6 ms·

Why Apple sends spyware victims to this nonprofit security lab

112 points by latexr 2y ago

freehorse 2y ago
This is a very verbose article that does not really engage with the actual question in the title. I still do not understand why apple (and in general big tech it seems?) reroute users to external forensic services instead of doing the forensics themselves. This only thing the article says about it is "they do not want/it is better this way".
- 1123581321 2y ago
  It said that AccessNow is really good at intake, and it wouldn’t be good for Apple to be in the business of inspecting so much personal data. My guess is that if Apple did this themselves, it would be firewalled from most of Apple, so like AccessNow, so hopefully they help fund AccessNow.
  - mktemp-d 2y ago
    The engineering requirements to build a branch of a company with the security needs of specialized SOC would be crazy endeavor and to the point that whatever comes of it would probably look as foreign to the main company's function than what currently exists. Having a separate non-profit agency handle these cases would not only allow for the agency's incentives to align, but also the overall security design approach to its facilities and internal networks. It's a win-win for both private and public interest imo.
    - Maxious 2y ago
      With regards to US politics, there's campaign funding considerations as to how corporations assist candidates https://defendcampaigns.org/donors https://defendcampaigns.org/donors
- dylan604 2y ago
  If you are targeted, presumably, they will be attacking you from every angle they can. If you have other tech besides Apple's, then that's just another attack vector. If Apple did this, they'd be Apple focused leaving many vulns. By this group being not Apple specific, they can be up on all the ways like IoT devices, Android, etc. Based on that, it seems smart for each of the tech players to support the 3rd party solutions
- tptacek 2y ago
  Apple does extensive forensics itself, and spends more on platform and hardware security than all but perhaps? two other companies in the world. By referring people to nonprofit labs, Apple is encouraging information about spyware systems --- which target multiple platforms --- to be widely disseminated, and allows the OSINT process, which Apple has no comparative advantage in running, to work out targeting and sourcing. The norm in high-end platform security practices at companies is to keep cards as close to the vest as possible, revealing information largely in the form of feature-style announcements of security improvements. The norm Apple is setting here is better.
  - newsclues 2y ago
    This is why I read more comments than articles.
  - x0x0 2y ago
    Sorry, I'm dumb. The value here is engaging this NGO to attempt to figure out who is being targeted and why; go public with that; and that's better not coming from Apple?
    - fragmede 2y ago
      The value here is that the NGO would then have information about hacking attempts against victims on Android, iOS, Windows, ChromeOS, and macOS, and could put that combined information to more use than if it were limited to just iOS and macOS users.
- bell-cot 2y ago
  Consider the liabilities, expectations, and political issues if Apple was doing such support work in-house. For the last - Apple has large, profitable operations in a fair number of the countries which might be targeting certain dissidents and journalists. Mr. Cook does not want any "you are aiding our worst enemies..." pushback when he is negotiating with the governments of those places.
- fweimer 2y ago
  It's possible that the vendor has targeted the user as the result of a court order. (Not necessarily by installing a software implant on the device itself, but I suspect often these things are not necessarily as transparent as they should be even if done server-side.) This means there is potential of a conflict of interest here, and deferring to a third party solves that.
- chews 2y ago
  it's to maintain the legality of the arms-length ability to do jailbreaky like thinks when a 3 letter agency asks.
saagarjha 2y ago
> While it may look like Apple is abdicating its responsibility to protect its users After reading the whole thing it still looks like that. After doing all that work to identify who’s been targeted with mercenary spyware why would you want to go to someone else to have them try their best at finding who it was?
- brookst 2y ago
  Agree the article doesn’t answer the question at all. My guess is expertise and scale; if Apple finds five such users a day, that doesn’t support a staff of 100 forensic experts. But if Apple, Facebook, Google, etc, etc, find 500 users a day, that might. But who knows? The article sure doesn’t.
  - nottorp 2y ago
    The real question is: does Apple donate to this nonprofit?
    - chmod775 2y ago
      According to this[1] it looks like Apple is more or less directly funding the helpline, so it's more like Apple is outsourcing the work. Note that I don't think the 2024 table is complete yet. Compared to 2023 there's hardly anything on it. In 2023 you can see that Meta was specifically funding the helpline. Lots of other major tech companies show up too. Though mostly the charity seems to run on European taxpayer money (~60% of its funding). [1] https://www.accessnow.org/financials/ https://www.accessnow.org/financials/
      - nottorp 2y ago
        Looks like Apple has been funding them for at least the past 3 years so this may even be fair. If you're really targeted, "they" will also go for your non Apple devices like your "smart" TV. So you could probably use support to harden all your tech stuff.
illwrks 2y ago
It seems sensible to send people to the appropriate avenue for support, they have no idea how someone has been compromised and by taking ownership it becomes their problem. If someone breaks into your house do you call the builder for help?
- Drakim 2y ago
  > If someone breaks into your house do you call the builder for help? If they constructed and installed the locks, and a weakness in the locks appears to have been the entry point for the break in, then yeah maybe?
  - scosman 2y ago
    And the locks can be remotely patched to remove the weakness... seems fair. Not the builder, but calling the lock maker for sure.
  - exe34 2y ago
    no, you call the police and your insurance company. the insurance company might enquire with the builders on who's at fault. hope that helps.
  - illwrks 2y ago
    There are weaknesses in everything around you. If apple were to be the owner of the issue then what’s to stop apple covering it up? It’s better for a third party to support, track and collate the issues and then for that knowledge to be addressed by Apple, or any other tech company. Apparently quantum computing is around a decade away, when that happens I’ve been told you can say goodbye to all privacy at that point.
  - lupusreal 2y ago
    Damn builders used glass for my windows. Don't they know how easy that is to break?
  - starkrights 2y ago
    Even if you do go to the builder, what are they going to tell you other than “yup. Lock got busted: here, here, and here, you should probably call the <people who investigate break ins for a living>”? I feel like the notification already does exactly that, no? “Hey, your phone looks busted, go call the <people who investigate sophisticated cyber surveillance targeting for a living>.” And from the angle of “yeah you guys installed the locks wrong and they just opened the door, you should fix that”- does anyone reject the idea that the vuln would get reported to Apple, and that they’d be on it like crazy?
throwaway984393 2y ago
[dead]
GeekyBear 2y ago
The big takeaway from this article: > All the experts TechCrunch spoke with strongly recommend turning on Lockdown Mode if you think you may be a target, especially if you are a journalist, human rights defender, or dissident. What does Lockdown Mode do? > When someone enables Lockdown Mode, some Apple apps and services work differently. For example, most attachments and link previews are blocked on iMessage, FaceTime calls from unknown contacts are filtered, location information is removed from shared pictures and certain fonts on websites are prevented from loading. https://techcrunch.com/2023/12/07/apple-says-it-is-not-aware-anyone-using-lockdown-mode-got-hacked/ https://techcrunch.com/2023/12/07/apple-says-it-is-not-aware...
- dave4420 2y ago
  IIRC, it also disables the Javascript jit compiler and configuration profiles.
- deleted 2y ago
  [deleted]
deleted 2y ago
[deleted]
_zagj 2y ago
[flagged]
- octokatt 2y ago
  ?
- latexr 2y ago
  You’re not shadow banned. You’ll probably get this comment flagged, though.
kidneystereotyp 2y ago
[dead]

