means “control of system”. That means escaping the compartment: for iMessage that means escaping the sandbox. The most recent one on the PZ blog is a multiparty series and I don’t believe they’ve described how NSO gets from code execution to actually escaping the sandbox. If being able to escape the sandboxing means “not compartmentalized” then if anyone escapes the VM in qubes then qubes is also not compartmentalized. The difference is how extreme the compartmentalization is. macOS and iOS use sandboxing which is much lighter weight than a full VM, but is not as strong a boundary as a full VM. However saying that they’re not a form of compartmentalization is plainly false. Every other virtualisation system also uses hardware virtualisation. They’ve been popped. I don’t think it’s unreasonable to suspect that qubes has not had the same degree of offensive interest as, say, VMware.