6 ms·
Possible US Government iPhone-Hacking Toolkit in foreign spy and criminal hands
- theearling 8mo ago[flagged]
- theearling 8mo agolol at all the downvotes, proves my point
- kvuj 8mo agoI think the downvotes come from the friction of the language used and the lack of sources to back the claim. If you linked some stories, it would add some weight to the statement.
- seanw444 8mo agoHow many people on this site are unaware of the amount of times the government's courts have found its executive, legislative, (and lower judicial) branches acting without authority? How many people on this site are unaware of the extent to which we are monitored? And openly? We have an entire agency whose primary task is to mass surveil.
- ranger_danger 8mo agoI think all the things are true at the same time... that most people already believe it, they don't need sources in this instance, but they still don't like the way the comment was worded.
- pak9rabid 8mo agoHave we already forgotten about Edward Snowden & the NSA?
- thewebguyd 8mo agoUnfortunately, I think that's likely the case for anyone on the younger side. Most of that came to light in 2013, 13 years ago. Anyone 20-30 years old today would've been a teenager then in high school, and likely not paying attention very closely. It was big news for a little bit, and then the media by design quickly forgot about it barely a year later, and that is why history is doomed to repeat.
- hulitu 8mo agoNo, but there are a lot of employees of 3 letter agencies in here and they don't like the noise.
- jjtheblunt 8mo agoyou're just on a technical site, so readers want citations for conjectures, because the readers generally and genuinely want to learn more edit: sibling comment agrees
- chucklenorris 8mo agoheh, saying hitler was a war criminal requires citations?
- theearling 8mo agoI guess the technical side is for the bots to find holes in my argument. Anyone with a brain in tech that knows of the US and it's invasion into privacy knows that the US having an iOS "Hacking Toolkit" is nightmare fuel. I already assumed it did, just glad Wired put it down on paper for the rest of us. Writing an article that "it's escaped the hands of the US government and into the hands of foreign hands" doesn't change my opinion of the abuse of power. Citation: Edward Snowden - Present Day (Flock, etc)
- oxfeed65261 8mo agohttps://archive.ph/r7jGc https://archive.ph/r7jGc
- doctorpangloss 8mo agothe government doesn't have superpowerful code crackers though it has a guy working at apple who introduces the subtle vulnerability he is instructed to do
- tptacek 8mo agoI expect the evidence for this claim is axiomatic, which is to say that you think it sounds good.
- lightedman 8mo agoNo, anyone who remembers the Best Buy/FBI debacle knows that this statement is very well-grounded in reality. If you took your laptop to Best Buy for repairs, the FBI got a copy of your hard drive contents.
- majorchord 8mo agoSource:
- 1xdevnet 8mo agohttps://www.cbsnews.com/sanfrancisco/news/fbi-best-buy-geek-squad/ https://www.cbsnews.com/sanfrancisco/news/fbi-best-buy-geek-... https://www.foxnews.com/tech/the-fbi-paid-geek-squad-employees-as-informants https://www.foxnews.com/tech/the-fbi-paid-geek-squad-employe... https://www.eff.org/cases/fbi-geek-squad-informants-foia-suit https://www.eff.org/cases/fbi-geek-squad-informants-foia-sui... https://www.washingtonpost.com/local/public-safety/if-a-best-buy-technician-is-a-paid-fbi-informant-are-his-computer-searches-legal/2017/01/09/f56028b4-d442-11e6-9cb0-54ab630851e8_story.html https://www.washingtonpost.com/local/public-safety/if-a-best...
- majorchord 8mo agoI read the filings. Nowhere in that entire case does anyone allege that the FBI was regularly being sent entire copies of the hard drive contents of best buy customers. The FBI merely taught workers how to identify and report CSAM. There is nothing illegal about that. EFF only sued because their FOIA request for info about their training process was denied, and after the FBI argued why they shouldn't grant the request, EFF agreed and backed down. Not only did the EFF agree to dismiss the case, their blog post claim of a supposed Fourth Amendment violation was never even argued in any of their filings at all. In my opinion, to construe a simple disagreement/misunderstanding over a FOIA request denial (which was proven as legal and justified) as "If you took your laptop to Best Buy for repairs, the FBI got a copy of your hard drive contents"... is patently and demonstrably false, and does not make any sense whatsoever.
- mentalgear 8mo agoHow could something as sensitive get out of an administration as competent as the current one? At least they have no access to lets say AI or autonomous weapons and the tools of mass surveillance ...
- grosswait 8mo ago[flagged]
- happyopossum 8mo ago"Possible" stripped from the headline on HN. That word seems particularly important given that it's speculative: "Clues suggest it was originally built for the US government."
