8 ms·

Because Apple controls the entire stack. From processor, to boards, to OS, to the walled garden of apps. No other tech has that level of control. Think of th

Because Apple controls the entire stack. From processor, to boards, to OS, to the walled garden of apps. No other tech has that level of control. Think of the controversy surrounding the Intel ME and other “secondary processors”. Not an issue with the IPhone (from Apples perspective). When Google decided they wanted to control all the computing on their servers, from bare metal up, they ran into the ME. Apple is the only key civilian entity with that level of control.

coldtea 5y ago
>Because Apple controls the entire stack. From processor, to boards, to OS, to the walled garden of apps. That's not really relevant. The American intelligence apparatus controls their entire stack too, ordering and autiting custom versions of professors and such.
drzaiusapelord 5y ago
Apple cant do this on its servers either, considering it has no server product. Google has this stack control in Android, Google Home, Chromebook, etc trivially if it chooses, if it doesn't have that already. Microsoft can do this on its Cortana smart speakers and Surface Pro X running their (Qualcomms) ARM cpu. Also I imagine bulk buyers can get Intel ME disabled if they don't want it on their server. AMD PSP can be disabled in the BIOS I believe. Comparing a phone to a server doesn't make too much sense. A phone is a consumer product like Android or Home and a server is a business product. Apple runs its cloud on Intel or AMD like everyone else.
- mike_d 5y ago
  > Apple cant do this on its servers either, considering it has no server product Wat? https://www.apple.com/shop/buy-mac/mac-pro/rack https://www.apple.com/shop/buy-mac/mac-pro/rack https://www.apple.com/macos/server/ https://www.apple.com/macos/server/
  - deleted 5y ago
    [deleted]
  - drzaiusapelord 5y ago
    I'm skeptic this is what they're populating their datacenters with. These are niche products for smaller businesses. I meant they are not powering their cloud with these products. Apple's icloud is partly their datacenter running a mix of systems/hardware and renting out Amazon and Google cloud units, which are Intel/AMD.
    - mike_d 5y ago
      Two hours ago you didn't even know they made servers, so your statement about how niche you think they are isn't super relevant. Google populates it's datacenters with their own servers. So does Facebook. So does Amazon. Netflix builds their own CDN appliances. Apple absolutely could if they wanted to.
      - drzaiusapelord 5y ago
        Define "own servers" because this discussion is about controlling the entire stack, and eliminating things like ME or PSP. FANG runs on AMD/Intel, so they don't own their own stack. They have to contend with the AMD/Intel product. Buying a beige box to put an intel chip is not "your own" servers in the context of this discussion. I'm not sure why you're so rude and confrontational here. We're discussing how Apple has top to bottom control in its consumer devices, not some weird discussion about datacenter packaging. Servers run on AMD/Intel and as such are stuck with the elements of those platforms AMD and Intel dictate. That's not having the entire stack to themselves.
        mike_d 5y ago
        I think you seem to be confusing what is available in the public cloud and on Newegg for what companies use internally. Custom silicon is extremely prevalent and it doesn't all run on AMD/Intel.
  - 5y ago
judge2020 5y ago
Apple does all of it quite well, but software inherently has bugs for as long as we use type-unsafe languages. Maybe Apple could move entirely to Rust instead of C to prevent things like checkm8 but even then the logic of a program is written by imperfect humans.
- saagarjha 5y ago
  Apple uses a memory-safe version of C for iBoot these days.
- frutiger 5y ago
  > software inherently has bugs for as long as we use type-unsafe languages This is untrue. Textbooks on type theory (Pierce’s TaPL comes immediately to mind) will state early on that well typed terms cannot always eliminate all undesirable states. In fact, there is a tension in encoding all your constraints into the type system (at which point you become a mathematician proving theorems) and producing programs that are actually useful to other people.
  - nicce 5y ago
    Indeed, you can still have errors in logic for example, which can lead to dangerous vulnerabilities.
toofy 5y ago
ill echo what the gp said. again, none of that means it is at all realistic to believe you can defeat determined funded state actors. it is the height of ridiculousness to ever think you can use anything with the surface of something like a modern phone and be safe against a state. ridiculous. i’ll say it again. ridiculous. threat models exist for a reason. if anyone ever implied that an apple phone or an android, or pc were safe against this model, this person is a lightweight and you should run fast and far from their advice. if you’ve ever told people they were safe against a state actor with a smart phone, you need to immediately reevaluate what you do and what you do not know. immediately. no serious person—including apple themselves—ever made the claim these devices were safe against state determined actors with an off-the-shelf device you can grab from best buy on your way home from work.
- bigbizisverywyz 5y ago
  I dunno, if you look at the incredible hoops the iMessage exploit had to go through in order to work, then there must be a point where the effort involved in finding new exploits would far outweigh the benefits ... assuming Apple is actively finding and closing current exploits and not introducing new software that just increases the attack surface area.
  - pyuser583 5y ago
    Roughly speaking it worked by hijacking preinstalled apps (calendar, mail, etc) and privilege escalation, to create a new account. The Apples preinstalled apps, and default behavior meant the attackers could rely on certain behavior once they were in. Apples standardization is what got them.
- pyuser583 5y ago
  True … keep in mind … the whole idea behind a mobile device is frought with security issues. It’s constantly connected to uncontrolled networks, constantly downloading media, possesses microphones, cameras, gps, etc Basically gathers tons of info, and is connected to the internet always and everywhere.
- astrange 5y ago
wolverine876 5y ago
> Apple controls the entire stack Control doesn't guarantee security, it just assesses accountability. Also, control doesn't mean Apple writes all the software. They outside code like everyone else.
- pm90 5y ago
  But they don’t have to. If anyone had the resources to hire top tier software engineers to write or audit everything in house it would be Apple. That they don’t do it is almost… greedy and shows a lack of foresight imo.
  - wolverine876 5y ago