112 points by latexr 2y ago

This is a very verbose article that does not really engage with the actual question in the title. I still do not understand why apple (and in general big tech it seems?) reroute users to external forensic services instead of doing the forensics themselves. This only thing the article says about it is "they do not want/it is better this way".

1123581321 2y ago
It said that AccessNow is really good at intake, and it wouldn’t be good for Apple to be in the business of inspecting so much personal data. My guess is that if Apple did this themselves, it would be firewalled from most of Apple, so like AccessNow, so hopefully they help fund AccessNow.
- mktemp-d 2y ago
  The engineering requirements to build a branch of a company with the security needs of specialized SOC would be crazy endeavor and to the point that whatever comes of it would probably look as foreign to the main company's function than what currently exists. Having a separate non-profit agency handle these cases would not only allow for the agency's incentives to align, but also the overall security design approach to its facilities and internal networks. It's a win-win for both private and public interest imo.
  - Maxious 2y ago
    With regards to US politics, there's campaign funding considerations as to how corporations assist candidates https://defendcampaigns.org/donors https://defendcampaigns.org/donors
dylan604 2y ago
If you are targeted, presumably, they will be attacking you from every angle they can. If you have other tech besides Apple's, then that's just another attack vector. If Apple did this, they'd be Apple focused leaving many vulns. By this group being not Apple specific, they can be up on all the ways like IoT devices, Android, etc. Based on that, it seems smart for each of the tech players to support the 3rd party solutions
tptacek 2y ago
Apple does extensive forensics itself, and spends more on platform and hardware security than all but perhaps? two other companies in the world. By referring people to nonprofit labs, Apple is encouraging information about spyware systems --- which target multiple platforms --- to be widely disseminated, and allows the OSINT process, which Apple has no comparative advantage in running, to work out targeting and sourcing. The norm in high-end platform security practices at companies is to keep cards as close to the vest as possible, revealing information largely in the form of feature-style announcements of security improvements. The norm Apple is setting here is better.
- newsclues 2y ago
  This is why I read more comments than articles.
- x0x0 2y ago
  Sorry, I'm dumb. The value here is engaging this NGO to attempt to figure out who is being targeted and why; go public with that; and that's better not coming from Apple?
  - fragmede 2y ago
    The value here is that the NGO would then have information about hacking attempts against victims on Android, iOS, Windows, ChromeOS, and macOS, and could put that combined information to more use than if it were limited to just iOS and macOS users.
bell-cot 2y ago
Consider the liabilities, expectations, and political issues if Apple was doing such support work in-house. For the last - Apple has large, profitable operations in a fair number of the countries which might be targeting certain dissidents and journalists. Mr. Cook does not want any "you are aiding our worst enemies..." pushback when he is negotiating with the governments of those places.
fweimer 2y ago
It's possible that the vendor has targeted the user as the result of a court order. (Not necessarily by installing a software implant on the device itself, but I suspect often these things are not necessarily as transparent as they should be even if done server-side.) This means there is potential of a conflict of interest here, and deferring to a third party solves that.
chews 2y ago
it's to maintain the legality of the arms-length ability to do jailbreaky like thinks when a 3 letter agency asks.

