7 ms·

iCloud for Windows downloading other people's photos

377 points by whatever1 4y ago

quyleanh 4y ago
Then Google Photos. Now iCloud Photos. When Onedrive Photos? I'm currently using Onedrive (with Office 365) as my main data backup...
- plantain 4y ago
  Plot twist - iCloud uses Google Cloud for storage. https://www.macrumors.com/2021/06/29/icloud-data-stored-on-google-cloud-increasing/ https://www.macrumors.com/2021/06/29/icloud-data-stored-on-g...
kylehotchkiss 4y ago
Has somebody tried emailing this to Tim? a note saying it was ignored by apple's security submission process would probably be a good addition
- s1mon 4y ago
  I had another issue with iCloud and photo syncing being abysmally slow, and I ended up digging through LinkedIn and I found the director of engineering for photos at Apple. I messaged that person through LinkedIn, and ended up getting some very senior tech support people who helped go through my issues with me. I hesitate to post contact info, but just saying... it's possible if you are polite and can clearly articulate the issue to get someone like that to help really escalate the support.
  - jiggawatts 4y ago
    You shouldn't have to "know a guy". If I upload photos on, say, icloud.com, it'll turn up on my devices days later. In 2022, that shouldn't be categorised as merely slow when it is basically broken. This is a well-known issue with thousands and thousands of posts on various forums, with the usual answers of "Have you tried turning it off and on again?". The photo sync functionality is probably the most broken part of the Apple ecosystem that I've encountered, and this security issue just proves my suspicions.
whatever1 4y ago
In a world of containers and micro services, I do not understand why we cannot have independent databases and buckets per user, specially if we are talking about sensitive data.
- tyingq 4y ago
  I'm guessing it's an uninitialized buffer in a shared encoder instance, where independent storage wouldn't have helped much.
  - _cenw 4y ago
    It looks like iCloud for Windows might remote-transcode HEVC down into a format that doesn't ask for a fee to be played back on that platform. In that case it's probably a good idea to stop using iCloud for Windows right now.
    - cjsawyer 4y ago
      That’s what the photos page on icloud.com does unless you specifically request the original format
- jjtheblunt 4y ago
  well clearly we can, and this is clearly a monstrous bug ?
- nhinck2 4y ago
  Where do you keep the record of which container belongs to which user and how does that record avoid the same problem?
  - whatever1 4y ago
    The encoder container / lambda would had been spawned for that particular user and it would have permissions to access only the content of that specific user.
ilikehurdles 4y ago
This should be a showstopper, critical issue. I’m surprised to see this still be in the wild after being posted on Friday of last week.
- walrus01 4y ago
  Imagine getting still frames of somebody else's bedroom photos or kinky selfies sent to a partner or something similar rendered into your own video. This could be very much like the technical cloud-based version of the fictional Tyler Durden splicing dick pics into single frames of 35mm film movies. Based on what people use phones for these days some sizable percentage of icloud synced photos have to be something you really wouldn't want to get out there to random other icloud users.
  - Kenji 4y ago
    Imagine having CSAM inserted in your videos, then getting persecuted for it. Oh wait, they already scan for it, good on them.
    - infogulch 4y ago
      Hm, what if you modified a CSAM video to evade detection (adversarial ML etc), then injected it onto the target's machine with this fun bug, then when the target's computer automatically creates a thumbnail for the video the thumbnail would be automatically flagged.
      - deleted 4y ago
        [deleted]
      - smoldesu 4y ago
        Or just make your own fake/questionable hash collisions with a script Some Guy made on Github: https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX
- greasyfullfryup 4y ago
lovehashbrowns 4y ago
Holy heck this is a bad one. That response from the security team is completely unacceptable. I wonder if there's a way to force this to happen, e.g. by modifying the file contents directly.
Kibae 4y ago
Why aren't photos and files encrypted in the cloud? I feel like it should be standard for cases like this.
- Bilal_io 4y ago
  It's Apple. As long as its users have the perception of security and privacy, they may not change anything.
- MBCook 4y ago
  Maybe they are, but the gold returned from the sever isn’t. When they tried to encrypt photos end-to-end much of HN (and others) flipped out and raised such a fuss they gave up.
  - commoner 4y ago
    > When they tried to encrypt photos end-to-end There is no evidence that iCloud was going to implement end-to-end encryption. This was a rumor that was spread by people who defended Apple's plan to implement on-device CSAM scanning.
  - smoldesu 4y ago
    > much of HN (and others) flipped out That must signal some widely-objectionable, obvious implementation error that rubbed common people and engineers the wrong way.
- jeroenhd 4y ago
  Probably because people lose keys, forget password, and lose their treasured family photos. That said, the option should at least be available to those who know the benefits and accept the risks.
  - floydnoel 4y ago
    I think this is one of the biggest unsolved problems with holding private keys. There needs to be some kind of recoverable key system (secret sharing) that is bulletproof and idiot proof. Hopefully something like that is possible!
est31 4y ago
In theory this is meant to be one of the advantages of end to end encryption: no more "accidental" leakage of user data between users, leakage in logs, etc (remember Facebook's logging incident? [0]). as it's only available on end user devices. And if you look at Apple's documentation [1], they say that iCloud is end to end encrypted. This is obviously not accurate as Apple keeps decryption keys for themselves. But this issue is even worse: here, the end to end encryption was circumvented in such a bad way that this bug could surface. [0]: https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/ https://krebsonsecurity.com/2019/03/facebook-stored-hundreds... [1]: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
- sneak 4y ago