    > If anyone had the resources to hire top tier software engineers to write or audit everything in house it would be Apple. That they don’t do it is almost… greedy and shows a lack of foresight imo. Maybe it shows that even Apple doesn't have the resources to do it, and therefore nobody does.
    - tcmart14 5y ago
      Not only that, but there is more going on than just auditing. If Apple spent the time necessary to constantly do deep security dives, and spent the money on top talent to do it, it still wouldn't get done because it is constantly a moving target unless they froze all new development. Otherwise they have done a complete walk through of Mac OS 12.1, but 12.3 is released and they have n't even started on a full walk through of 12.2. These are time intensive tasks, meanwhile customers and shareholders are still wanting the latest, greatest, and shiniest. Then at the end of the day, customers are still installing 3rd party applications, so does apple have to walk all of their code too?
- pyuser583 5y ago
  It reduces trust … in a good way. Whenever a machine says “well if just have to trust this other component”, security is reduced. Apple rarely has to “just trust” a part of its stack.
devoutsalsa 5y ago
I had to lookup Intel ME. It's the Intel Management Engine. https://en.wikipedia.org/wiki/Intel_Management_Engine https://en.wikipedia.org/wiki/Intel_Management_Engine From the Wikipedia article: The Intel Management Engine (ME), also known as the Intel Manageability Engine, is an autonomous subsystem that has been incorporated in virtually all of Intel's processor chipsets since 2008. It is located in the Platform Controller Hub of modern Intel motherboards. The Intel Management Engine always runs as long as the motherboard is receiving power, even when the computer is turned off. This issue can be mitigated with deployment of a hardware device, which is able to disconnect mains power. The Intel ME is an attractive target for hackers, since it has top level access to all devices and completely bypasses the operating system. The Electronic Frontier Foundation has voiced concern about Intel ME and some security researchers have voiced concern that it is a backdoor.
- vgb2k18 5y ago
  See also, AMD's PSP (Platform Secure Processor) https://en.wikipedia.org/wiki/AMD_Platform_Security_Processor https://en.wikipedia.org/wiki/AMD_Platform_Security_Processo...
harry8 5y ago
>When Google decided they wanted to control all the computing on their servers, from bare metal up, they ran into the ME. Why not go AMD or do they do something equivalent to the intel ME?
- saagarjha 5y ago
  They do, it’s called the Platform Security Processor.
  - trenchgun 5y ago
    Why not go to Arm?
    - saagarjha 5y ago
      No good options?
      - fsflover 5y ago
        Depends on what is "good" for you: https://pine64.org/pinebook https://pine64.org/pinebook.
        saagarjha 5y ago
        For me it’s probably fine. For Google, it’s not.
        harry8 5y ago
        You can't buy these. All pinebooks are out of stock due to chip shortage or what stock is there is reserved. So no, that suggestion isn't good for basically everybody.
    - philjohn 5y ago
      Fun fact - the AMD PSP is actually an Arm core.
muricula 5y ago
Surprisingly enough there are other consumer grade devices where one company controls the entire stack and deliver similar security -- game consoles. xbox os and ios have different designs but make similar security promises.
rndgermandude 5y ago
As long as fallible humans are involved in creating software and hardware we will have bugs, and some of those bugs will be exploitable. The best we can hope for is using the best tools and practices we have available to make it as hard as possible to make mistakes and therefore as hard as possible for attackers to find exploitable bugs. In reality tho, that's not really what happens. We still use C (and C++) for example (and other footgun-languages) and/or run billions of lines of badly audited "legacy" code (that wasn't written with the threats we face today in mind) in a lot of places for various reasons[0], and then try to use all kinds of tools as work around to detect past and new mistakes or at least mitigate the severity of outcomes when mistakes happen and are uncovered and exploited by adversaries[1]. And that's not even yet considering supply chain attacks, be it software or hardware ones. That isn't to say that Apple couldn't still do a lot better... "Beware of bugs in the above code; I have only proved it correct, not tried it." [0] Such as maintaining legacy code bases, "performance", interoperability, development speed, developer availability, business ("cost") considerations, etc. [1] Starting with code reviews, code coverage, unit tests, static analysis, fuzz testing, etc, and then later at runtime ASLR, canaries, retpoline, sandboxes, etc.
DyslexicAtheist 5y ago
it's 100% unrealistic because the discussion and the headline can be summed up as "how come this thing is not unhackable as the company promised?" When people say "state-level hackers", they appeal to authority like "the state" is something one simply can't win against. And those employed by the state are super-level Uber-hackers. But in reality what it means is: A state is able to waste billions on mistakes and incompetence. The state gets away with most projects failing. In reality forensics and post-mortems show the adversary's understanding of tradecraft, opsec and technical understanding of the space was so bad, it's _not_ skill but luck why they won. There is very little "advanced" about an APT other than unlimited pockets. If you have unlimited pockets you're more likely able to brute-force your way to winning. state-level is such an opaque concept because of the huge numbers of actors in it, that never get credited. People like systems-thinking and the idea of everything being planned and orchestrated like in a Hollywood movie. And they we forget in many "bAd coUntTiEs" it's a collaboration between criminal enterprise and state enterprise. It includes thousands of "criminals" who can be leaned on or are willing to lean on others. There is also the private-public partnership in some of the more functional countries[1] that adds thousands to this group of people. the term "state level" is almost useless. It is the language of PR and propaganda. If taken serious as a concept it just means an entire different country. And this is why it's saying "unhackable": When one expects a security guarantee to defend against such a large group of diverse actors (or not even being able to identify the adversary in the first place) then to fulfill that promise it will have to be "unhackable". [1] Australia has a gag-order where you can't even warn your employer when they force you to implement a backdoor in their products.
go_prodev 5y ago
A determined actor can still infiltrate their supply chain. Almost the entire phone manufacturing and assembly, firmware etc is handled in China.

