5 ms·

Someone has the signing keys for Apple os/apps, baseband drivers, oma-dm toolkits, etc. Whoever that is can sign whatever they want, send an update notificatio

by lrvick 3y ago

Someone has the signing keys for Apple os/apps, baseband drivers, oma-dm toolkits, etc. Whoever that is can sign whatever they want, send an update notification targeting a single user, and the phone will then execute anything as instructed. A court order could tell whoever holds those signing keys to sign something to decrypt all messages, or install a dummy encryption key, or make the random number generator always return 42. Just because Apple has successfully gaslighted the courts by claiming they cannot decrypt phones, does not make it true. Supply chain attacks on a proprietary system lacking reproducible builds and public accountability is indistinguishable from remote code execution as a service.

lapcat 3y ago
> Whoever that is can sign whatever they want, send an update notification targeting a single user, and the phone will then execute anything as instructed. That wasn't the claim. The claim was "Apple can remotely execute any code they want on your phone at any time." In other words, Apple can do it right now, on your phone, without any software update. And there's zero evidence for this claim. Software updates are not remote code execution. Moreover, users can choose not to install software updates.
- sneak 3y ago
  > Software updates are not remote code execution. Moreover, users can choose not to install software updates. However, automatic software updates are, as Solarwinds learned, and this is on by default on iOS, meaning that Apple can indeed execute code on all iPhones in the default configuration without user intervention.
- lrvick 3y ago
  Executing code remotely via default-enabled automatic updates with some delay, or via an ssh command with less delay, the result is the same. Someone chooses to run code on your client, and it runs. The semantics do not impact the threat model here so who cares?
  - lapcat 3y ago
    As I already said, "users can choose not to install software updates". So no, Apple can't "remotely" execute any code they want on your phone at any time, when you've made the simple, easy choice to change your Settings. This is not just "semantics". This discussion is getting pretty tiresome to me. You and sneak want to redefine all software updates as "remote code execution". That's complete BS IMO, and I'm never going to agree to that redefinition.
    - lrvick 3y ago
      If you fail to apply updates, then you fail to apply actual security patches to stop RCEs -anyone- can use. In exchange you agree to allow apple to execute any code they, or anyone coercing the key holders, want. You can play semantic games, but the end result is the same under a threat model that does not trust any single entity to run code of their choosing on your device. A supply chain attack is the correct term for this, but a supply chain attack is, in effect, and RCE path available to anyone in the supply chain. Saying supply chain attacks are not a form of RCE because you can disable software updates is like saying no RCEs exist because you have the choice to disconnect from the internet. Security discussions should be grounded in threat models over semantics.
      - lapcat 3y ago
        > Security discussions should be grounded in threat models over semantics. There's no evidence that Apple is a threat. You claimed that Apple could already remotely execute any code at any time. That sounded very sinister, as if Apple had added a secret back door to the OS, but it was extremely misleading at best, completely false at worst. Yes, Apple can ship software updates, as we all know. But that's not a threat in itself. I don't want to hear what Apple could theoretically do. Your lover could theoretically kill you while you sleep. How's that for a threat model? Are you going to sleep alone for the rest of your life? I suspect it's actually more likely, though, than Apple shipping the malicious OS update that you fear.
sneak 3y ago
> A court order could tell whoever holds those signing keys to sign something to decrypt all messages No, I'm not a lawyer but my understanding is that this is compelled speech and is not permissible.
- lrvick 3y ago
  You do not have to incriminate yourself under US law, but corporate property is not the same as personal property. The NSA very likely could compel Apple to give up their signing keys if it came with an executive order citing national defense objectives... or more probably they will just manipulate the RNGs of the HSMs Apple uses, or get a special contract with their supplier, or bribe a release engineer. I know people who have been party to such arrangements first hand. Any system that relies on a single private key with SPOFs in the supply chain should be considered compromised, if the targets it governs are high value. The CCP did not need to do anything cloak and dagger and simply mandated overt access to Apples HSMs for chinese users.

by lrvick 3y ago

lapcat 3y ago

> Whoever that is can sign whatever they want, send an update notification targeting a single user, and the phone will then execute anything as instructed. That wasn't the claim. The claim was "Apple can remotely execute any code they want on your phone at any time." In other words, Apple can do it right now, on your phone, without any software update. And there's zero evidence for this claim. Software updates are not remote code execution. Moreover, users can choose not to install software updates.

sneak 3y ago
> Software updates are not remote code execution. Moreover, users can choose not to install software updates. However, automatic software updates are, as Solarwinds learned, and this is on by default on iOS, meaning that Apple can indeed execute code on all iPhones in the default configuration without user intervention.
lrvick 3y ago
Executing code remotely via default-enabled automatic updates with some delay, or via an ssh command with less delay, the result is the same. Someone chooses to run code on your client, and it runs. The semantics do not impact the threat model here so who cares?
- lapcat 3y ago
  As I already said, "users can choose not to install software updates". So no, Apple can't "remotely" execute any code they want on your phone at any time, when you've made the simple, easy choice to change your Settings. This is not just "semantics". This discussion is getting pretty tiresome to me. You and sneak want to redefine all software updates as "remote code execution". That's complete BS IMO, and I'm never going to agree to that redefinition.
  - lrvick 3y ago
    If you fail to apply updates, then you fail to apply actual security patches to stop RCEs -anyone- can use. In exchange you agree to allow apple to execute any code they, or anyone coercing the key holders, want. You can play semantic games, but the end result is the same under a threat model that does not trust any single entity to run code of their choosing on your device. A supply chain attack is the correct term for this, but a supply chain attack is, in effect, and RCE path available to anyone in the supply chain. Saying supply chain attacks are not a form of RCE because you can disable software updates is like saying no RCEs exist because you have the choice to disconnect from the internet. Security discussions should be grounded in threat models over semantics.
    - lapcat 3y ago
      > Security discussions should be grounded in threat models over semantics. There's no evidence that Apple is a threat. You claimed that Apple could already remotely execute any code at any time. That sounded very sinister, as if Apple had added a secret back door to the OS, but it was extremely misleading at best, completely false at worst. Yes, Apple can ship software updates, as we all know. But that's not a threat in itself. I don't want to hear what Apple could theoretically do. Your lover could theoretically kill you while you sleep. How's that for a threat model? Are you going to sleep alone for the rest of your life? I suspect it's actually more likely, though, than Apple shipping the malicious OS update that you fear.

sneak 3y ago

> A court order could tell whoever holds those signing keys to sign something to decrypt all messages No, I'm not a lawyer but my understanding is that this is compelled speech and is not permissible.

lrvick 3y ago
You do not have to incriminate yourself under US law, but corporate property is not the same as personal property. The NSA very likely could compel Apple to give up their signing keys if it came with an executive order citing national defense objectives... or more probably they will just manipulate the RNGs of the HSMs Apple uses, or get a special contract with their supplier, or bribe a release engineer. I know people who have been party to such arrangements first hand. Any system that relies on a single private key with SPOFs in the supply chain should be considered compromised, if the targets it governs are high value. The CCP did not need to do anything cloak and dagger and simply mandated overt access to Apples HSMs for chinese users.