  Apple does not claim that iCloud photos are end to end encrypted. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
  - est31 4y ago
    Good point about that. Makes sense then how this issue could surface.
    - MBCook 4y ago
      They were going to, but some people flipped out about “their devices spying on them”. So instead photos are unencrypted and still scanned server-side.
      - trifurcate 4y ago
        Do you have any statement from Apple themselves or any indication that this was their line of thought? As far as I know, the on-device iMessage image scanning for CSAM (presumably what you are referring to) is a shipped feature live on all recent iOS builds, and I don't ever recall seeing any sort of public debate regarding whether iCloud photos should be encrypted or not (to be fair, before this thread, I assumed that they were).
sneak 4y ago
Reminder: Photos and videos in iCloud are not end to end encrypted (just like your device backup that contains your iMessage "e2e" keys) and are always readable by Apple (and thus FBI et al). Apple is required to hand over data without a search warrant over 30,000 times per year to US authorities. https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
- kls0e 4y ago
  Is there a way to have new iMessage e2e keys generated after disabling iCloud device backup?
  - wtallis 4y ago
    According to https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 : > When you turn off iCloud Backup, a new key is generated on your device to protect future messages and isn't stored by Apple. So it doesn't look like any extra steps are required.
    - sneak 4y ago
      The extra steps are having everyone else you iMessage with also turn off iCloud Backup. Messages are all backed up twice by default: once from each device. Turning off iCloud Backup is like migrating off of gmail to keep daddy G from reading your correspondence: it doesn't work when everyone else you correspond with is still being surveilled.
      - kls0e 4y ago
        thanks for clarifying.
- astrange 4y ago
  There’s nothing special about a “search warrant” compared to other equally valid forms of legal process.
goosedragons 4y ago
Anyone else think the "scanlines" in the video are not scanlines but actually data of some sort? They seem to have white/black bits. Suggesting it might be some sort of data the video codec displays that way.
6510 4y ago
One could argue that the response makes icloud illegal in the EU.
- mhitza 4y ago
  All US operated websites are technically illegal in EU (due to the CLOUD Act). Practically, they are still used en masse. In theory the next iteration of the Privacy Shield (or whatever name they are going to give it this time around) and which EU-US should sign sometime next year should reconcile in some way the existing privacy issues where EU residents personal data does not have adequate privacy protection once it's touched by a US company.
extr0pian 4y ago
This happened to me during a Google Takeout export when I was degoogling in late 2019. I recall going through some photos from the earlier 2010's and some random pictures of other people were popping up. About a month or so later I received an email from Google letting me know that some of my files may have been accidentally in other people's exports. Since then, I stopped using apps like Google Photos and cloud storage in general. If I do, my files will be encrypted before I upload them. Here's the original story: https://9to5google.com/2020/02/03/google-photos-video-strangers/ https://9to5google.com/2020/02/03/google-photos-video-strang...
StanislavPetrov 4y ago
Another reminder that "the cloud" is really just someone else's computer.
Jerrrry 4y ago
If this can happen accidentally, it can happen on purpose. A glitch is just an exploit that just hasn't been sufficiently documented.
tibbydudeza 4y ago
I get the feeling that the folks working on the Windows/Android team at Apple are not highly regarded - get the sense of "folks working in the basement" - you can see it by the lackluster stuff they ship.
- layer8 4y ago
  As a Windows/Android developer, you probably don't apply at Apple for a job, and as an Apple employee you're probably not too enamored with developing for Windows/Android.
  - tibbydudeza 4y ago
    Apple Music was Beats Music and iTunes just added cruft over the years and the Windows version was eventually added to the Windows Store with no improvement whatsever (podcasts was the last big upgrade). Guess iTunes has been sunset and deprecated by Apple Music - who buys music tracks these days ???. I must be the only oddball that still curates and listens to his music on a PC (Spotify).
divbzero 4y ago
This kind of bug is unacceptable for a supposedly private cloud service. I wonder how long the bug has been around and whether it is at all related to the recent roll out of iCloud Shared Photo Library. https://support.apple.com/guide/icloud-windows/use-icloud-shared-photo-library-icw153978ac3/icloud https://support.apple.com/guide/icloud-windows/use-icloud-sh...
languageserver 4y ago
There is absolutely no proof that these are images from other peoples iCloud accounts. Assuming these are even from iCloud in the first place, they could have been their version of "stock photos". Assuming these are from iCloud, could have been the user's previous deleted photos. Could also just be photos on their windows computer. So many options. Going straight for the most unlikely scenario is strange, and seems like people have an agenda.
- Aaron2222 4y ago
  Stock photos had crossed my mind as a possibility as well, but I'd say it's unlikely to be previously deleted photos or from their Windows computer if they're seeing photos of kids they don't know.
  - languageserver 4y ago
    yea, maybe the computer is used? All I am saying is that this is a very serious security breach if true, and everyone in this thread is taking a forum post at face value. There are a hundred things that could "cause" this, even if true.
    - smoldesu 4y ago
      According to the thread on Macrumors, this hypothesis makes no sense: https://forums.macrumors.com/threads/icloud-for-windows-corrupting-videos-downloading-other-peoples-photos.2370666/?post=31739980#post-31739980 https://forums.macrumors.com/threads/icloud-for-windows-corr... The data appears to be improperly handled personal info. There is no evidence suggesting that the photos are from a "used computer" and the photos are directly downloaded via the iCloud for Windows client.