saagarjha 2y ago

> While it may look like Apple is abdicating its responsibility to protect its users After reading the whole thing it still looks like that. After doing all that work to identify who’s been targeted with mercenary spyware why would you want to go to someone else to have them try their best at finding who it was?

brookst 2y ago
Agree the article doesn’t answer the question at all. My guess is expertise and scale; if Apple finds five such users a day, that doesn’t support a staff of 100 forensic experts. But if Apple, Facebook, Google, etc, etc, find 500 users a day, that might. But who knows? The article sure doesn’t.
- nottorp 2y ago
  The real question is: does Apple donate to this nonprofit?
  - chmod775 2y ago
    According to this[1] it looks like Apple is more or less directly funding the helpline, so it's more like Apple is outsourcing the work. Note that I don't think the 2024 table is complete yet. Compared to 2023 there's hardly anything on it. In 2023 you can see that Meta was specifically funding the helpline. Lots of other major tech companies show up too. Though mostly the charity seems to run on European taxpayer money (~60% of its funding). [1] https://www.accessnow.org/financials/ https://www.accessnow.org/financials/
    - nottorp 2y ago
      Looks like Apple has been funding them for at least the past 3 years so this may even be fair. If you're really targeted, "they" will also go for your non Apple devices like your "smart" TV. So you could probably use support to harden all your tech stuff.

illwrks 2y ago

It seems sensible to send people to the appropriate avenue for support, they have no idea how someone has been compromised and by taking ownership it becomes their problem. If someone breaks into your house do you call the builder for help?

Drakim 2y ago
> If someone breaks into your house do you call the builder for help? If they constructed and installed the locks, and a weakness in the locks appears to have been the entry point for the break in, then yeah maybe?
- scosman 2y ago
  And the locks can be remotely patched to remove the weakness... seems fair. Not the builder, but calling the lock maker for sure.
- exe34 2y ago
  no, you call the police and your insurance company. the insurance company might enquire with the builders on who's at fault. hope that helps.
- illwrks 2y ago
  There are weaknesses in everything around you. If apple were to be the owner of the issue then what’s to stop apple covering it up? It’s better for a third party to support, track and collate the issues and then for that knowledge to be addressed by Apple, or any other tech company. Apparently quantum computing is around a decade away, when that happens I’ve been told you can say goodbye to all privacy at that point.
- lupusreal 2y ago
  Damn builders used glass for my windows. Don't they know how easy that is to break?
- starkrights 2y ago
  Even if you do go to the builder, what are they going to tell you other than “yup. Lock got busted: here, here, and here, you should probably call the <people who investigate break ins for a living>”? I feel like the notification already does exactly that, no? “Hey, your phone looks busted, go call the <people who investigate sophisticated cyber surveillance targeting for a living>.” And from the angle of “yeah you guys installed the locks wrong and they just opened the door, you should fix that”- does anyone reject the idea that the vuln would get reported to Apple, and that they’d be on it like crazy?

throwaway984393 2y ago

[dead]

GeekyBear 2y ago

The big takeaway from this article: > All the experts TechCrunch spoke with strongly recommend turning on Lockdown Mode if you think you may be a target, especially if you are a journalist, human rights defender, or dissident. What does Lockdown Mode do? > When someone enables Lockdown Mode, some Apple apps and services work differently. For example, most attachments and link previews are blocked on iMessage, FaceTime calls from unknown contacts are filtered, location information is removed from shared pictures and certain fonts on websites are prevented from loading. https://techcrunch.com/2023/12/07/apple-says-it-is-not-aware-anyone-using-lockdown-mode-got-hacked/ https://techcrunch.com/2023/12/07/apple-says-it-is-not-aware...

dave4420 2y ago
IIRC, it also disables the Javascript jit compiler and configuration profiles.
deleted 2y ago
[deleted]

deleted 2y ago

[deleted]

_zagj 2y ago

[flagged]

octokatt 2y ago
?
latexr 2y ago
You’re not shadow banned. You’ll probably get this comment flagged, though.

kidneystereotyp 2y ago

[dead]