3 ms·

If Apple is somehow dumb enough to leave an unscrubbed/unfuzzed backdoor in their shipping version of iOS, I'd almost be inclined to call it a red herring. It

If Apple is somehow dumb enough to leave an unscrubbed/unfuzzed backdoor in their shipping version of iOS, I'd almost be inclined to call it a red herring. It stands a reasonably safe assumption that Apple has been compelled to add obfuscated adversarial code to iOS, just as you can assume BitLocker is about as secure as a Masterlock made out of Swiss Cheese.

lapcat 3y ago
No, it's not a safe assumption, and it's not clear that you even know what you're talking about, technically. You use terms like "unscrubbed", "unfuzzed", "obfuscated", but what do you think they mean exactly? For example, how does "unfuzzed" relate, if at all, to https://en.wikipedia.org/wiki/Fuzzing https://en.wikipedia.org/wiki/Fuzzing
- smoldesu 3y ago
  I think the core conclusion is perfectly sound. Apple is a capable company - they would not let the user discover malicious code unless they wanted you to find it. They intend for people to reverse-engineer their systems and run it through IDA, Ghidra and Cutter. Tools exist to mitigate that discoverability, and I think it's foolish to assume they don't use them. The only safe assumption seems to be that they are hiding something. Proving the contrary requires tools we may never have.
  - lapcat 3y ago
    > Apple is a capable company - they would not let the user discover malicious code unless they wanted you to find it. Apple is not capable of magic, or the impossible. > Tools exist to mitigate that discoverability Citation needed. > The only safe assumption seems to be that they are hiding something. Proving the contrary requires tools we may never have. You can assume whatever you want, but with no evidence whatsoever, I wouldn't call it "safe", I'd call it "irrational". Also, you didn't answer my question, which suggests that I was right about your not knowing what you were talking about.
    - smoldesu 3y ago
      > Citation needed. There are hundreds of commercial and open methods for obfuscating a program during compilation. Since Apple controls Ring 0 they can also obfuscate syscalls and network traffic if they want. I'd ask you if I'm wrong about this, but you already seem convinced. > You can assume whatever you want, but with no evidence whatsoever, I wouldn't call it "safe", I'd call it "irrational". It's perfectly rational. Apple already does this in China. We know the CIA, FBI and NSA have a common interest in weakening all domestic cryptography. Taking Apple at face value when so many other FAANG companies have been embarrassed by PRISM revelations is a fool's decision. It will be irrational once we know for certain that Apple doesn't aid spying on their users. Until then, I figure I'm a safe skeptic. Pending evidence, both of our claims are equally substantiated. Only the uninvested parties have nothing to lose here, though.
      - dragonwriter 3y ago
        > We know the CIA, FBI and NSA have a common interest in weakening all domestic cryptography. To the extent that the CIA, NSA, or FBI have an interest in weakening cryptography, it applies at least as strongly (more strongly for most of them) to foreign cryptography, so I’d probably drop the modifier “domestic” from that sentence.
        smoldesu 3y ago
        You're not wrong about that. The history of their interference with domestic corporations is why I add that in, though. They do have an interest in weakening all cryptography, but the ones they're best-suited to compromise are the ones relying on domestic trust.
      - lapcat 3y ago
        > There are hundreds of commercial and open methods for obfuscating a program during compilation. Obfuscation doesn't make reverse engineering impossible, only a little more difficult. > It's perfectly rational. Apple already does this in China. Does what exactly? Remember, the original claim was "Apple can remotely execute any code they want on your phone at any time." > Taking Apple at face value I never said to take Apple at face value. > It will be irrational once we know for certain that Apple doesn't aid spying on their users. Which you claim is impossible to know forever, making your belief totally unfalsifiable. How convenient.

lapcat 3y ago

No, it's not a safe assumption, and it's not clear that you even know what you're talking about, technically. You use terms like "unscrubbed", "unfuzzed", "obfuscated", but what do you think they mean exactly? For example, how does "unfuzzed" relate, if at all, to https://en.wikipedia.org/wiki/Fuzzing https://en.wikipedia.org/wiki/Fuzzing

smoldesu 3y ago
I think the core conclusion is perfectly sound. Apple is a capable company - they would not let the user discover malicious code unless they wanted you to find it. They intend for people to reverse-engineer their systems and run it through IDA, Ghidra and Cutter. Tools exist to mitigate that discoverability, and I think it's foolish to assume they don't use them. The only safe assumption seems to be that they are hiding something. Proving the contrary requires tools we may never have.
- lapcat 3y ago
  > Apple is a capable company - they would not let the user discover malicious code unless they wanted you to find it. Apple is not capable of magic, or the impossible. > Tools exist to mitigate that discoverability Citation needed. > The only safe assumption seems to be that they are hiding something. Proving the contrary requires tools we may never have. You can assume whatever you want, but with no evidence whatsoever, I wouldn't call it "safe", I'd call it "irrational". Also, you didn't answer my question, which suggests that I was right about your not knowing what you were talking about.
  - smoldesu 3y ago
    > Citation needed. There are hundreds of commercial and open methods for obfuscating a program during compilation. Since Apple controls Ring 0 they can also obfuscate syscalls and network traffic if they want. I'd ask you if I'm wrong about this, but you already seem convinced. > You can assume whatever you want, but with no evidence whatsoever, I wouldn't call it "safe", I'd call it "irrational". It's perfectly rational. Apple already does this in China. We know the CIA, FBI and NSA have a common interest in weakening all domestic cryptography. Taking Apple at face value when so many other FAANG companies have been embarrassed by PRISM revelations is a fool's decision. It will be irrational once we know for certain that Apple doesn't aid spying on their users. Until then, I figure I'm a safe skeptic. Pending evidence, both of our claims are equally substantiated. Only the uninvested parties have nothing to lose here, though.
    - dragonwriter 3y ago
      > We know the CIA, FBI and NSA have a common interest in weakening all domestic cryptography. To the extent that the CIA, NSA, or FBI have an interest in weakening cryptography, it applies at least as strongly (more strongly for most of them) to foreign cryptography, so I’d probably drop the modifier “domestic” from that sentence.
      - smoldesu 3y ago
        You're not wrong about that. The history of their interference with domestic corporations is why I add that in, though. They do have an interest in weakening all cryptography, but the ones they're best-suited to compromise are the ones relying on domestic trust.
    - lapcat 3y ago
      > There are hundreds of commercial and open methods for obfuscating a program during compilation. Obfuscation doesn't make reverse engineering impossible, only a little more difficult. > It's perfectly rational. Apple already does this in China. Does what exactly? Remember, the original claim was "Apple can remotely execute any code they want on your phone at any time." > Taking Apple at face value I never said to take Apple at face value. > It will be irrational once we know for certain that Apple doesn't aid spying on their users. Which you claim is impossible to know forever, making your belief totally unfalsifiable. How convenient.