377 points by whatever1 4y ago

Then Google Photos. Now iCloud Photos. When Onedrive Photos? I'm currently using Onedrive (with Office 365) as my main data backup...

plantain 4y ago
Plot twist - iCloud uses Google Cloud for storage. https://www.macrumors.com/2021/06/29/icloud-data-stored-on-google-cloud-increasing/ https://www.macrumors.com/2021/06/29/icloud-data-stored-on-g...

kylehotchkiss 4y ago

Has somebody tried emailing this to Tim? a note saying it was ignored by apple's security submission process would probably be a good addition

s1mon 4y ago
I had another issue with iCloud and photo syncing being abysmally slow, and I ended up digging through LinkedIn and I found the director of engineering for photos at Apple. I messaged that person through LinkedIn, and ended up getting some very senior tech support people who helped go through my issues with me. I hesitate to post contact info, but just saying... it's possible if you are polite and can clearly articulate the issue to get someone like that to help really escalate the support.
- jiggawatts 4y ago
  You shouldn't have to "know a guy". If I upload photos on, say, icloud.com, it'll turn up on my devices days later. In 2022, that shouldn't be categorised as merely slow when it is basically broken. This is a well-known issue with thousands and thousands of posts on various forums, with the usual answers of "Have you tried turning it off and on again?". The photo sync functionality is probably the most broken part of the Apple ecosystem that I've encountered, and this security issue just proves my suspicions.

whatever1 4y ago

In a world of containers and micro services, I do not understand why we cannot have independent databases and buckets per user, specially if we are talking about sensitive data.

tyingq 4y ago
I'm guessing it's an uninitialized buffer in a shared encoder instance, where independent storage wouldn't have helped much.
- _cenw 4y ago
  It looks like iCloud for Windows might remote-transcode HEVC down into a format that doesn't ask for a fee to be played back on that platform. In that case it's probably a good idea to stop using iCloud for Windows right now.
  - cjsawyer 4y ago
    That’s what the photos page on icloud.com does unless you specifically request the original format
jjtheblunt 4y ago
well clearly we can, and this is clearly a monstrous bug ?
nhinck2 4y ago
Where do you keep the record of which container belongs to which user and how does that record avoid the same problem?
- whatever1 4y ago
  The encoder container / lambda would had been spawned for that particular user and it would have permissions to access only the content of that specific user.