coldtea 5y ago

>Because Apple controls the entire stack. From processor, to boards, to OS, to the walled garden of apps. That's not really relevant. The American intelligence apparatus controls their entire stack too, ordering and autiting custom versions of professors and such.

drzaiusapelord 5y ago

Apple cant do this on its servers either, considering it has no server product. Google has this stack control in Android, Google Home, Chromebook, etc trivially if it chooses, if it doesn't have that already. Microsoft can do this on its Cortana smart speakers and Surface Pro X running their (Qualcomms) ARM cpu. Also I imagine bulk buyers can get Intel ME disabled if they don't want it on their server. AMD PSP can be disabled in the BIOS I believe. Comparing a phone to a server doesn't make too much sense. A phone is a consumer product like Android or Home and a server is a business product. Apple runs its cloud on Intel or AMD like everyone else.

mike_d 5y ago
> Apple cant do this on its servers either, considering it has no server product Wat? https://www.apple.com/shop/buy-mac/mac-pro/rack https://www.apple.com/shop/buy-mac/mac-pro/rack https://www.apple.com/macos/server/ https://www.apple.com/macos/server/
- deleted 5y ago
  [deleted]
- drzaiusapelord 5y ago
  I'm skeptic this is what they're populating their datacenters with. These are niche products for smaller businesses. I meant they are not powering their cloud with these products. Apple's icloud is partly their datacenter running a mix of systems/hardware and renting out Amazon and Google cloud units, which are Intel/AMD.
  - mike_d 5y ago
    Two hours ago you didn't even know they made servers, so your statement about how niche you think they are isn't super relevant. Google populates it's datacenters with their own servers. So does Facebook. So does Amazon. Netflix builds their own CDN appliances. Apple absolutely could if they wanted to.
    - drzaiusapelord 5y ago
      Define "own servers" because this discussion is about controlling the entire stack, and eliminating things like ME or PSP. FANG runs on AMD/Intel, so they don't own their own stack. They have to contend with the AMD/Intel product. Buying a beige box to put an intel chip is not "your own" servers in the context of this discussion. I'm not sure why you're so rude and confrontational here. We're discussing how Apple has top to bottom control in its consumer devices, not some weird discussion about datacenter packaging. Servers run on AMD/Intel and as such are stuck with the elements of those platforms AMD and Intel dictate. That's not having the entire stack to themselves.
      - mike_d 5y ago
        I think you seem to be confusing what is available in the public cloud and on Newegg for what companies use internally. Custom silicon is extremely prevalent and it doesn't all run on AMD/Intel.
- 5y ago

