5 ms·
Kaspersky finds hardware backdoor in 5 generations of Apple Silicon (2024)
- derelicta 2y agoSmells like CIA stuff. Impressive.
- deleted 2y ago[deleted]
- pvg 2y agoThread at the time https://news.ycombinator.com/item?id=38783112 https://news.ycombinator.com/item?id=38783112
- tomku 2y agoThat thread also has the benefit of using the original source article from Kaspersky, which is worth a read. This blog post notably disagrees with Kaspersky's own conclusions about whether it's an intentional backdoor, instead citing Steve Gibson, who has clearly learned nothing from his previous "WMF backdoor" debacle.
- post-it 2y agoThis is a year old, does anyone have an article with updates?
- andrewinardeer 2y agohttps://nvd.nist.gov/vuln/detail/cve-2023-38606 https://nvd.nist.gov/vuln/detail/cve-2023-38606
- daghamm 2y agoCompared to other CVEs, the description for this one looks very different. Does anyone know why it reads so apologetic?
- halJordan 2y agoNo updates because its just a dude freaking out about his incredible jump to conclusions. The bug was fixed and everyone kept living their lives
- beardyw 2y agoWow, this is terrible.
- deleted 2y ago[deleted]
- Qem 2y agoI wonder if something like this is behind the push from Microsoft to obsolete a lot of hardware with the windows 11 release. The NSA pushed them to require a hardware upgrade so people replace devices bearing old processors with new ones featuring the latest bleeding-edge backdoors.
- deleted 2y ago[deleted]
- pvg 2y agoWhat if your comment is a part of a psyop to keep paranoid people (NSA's true target) on their old devices which are even easier to breach?
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- londons_explore 2y agoI do notice that a lot of enemies of the state seem to use poorly secured platforms. Everything from Hamas using pagers to widespread use of unencrypted telegram groups and discord, and the ANOM sting with a non-e2e app. Yet platforms with apparently secure e2e messaging (ie. WhatsApp) never seem to be used by criminals. I wonder if this is just selection bias in the criminals caught, or if there is some forcing factor persuading criminals to make poor security choices.
- hulitu 2y ago> Yet platforms with apparently secure e2e messaging (ie. WhatsApp) Do you have the keys to your WhatsApp messages ? Are you sure that they only reach their intended recipient ?
- londons_explore 2y ago
- markus_zhang 2y agoI read the original Kaspersky analysis and found it very weird that such a cyber security company that works with the Russian government closely allows US made phones accessing their networks as late as 2023 Dec.
- Barrin92 2y ago>that works with the Russian government closely There's never been any real and substantial evidence for this and much to the contrary. They've moved a lot of their infra out of Russia and have for ages been early on malware that originated from Russia and allies. It's one of those things that if American media writes about it long enough people somehow just assume its true.
- markus_zhang 2y agoBe it may the case, I highly suspect that is the case by looking at the efforts the other party spent to make it work. Multiple zero days plus maybe some pulling strings in Apple.
- londons_explore 2y agoYour options are iPhone or Android if you want a reasonably usable phone in 2025. And iPhone is considerably more secure than Android against both script kiddies and nation state attackers.
- daft_pink 2y agoCorrection, non-US nation state attackers. (this comment is mostly a sarcastic joke)
- markus_zhang 2y agoIf they really need the security, considering how the other party spent such trouble to hack their phones, this is probably true, then they should not allow any smart phone into the facility. This has been done many times before by other companies. Huawei used to do a lot of closed door development -- every one of the team lives in a hotel for a few months without phones and cannot get out. If your adversary burnt so many zero days and maybe also pulled some strings to hack you, you absolutely should do this.
- Synaesthesia 2y agoAccording to this blog it has been patched. But it really does open up the question of how much do we trust Apple, Google and other large tech companies.
- Bluescreenbuddy 2y agoRead the blog date. It's over a year old. This is old news.
- Synaesthesia 2y agoOld news or not, the fact that my hardware could have backdoors in it concerns me, and I use a Pixel phone. These things are the ideal spying devices.
- LorenPechtel 2y agoYeah, if the good guys have a backdoor sooner or later the bad guys will also.
- hulitu 2y agoMaybe not everybody is so stupid like "the good guys". /s
- timbo1642 2y ago[dead]
- daft_pink 2y agoYou have to wonder if the only reason the iPhone 16 isn’t included in this article, is because the article was written before the iPhone 16 existed.
- CharlesW 2y agoIt's because Apple fixed the issue on all affected devices with OS updates released in July 2023.
- londons_explore 2y agoHas anyone disassembled that update to figure out how they patched this? If it is some device sitting on the memory bus, how did they disable it in a way it couldn't be reenabled by the OS kernel? Most hardware that sits on a CPU bus doesn't have such an ability.
- tomku 2y agoThe iPhone 16 shipped with iOS 18. The vulnerability in question (CVE 2023-38606) was patched with iOS 16.6 released in July 2023, months before Kaspersky's write-up that prompted this blog post. There, now you don't have to wonder any more.
- daft_pink 2y agoThanks for making this more clear. This is the problem with reading old posts.
- rincebrain 2y agoI always assumed, not having worked at Apple, but from the observed functionality and the fact that they could patch it, that this was a debug backdoor that didn't get killswitched before release builds and then they decided it would draw attention to it if they killed it after the fact.
- ryao 2y agoAnyone who is paranoid about hardware backdoors might enjoy this: https://www.contrib.andrew.cmu.edu/~somlo/BTCP/ https://www.contrib.andrew.cmu.edu/~somlo/BTCP/
- markus_zhang 2y agoThanks for sharing. But I think there are easier solutions if one works for sensitive projects such as an Apple hardware designer or a Google Android kernel programmer: 1. Complete separation of work and personal computers and cellphones. 2. Company cellphones only stay in the facility and are checked for vulnerabilities from time to time. 3. No bragging in public about your project or messing with other women/men other than one's own partner, so one does not expose personal vulnerabilities.