4 ms·

Hypothetically, a government can coerce Apple or Google to update just your WhatsApp in a manner that you can't realistically detect. To make this more concret

Hypothetically, a government can coerce Apple or Google to update just your WhatsApp in a manner that you can't realistically detect. To make this more concrete: if Apple or Google has Australian citizens in positions with privileged access to software update infrastructure, the Australian government can issue a Technical Assistance Notice compelling them to cause a compromised variant of an app or OS component to be delivered to a targeted user, and binding them not to disclose the existence of the notice.

UncleMeat 3y ago
This is a very big hypothetical. The app stores don't have this precise of targeting, so they'd need to build entirely new distribution functionality in addition to the backdoored app. Given that Google currently leaks like a freaking sieve and has a monorepo where everybody has access to almost all of the code, it is difficult to believe that this plan would go off without a hitch.
- SheinhardtWigCo 3y ago
  Certainly a large dose of cynicism is needed to even entertain the possibility. My own cynicism stems from the Snowden disclosures and other leaks. I think there are more possibilities than you're considering. As far as I know, once a backdoored app is signed with the correct key, there's nothing stopping the partner CDN(s) from serving it to targeted users. In the simplest case, that's about 5 lines of nginx config. Also, the ability to stratify OS updates already exists because there are many combinations of country + carrier + device model + user permissions (e.g. special rules allowing internal/external developers and carrier employees to install development builds).
  - UncleMeat 3y ago
    > As far as I know, once a backdoored app is signed with the correct key, there's nothing stopping the partner CDN(s) from serving it to targeted users. This is true for native software distributed by various linux distro maintainers too.
- sneak 3y ago
  > The app stores don't have this precise of targeting This is false. Apple's OS-level software update tools have had the ability to target specific hardware items (ie serial numbers, ethernet MAC addresses, etc) for well over a decade.
- rdtsc 3y ago
  > so they'd need to build entirely new distribution functionality in addition to the backdoored app. In to order to do debugging or a slow rollout, I can see them implementing this in their backend. They’re can target updates at least by some combination of properties. Once that’s in place it might not be hard to throw a unique identifier in there as well.
chrismorgan 3y ago
Minor correction: I believe your case would require a technical capability notice the first time it was done. Assistance notices are “help us with the tools you already have” and regular warrant stuff, whereas capability notices are “you must develop the capability to help us”, and come from the Attorney-General with approval from the Minister for Communications. (A good summary of what this stuff means: https://www.homeaffairs.gov.au/nat-security/files/assistance-access-act-faq.pdf#page=4 https://www.homeaffairs.gov.au/nat-security/files/assistance....) But I also don’t think that this stuff would actually apply to Apple or Google. It’s part of the Telecommunications Act, for carriers and carriage service providers, which, while broad definitions, probably exclude them. Back when I worked at Fastmail (2017–2020), Fastmail as an email service provider was considered subject to that act for data request purposes, but the footnote at https://www.fastmail.com/blog/advocating-for-privacy-aabill-australia/#fn1 https://www.fastmail.com/blog/advocating-for-privacy-aabill-... indicates that in 2021 they were able to change to using the Crimes Act and such instead, so I’m not sure if they’re even subject to the Telecommunications Act in this way any more (not that the A&A Bill affected them anyway since they don’t do E2EE), and Apple and Google’s app stores feel like they would be even more out of scope. But I don’t know; there’s quite a bit of legislation I’ve paid close attention to, but the Telecommunications Act isn’t among that collection. And even if these app store companies aren’t covered by this stuff now, there are probably other governments out there that can already insist on this sort of thing, and plenty of future prospects, the A&A Bill showing how easily this sort of thing can be shoved through.
- SheinhardtWigCo 3y ago
  Thanks for the correction! That subtlety eluded me. On whether the assistance measures apply: the Home Affairs FAQ you referenced says they apply to "companies, businesses, organisations or individuals who contribute to the communications supply chain in Australia... This definition captures telecommunications operators, providers of electronic services, developers of software and manufacturers of devices."

UncleMeat 3y ago

This is a very big hypothetical. The app stores don't have this precise of targeting, so they'd need to build entirely new distribution functionality in addition to the backdoored app. Given that Google currently leaks like a freaking sieve and has a monorepo where everybody has access to almost all of the code, it is difficult to believe that this plan would go off without a hitch.

SheinhardtWigCo 3y ago
Certainly a large dose of cynicism is needed to even entertain the possibility. My own cynicism stems from the Snowden disclosures and other leaks. I think there are more possibilities than you're considering. As far as I know, once a backdoored app is signed with the correct key, there's nothing stopping the partner CDN(s) from serving it to targeted users. In the simplest case, that's about 5 lines of nginx config. Also, the ability to stratify OS updates already exists because there are many combinations of country + carrier + device model + user permissions (e.g. special rules allowing internal/external developers and carrier employees to install development builds).
- UncleMeat 3y ago
  > As far as I know, once a backdoored app is signed with the correct key, there's nothing stopping the partner CDN(s) from serving it to targeted users. This is true for native software distributed by various linux distro maintainers too.
sneak 3y ago
> The app stores don't have this precise of targeting This is false. Apple's OS-level software update tools have had the ability to target specific hardware items (ie serial numbers, ethernet MAC addresses, etc) for well over a decade.
rdtsc 3y ago
> so they'd need to build entirely new distribution functionality in addition to the backdoored app. In to order to do debugging or a slow rollout, I can see them implementing this in their backend. They’re can target updates at least by some combination of properties. Once that’s in place it might not be hard to throw a unique identifier in there as well.

chrismorgan 3y ago

Minor correction: I believe your case would require a technical capability notice the first time it was done. Assistance notices are “help us with the tools you already have” and regular warrant stuff, whereas capability notices are “you must develop the capability to help us”, and come from the Attorney-General with approval from the Minister for Communications. (A good summary of what this stuff means: https://www.homeaffairs.gov.au/nat-security/files/assistance-access-act-faq.pdf#page=4 https://www.homeaffairs.gov.au/nat-security/files/assistance....) But I also don’t think that this stuff would actually apply to Apple or Google. It’s part of the Telecommunications Act, for carriers and carriage service providers, which, while broad definitions, probably exclude them. Back when I worked at Fastmail (2017–2020), Fastmail as an email service provider was considered subject to that act for data request purposes, but the footnote at https://www.fastmail.com/blog/advocating-for-privacy-aabill-australia/#fn1 https://www.fastmail.com/blog/advocating-for-privacy-aabill-... indicates that in 2021 they were able to change to using the Crimes Act and such instead, so I’m not sure if they’re even subject to the Telecommunications Act in this way any more (not that the A&A Bill affected them anyway since they don’t do E2EE), and Apple and Google’s app stores feel like they would be even more out of scope. But I don’t know; there’s quite a bit of legislation I’ve paid close attention to, but the Telecommunications Act isn’t among that collection. And even if these app store companies aren’t covered by this stuff now, there are probably other governments out there that can already insist on this sort of thing, and plenty of future prospects, the A&A Bill showing how easily this sort of thing can be shoved through.

SheinhardtWigCo 3y ago
Thanks for the correction! That subtlety eluded me. On whether the assistance measures apply: the Home Affairs FAQ you referenced says they apply to "companies, businesses, organisations or individuals who contribute to the communications supply chain in Australia... This definition captures telecommunications operators, providers of electronic services, developers of software and manufacturers of devices."