judge2020 5y ago

Apple does all of it quite well, but software inherently has bugs for as long as we use type-unsafe languages. Maybe Apple could move entirely to Rust instead of C to prevent things like checkm8 but even then the logic of a program is written by imperfect humans.

saagarjha 5y ago
Apple uses a memory-safe version of C for iBoot these days.
frutiger 5y ago
> software inherently has bugs for as long as we use type-unsafe languages This is untrue. Textbooks on type theory (Pierce’s TaPL comes immediately to mind) will state early on that well typed terms cannot always eliminate all undesirable states. In fact, there is a tension in encoding all your constraints into the type system (at which point you become a mathematician proving theorems) and producing programs that are actually useful to other people.
- nicce 5y ago
  Indeed, you can still have errors in logic for example, which can lead to dangerous vulnerabilities.

toofy 5y ago

ill echo what the gp said. again, none of that means it is at all realistic to believe you can defeat determined funded state actors. it is the height of ridiculousness to ever think you can use anything with the surface of something like a modern phone and be safe against a state. ridiculous. i’ll say it again. ridiculous. threat models exist for a reason. if anyone ever implied that an apple phone or an android, or pc were safe against this model, this person is a lightweight and you should run fast and far from their advice. if you’ve ever told people they were safe against a state actor with a smart phone, you need to immediately reevaluate what you do and what you do not know. immediately. no serious person—including apple themselves—ever made the claim these devices were safe against state determined actors with an off-the-shelf device you can grab from best buy on your way home from work.

bigbizisverywyz 5y ago
I dunno, if you look at the incredible hoops the iMessage exploit had to go through in order to work, then there must be a point where the effort involved in finding new exploits would far outweigh the benefits ... assuming Apple is actively finding and closing current exploits and not introducing new software that just increases the attack surface area.
- pyuser583 5y ago
  Roughly speaking it worked by hijacking preinstalled apps (calendar, mail, etc) and privilege escalation, to create a new account. The Apples preinstalled apps, and default behavior meant the attackers could rely on certain behavior once they were in. Apples standardization is what got them.
pyuser583 5y ago
True … keep in mind … the whole idea behind a mobile device is frought with security issues. It’s constantly connected to uncontrolled networks, constantly downloading media, possesses microphones, cameras, gps, etc Basically gathers tons of info, and is connected to the internet always and everywhere.
astrange 5y ago

wolverine876 5y ago

> Apple controls the entire stack Control doesn't guarantee security, it just assesses accountability. Also, control doesn't mean Apple writes all the software. They outside code like everyone else.

pm90 5y ago
But they don’t have to. If anyone had the resources to hire top tier software engineers to write or audit everything in house it would be Apple. That they don’t do it is almost… greedy and shows a lack of foresight imo.
- wolverine876 5y ago
  > If anyone had the resources to hire top tier software engineers to write or audit everything in house it would be Apple. That they don’t do it is almost… greedy and shows a lack of foresight imo. Maybe it shows that even Apple doesn't have the resources to do it, and therefore nobody does.
  - tcmart14 5y ago
    Not only that, but there is more going on than just auditing. If Apple spent the time necessary to constantly do deep security dives, and spent the money on top talent to do it, it still wouldn't get done because it is constantly a moving target unless they froze all new development. Otherwise they have done a complete walk through of Mac OS 12.1, but 12.3 is released and they have n't even started on a full walk through of 12.2. These are time intensive tasks, meanwhile customers and shareholders are still wanting the latest, greatest, and shiniest. Then at the end of the day, customers are still installing 3rd party applications, so does apple have to walk all of their code too?
pyuser583 5y ago
It reduces trust … in a good way. Whenever a machine says “well if just have to trust this other component”, security is reduced. Apple rarely has to “just trust” a part of its stack.