ilikehurdles 4y ago

This should be a showstopper, critical issue. I’m surprised to see this still be in the wild after being posted on Friday of last week.

walrus01 4y ago
Imagine getting still frames of somebody else's bedroom photos or kinky selfies sent to a partner or something similar rendered into your own video. This could be very much like the technical cloud-based version of the fictional Tyler Durden splicing dick pics into single frames of 35mm film movies. Based on what people use phones for these days some sizable percentage of icloud synced photos have to be something you really wouldn't want to get out there to random other icloud users.
- Kenji 4y ago
  Imagine having CSAM inserted in your videos, then getting persecuted for it. Oh wait, they already scan for it, good on them.
  - infogulch 4y ago
    Hm, what if you modified a CSAM video to evade detection (adversarial ML etc), then injected it onto the target's machine with this fun bug, then when the target's computer automatically creates a thumbnail for the video the thumbnail would be automatically flagged.
    - deleted 4y ago
      [deleted]
    - smoldesu 4y ago
      Or just make your own fake/questionable hash collisions with a script Some Guy made on Github: https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX
greasyfullfryup 4y ago

lovehashbrowns 4y ago

Holy heck this is a bad one. That response from the security team is completely unacceptable. I wonder if there's a way to force this to happen, e.g. by modifying the file contents directly.

Kibae 4y ago

Why aren't photos and files encrypted in the cloud? I feel like it should be standard for cases like this.

Bilal_io 4y ago
It's Apple. As long as its users have the perception of security and privacy, they may not change anything.
MBCook 4y ago
Maybe they are, but the gold returned from the sever isn’t. When they tried to encrypt photos end-to-end much of HN (and others) flipped out and raised such a fuss they gave up.
- commoner 4y ago
  > When they tried to encrypt photos end-to-end There is no evidence that iCloud was going to implement end-to-end encryption. This was a rumor that was spread by people who defended Apple's plan to implement on-device CSAM scanning.
- smoldesu 4y ago
  > much of HN (and others) flipped out That must signal some widely-objectionable, obvious implementation error that rubbed common people and engineers the wrong way.
jeroenhd 4y ago
Probably because people lose keys, forget password, and lose their treasured family photos. That said, the option should at least be available to those who know the benefits and accept the risks.
- floydnoel 4y ago
  I think this is one of the biggest unsolved problems with holding private keys. There needs to be some kind of recoverable key system (secret sharing) that is bulletproof and idiot proof. Hopefully something like that is possible!

est31 4y ago

In theory this is meant to be one of the advantages of end to end encryption: no more "accidental" leakage of user data between users, leakage in logs, etc (remember Facebook's logging incident? [0]). as it's only available on end user devices. And if you look at Apple's documentation [1], they say that iCloud is end to end encrypted. This is obviously not accurate as Apple keeps decryption keys for themselves. But this issue is even worse: here, the end to end encryption was circumvented in such a bad way that this bug could surface. [0]: https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/ https://krebsonsecurity.com/2019/03/facebook-stored-hundreds... [1]: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303

sneak 4y ago
Apple does not claim that iCloud photos are end to end encrypted. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
- est31 4y ago
  Good point about that. Makes sense then how this issue could surface.
  - MBCook 4y ago
    They were going to, but some people flipped out about “their devices spying on them”. So instead photos are unencrypted and still scanned server-side.
    - trifurcate 4y ago
      Do you have any statement from Apple themselves or any indication that this was their line of thought? As far as I know, the on-device iMessage image scanning for CSAM (presumably what you are referring to) is a shipped feature live on all recent iOS builds, and I don't ever recall seeing any sort of public debate regarding whether iCloud photos should be encrypted or not (to be fair, before this thread, I assumed that they were).

sneak 4y ago

Reminder: Photos and videos in iCloud are not end to end encrypted (just like your device backup that contains your iMessage "e2e" keys) and are always readable by Apple (and thus FBI et al). Apple is required to hand over data without a search warrant over 30,000 times per year to US authorities. https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...

