3 ms·

And Apple has a backdoor that only Apple can use. Why don't criminals exploit Apple's backdoor?

catlifeonmars 3y ago
FWIW this is a fair and valid argument. Generally, no one entity should have that much power. Doesn’t really matter if it’s USG or a tech giant.
frickinLasers 3y ago
https://arstechnica.com/security/2023/12/exploit-used-in-mass-iphone-infection-campaign-targeted-secret-hardware-feature/ https://arstechnica.com/security/2023/12/exploit-used-in-mas... Looks like criminals were using it for four years undetected.
quickslowdown 3y ago
Which backdoor do you mean? I'm not an Apple expert by any means, but I thought they encrypted customer data in a way that even they can't get to it? Wasn't that the crux of this case, that Apple couldn't help the FBI due to security measures, prompting the agency to ask for a backdoor?
- 2OEH8eoCRo0 3y ago
  What's an update? They can sign and push any code they want remotely.
  - dataangel 3y ago
    IIRC the question is when the phone is totally locked, e.g. if you turn it off then turn it back on and haven't entered the PIN yet. In this state even apple can't get an update to run, the secure hardware won't do it unless you wipe the phone first. And your data is encrypted until you unlock the phone. In practice though most people are screwed b/c it's all already in icloud.
    - fragmede 3y ago
      with advanced data protection, it's encrypted before it hits iCloud, so apple, nor the feds can't get at it.
catlifeonmars 3y ago
Source/reference? I’m not aware of such a backdoor
- adrian_b 3y ago
  See the posting above about the Arstechnica article. During the last days of 2023 there was a big discussion, also on HN, after it was revealed that all recent Apple devices had a hardware backdoor that allowed bypassing all memory access protections claimed to exist by Apple. It is likely that the backdoor consisted in some cache memory test registers used during production, but it is absolutely incomprehensible how it has been possible for many years that those test registers were not disabled at the end of the manufacturing process but they remained accessible for the attackers who knew Apple's secrets. For instance any iPhone could be completely controlled remotely after sending to it an invisible iMessage message.
  - sylware 3y ago
    "Convenient software/hardware bugs"... but "they are not backdoors, I swear!"
  - rightbyte 3y ago
    Can't Apple just push an software update with some: if (user_id == "adrian_b") pwn (); ?
  - _kbh_ 3y ago
    > It is likely that the backdoor consisted in some cache memory test registers used during production, but it is absolutely incomprehensible how it has been possible for many years that those test registers were not disabled at the end of the manufacturing process but they remained accessible for the attackers who knew Apple's secrets. I think we are nearly certain that the bug is because of a MMIO accessible register that allows you to write into the CPU's cache (its nearly certain this is related to the GPU's coherent L2 cache). But I don't think it's 'incomprehensible' that such a bug could exist unintentionally. Modern computers and even more so high end mobile devices are a huge basket of complexity that has so many interactions and coprocessors all over the place I think it's very likely that a similar bug exists undiscovered unmitigated. > For instance any iPhone could be completely controlled remotely after sending to it an invisible iMessage message. I don't think the iMessage was invisible I think it deleted itself once the exploit had run, its also worth noting just how complicated the attack chain was and that the attacker _needed_ a hardware bug just to patch the kernel whilst having kernel code execution.

FWIW this is a fair and valid argument. Generally, no one entity should have that much power. Doesn’t really matter if it’s USG or a tech giant.

frickinLasers 3y ago

https://arstechnica.com/security/2023/12/exploit-used-in-mass-iphone-infection-campaign-targeted-secret-hardware-feature/ https://arstechnica.com/security/2023/12/exploit-used-in-mas... Looks like criminals were using it for four years undetected.

quickslowdown 3y ago

Which backdoor do you mean? I'm not an Apple expert by any means, but I thought they encrypted customer data in a way that even they can't get to it? Wasn't that the crux of this case, that Apple couldn't help the FBI due to security measures, prompting the agency to ask for a backdoor?

2OEH8eoCRo0 3y ago
What's an update? They can sign and push any code they want remotely.
- dataangel 3y ago
  IIRC the question is when the phone is totally locked, e.g. if you turn it off then turn it back on and haven't entered the PIN yet. In this state even apple can't get an update to run, the secure hardware won't do it unless you wipe the phone first. And your data is encrypted until you unlock the phone. In practice though most people are screwed b/c it's all already in icloud.
  - fragmede 3y ago
    with advanced data protection, it's encrypted before it hits iCloud, so apple, nor the feds can't get at it.

catlifeonmars 3y ago

Source/reference? I’m not aware of such a backdoor

adrian_b 3y ago
See the posting above about the Arstechnica article. During the last days of 2023 there was a big discussion, also on HN, after it was revealed that all recent Apple devices had a hardware backdoor that allowed bypassing all memory access protections claimed to exist by Apple. It is likely that the backdoor consisted in some cache memory test registers used during production, but it is absolutely incomprehensible how it has been possible for many years that those test registers were not disabled at the end of the manufacturing process but they remained accessible for the attackers who knew Apple's secrets. For instance any iPhone could be completely controlled remotely after sending to it an invisible iMessage message.
- sylware 3y ago
  "Convenient software/hardware bugs"... but "they are not backdoors, I swear!"
- rightbyte 3y ago
  Can't Apple just push an software update with some: if (user_id == "adrian_b") pwn (); ?
- _kbh_ 3y ago
  > It is likely that the backdoor consisted in some cache memory test registers used during production, but it is absolutely incomprehensible how it has been possible for many years that those test registers were not disabled at the end of the manufacturing process but they remained accessible for the attackers who knew Apple's secrets. I think we are nearly certain that the bug is because of a MMIO accessible register that allows you to write into the CPU's cache (its nearly certain this is related to the GPU's coherent L2 cache). But I don't think it's 'incomprehensible' that such a bug could exist unintentionally. Modern computers and even more so high end mobile devices are a huge basket of complexity that has so many interactions and coprocessors all over the place I think it's very likely that a similar bug exists undiscovered unmitigated. > For instance any iPhone could be completely controlled remotely after sending to it an invisible iMessage message. I don't think the iMessage was invisible I think it deleted itself once the exploit had run, its also worth noting just how complicated the attack chain was and that the attacker _needed_ a hardware bug just to patch the kernel whilst having kernel code execution.