devoutsalsa 5y ago

I had to lookup Intel ME. It's the Intel Management Engine. https://en.wikipedia.org/wiki/Intel_Management_Engine https://en.wikipedia.org/wiki/Intel_Management_Engine From the Wikipedia article: The Intel Management Engine (ME), also known as the Intel Manageability Engine, is an autonomous subsystem that has been incorporated in virtually all of Intel's processor chipsets since 2008. It is located in the Platform Controller Hub of modern Intel motherboards. The Intel Management Engine always runs as long as the motherboard is receiving power, even when the computer is turned off. This issue can be mitigated with deployment of a hardware device, which is able to disconnect mains power. The Intel ME is an attractive target for hackers, since it has top level access to all devices and completely bypasses the operating system. The Electronic Frontier Foundation has voiced concern about Intel ME and some security researchers have voiced concern that it is a backdoor.

vgb2k18 5y ago
See also, AMD's PSP (Platform Secure Processor) https://en.wikipedia.org/wiki/AMD_Platform_Security_Processor https://en.wikipedia.org/wiki/AMD_Platform_Security_Processo...

harry8 5y ago

>When Google decided they wanted to control all the computing on their servers, from bare metal up, they ran into the ME. Why not go AMD or do they do something equivalent to the intel ME?

saagarjha 5y ago
They do, it’s called the Platform Security Processor.
- trenchgun 5y ago
  Why not go to Arm?
  - saagarjha 5y ago
    No good options?
    - fsflover 5y ago
      Depends on what is "good" for you: https://pine64.org/pinebook https://pine64.org/pinebook.
      - saagarjha 5y ago
        For me it’s probably fine. For Google, it’s not.
      - harry8 5y ago
        You can't buy these. All pinebooks are out of stock due to chip shortage or what stock is there is reserved. So no, that suggestion isn't good for basically everybody.
  - philjohn 5y ago
    Fun fact - the AMD PSP is actually an Arm core.

muricula 5y ago

Surprisingly enough there are other consumer grade devices where one company controls the entire stack and deliver similar security -- game consoles. xbox os and ios have different designs but make similar security promises.

rndgermandude 5y ago

As long as fallible humans are involved in creating software and hardware we will have bugs, and some of those bugs will be exploitable. The best we can hope for is using the best tools and practices we have available to make it as hard as possible to make mistakes and therefore as hard as possible for attackers to find exploitable bugs. In reality tho, that's not really what happens. We still use C (and C++) for example (and other footgun-languages) and/or run billions of lines of badly audited "legacy" code (that wasn't written with the threats we face today in mind) in a lot of places for various reasons[0], and then try to use all kinds of tools as work around to detect past and new mistakes or at least mitigate the severity of outcomes when mistakes happen and are uncovered and exploited by adversaries[1]. And that's not even yet considering supply chain attacks, be it software or hardware ones. That isn't to say that Apple couldn't still do a lot better... "Beware of bugs in the above code; I have only proved it correct, not tried it." [0] Such as maintaining legacy code bases, "performance", interoperability, development speed, developer availability, business ("cost") considerations, etc. [1] Starting with code reviews, code coverage, unit tests, static analysis, fuzz testing, etc, and then later at runtime ASLR, canaries, retpoline, sandboxes, etc.

DyslexicAtheist 5y ago

it's 100% unrealistic because the discussion and the headline can be summed up as "how come this thing is not unhackable as the company promised?" When people say "state-level hackers", they appeal to authority like "the state" is something one simply can't win against. And those employed by the state are super-level Uber-hackers. But in reality what it means is: A state is able to waste billions on mistakes and incompetence. The state gets away with most projects failing. In reality forensics and post-mortems show the adversary's understanding of tradecraft, opsec and technical understanding of the space was so bad, it's _not_ skill but luck why they won. There is very little "advanced" about an APT other than unlimited pockets. If you have unlimited pockets you're more likely able to brute-force your way to winning. state-level is such an opaque concept because of the huge numbers of actors in it, that never get credited. People like systems-thinking and the idea of everything being planned and orchestrated like in a Hollywood movie. And they we forget in many "bAd coUntTiEs" it's a collaboration between criminal enterprise and state enterprise. It includes thousands of "criminals" who can be leaned on or are willing to lean on others. There is also the private-public partnership in some of the more functional countries[1] that adds thousands to this group of people. the term "state level" is almost useless. It is the language of PR and propaganda. If taken serious as a concept it just means an entire different country. And this is why it's saying "unhackable": When one expects a security guarantee to defend against such a large group of diverse actors (or not even being able to identify the adversary in the first place) then to fulfill that promise it will have to be "unhackable". [1] Australia has a gag-order where you can't even warn your employer when they force you to implement a backdoor in their products.

go_prodev 5y ago

A determined actor can still infiltrate their supply chain. Almost the entire phone manufacturing and assembly, firmware etc is handled in China.