kls0e 4y ago
Is there a way to have new iMessage e2e keys generated after disabling iCloud device backup?
- wtallis 4y ago
  According to https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 : > When you turn off iCloud Backup, a new key is generated on your device to protect future messages and isn't stored by Apple. So it doesn't look like any extra steps are required.
  - sneak 4y ago
    The extra steps are having everyone else you iMessage with also turn off iCloud Backup. Messages are all backed up twice by default: once from each device. Turning off iCloud Backup is like migrating off of gmail to keep daddy G from reading your correspondence: it doesn't work when everyone else you correspond with is still being surveilled.
    - kls0e 4y ago
      thanks for clarifying.
astrange 4y ago
There’s nothing special about a “search warrant” compared to other equally valid forms of legal process.

goosedragons 4y ago

Anyone else think the "scanlines" in the video are not scanlines but actually data of some sort? They seem to have white/black bits. Suggesting it might be some sort of data the video codec displays that way.

6510 4y ago

One could argue that the response makes icloud illegal in the EU.

mhitza 4y ago
All US operated websites are technically illegal in EU (due to the CLOUD Act). Practically, they are still used en masse. In theory the next iteration of the Privacy Shield (or whatever name they are going to give it this time around) and which EU-US should sign sometime next year should reconcile in some way the existing privacy issues where EU residents personal data does not have adequate privacy protection once it's touched by a US company.

extr0pian 4y ago

This happened to me during a Google Takeout export when I was degoogling in late 2019. I recall going through some photos from the earlier 2010's and some random pictures of other people were popping up. About a month or so later I received an email from Google letting me know that some of my files may have been accidentally in other people's exports. Since then, I stopped using apps like Google Photos and cloud storage in general. If I do, my files will be encrypted before I upload them. Here's the original story: https://9to5google.com/2020/02/03/google-photos-video-strangers/ https://9to5google.com/2020/02/03/google-photos-video-strang...

StanislavPetrov 4y ago

Another reminder that "the cloud" is really just someone else's computer.

Jerrrry 4y ago

If this can happen accidentally, it can happen on purpose. A glitch is just an exploit that just hasn't been sufficiently documented.

tibbydudeza 4y ago

I get the feeling that the folks working on the Windows/Android team at Apple are not highly regarded - get the sense of "folks working in the basement" - you can see it by the lackluster stuff they ship.

layer8 4y ago
As a Windows/Android developer, you probably don't apply at Apple for a job, and as an Apple employee you're probably not too enamored with developing for Windows/Android.
- tibbydudeza 4y ago
  Apple Music was Beats Music and iTunes just added cruft over the years and the Windows version was eventually added to the Windows Store with no improvement whatsever (podcasts was the last big upgrade). Guess iTunes has been sunset and deprecated by Apple Music - who buys music tracks these days ???. I must be the only oddball that still curates and listens to his music on a PC (Spotify).

divbzero 4y ago

This kind of bug is unacceptable for a supposedly private cloud service. I wonder how long the bug has been around and whether it is at all related to the recent roll out of iCloud Shared Photo Library. https://support.apple.com/guide/icloud-windows/use-icloud-shared-photo-library-icw153978ac3/icloud https://support.apple.com/guide/icloud-windows/use-icloud-sh...

languageserver 4y ago

There is absolutely no proof that these are images from other peoples iCloud accounts. Assuming these are even from iCloud in the first place, they could have been their version of "stock photos". Assuming these are from iCloud, could have been the user's previous deleted photos. Could also just be photos on their windows computer. So many options. Going straight for the most unlikely scenario is strange, and seems like people have an agenda.

Aaron2222 4y ago
Stock photos had crossed my mind as a possibility as well, but I'd say it's unlikely to be previously deleted photos or from their Windows computer if they're seeing photos of kids they don't know.
- languageserver 4y ago
  yea, maybe the computer is used? All I am saying is that this is a very serious security breach if true, and everyone in this thread is taking a forum post at face value. There are a hundred things that could "cause" this, even if true.
  - smoldesu 4y ago
    According to the thread on Macrumors, this hypothesis makes no sense: https://forums.macrumors.com/threads/icloud-for-windows-corrupting-videos-downloading-other-peoples-photos.2370666/?post=31739980#post-31739980 https://forums.macrumors.com/threads/icloud-for-windows-corr... The data appears to be improperly handled personal info. There is no evidence suggesting that the photos are from a "used computer" and the photos are directly downloaded via the iCloud for Windows client.