- dang 8mo agoThe title limit is 80 chars, if anyone wants to figure out a decent way to squeeze possibility back in there.
- alwa 8mo ago“Possible US-Gov-made iPhone-hacking toolkit is now in foreign and criminal hands“ ?
- dang 8mo agoWe try to avoid abbreviations if possible. You spurred me to take another crack at it and I think it worked this time? Happy to edit again if not...
- irishcoffee 8mo agoA US Govt iPhone-hacking suite is now possibly in criminal hands 15 chars to spare!
- dang 8mo agoI think the "possibly" is supposed to mean "possibly produced by the US government"
- irishcoffee 8mo agoGood point.
- deleted 8mo ago[deleted]
- 8mo ago
- everdrive 8mo agoNo matter the risk, I must carry my smartphone everywhere and install every app. It would be unimaginable to have the urge to look something up, but then wait to do it later until I'm using a real computer. No negative outcome will EVER shake my deep, permanent need to carry a smartphone all the time and use it for as much as possible.
- theearling 8mo agoWebapps exist for a reason, they don't get all the special permissions apps get when fully installed. at the very least use a VPN / more secure phone like a pixel with graphene You keep doing you though
- thewebguyd 8mo agoIronically, the exploits in this leaked kit all involved flaws in webkit, so you'd have been safer sticking to native apps assuming they didn't have any webviews in them to load the malicious site.
- SpaceManNabs 8mo agoWebView is the worst experience I have on any smart phone or mobile app. The fact that there is no option so that any webview by default opens in safari across all app in ios is horrible. i am not surprised it is riddled with security holes.
- thesuitonym 8mo agoA VPN won't help you if your device is compromised. A VPN won't help you if the server is compromised. A VPN won't help you if the VPN is compromised. I really wish people would understand that VPNs are not magical, unbreakable security. VPNs are barely security at all, and commercial VPNs even less so.
- theearling 8mo agooh 100% agree here, I was just confused at the OP comments evangelism of installing and keeping his phone on his for those quick fix google searches
- stock_toaster 8mo agoWith this administration? Color me unsurprised.
- auslegung 8mo ago> In total, Coruna takes advantage of 23 distinct vulnerabilities in iOS, a rare collection of hacking components that suggests it was created by a well-resourced, likely state-sponsored group of hackers. People have been hacking iOS since before it was called iOS and they weren't necessarily "well-resourced, likely state-sponsored". See geohot
- jesse_dot_id 8mo agoIt seems as though you can basically do anything in this administration if the money is right, so selling state secrets free of punishment sounds about right to me.
- butILoveLife 8mo agoHierarchies can punish this. Note that the legislature and judicial branches exert their power. Epstein files got released if you need proof. (However, if we are International Systems Realists, there are inevitable effects that happen. I have a feeling even Biden/Harris would be in Iran right now.)
- dlev_pika 8mo agoSome got released, and in the way the Executive wanted them to be. This proves the opposite IMO - while the Legislative is co-opted, the Judicial branch has shown it is quite inadequate exerting control or punishment of the Executive.
- alwillis 8mo ago> I have a feeling even Biden/Harris would be in Iran right now. I seriously doubt that; certainly not under the current circumstances of rising inflation with negative economic growth.
- King-Aaron 8mo agoThe rule of law does appear to be dead, instead it's a protection racket system in the US these days.
- AngryData 8mo agoIt has been for decades now, they are just open and blatant now because the corruption is so deep rooted that there is little average people can do except choose to burn down the house around themselves.
- 8mo ago
- butILoveLife 8mo agoMeanwhile last time I checked, Android bug bounty is higher. iPhone makes you an easy target. Sorry Besos, security through obscurity was a bad idea... but you should have known better.
- cluckindan 8mo agoSorry who?
- dlev_pika 8mo agoBinders with classified information were hosted in a bathroom at a country club, so…you know…
- varispeed 8mo agoWhenever I point out that Apple's "security by obscurity" strategy is a complete failure I get downvotes. Person suspecting their iPhone has been hacked has no way to check it. Apple only offer cope mechanism in form of "lockdown mode", which likely can be bypassed just as well. This situation shows that Apple devices are not secure and liability. They'll likely protect your grandma from getting low effort malware, but if you are a CEO - buy something else.
- tptacek 8mo agoWhat do you mean by "security by obscurity"? What's your comparand that doesn't have the same software defects iPhone-targeting CNE is exploiting?
- varispeed 8mo agoOne for instance is that Apple doesn't offer an API for deep system scanning. So if your phone is infected, you have no way of knowing this, because there is no software that can scan it. You cannot trust it. Or things like Memory Tagging Extension (MTE) Apple has implemented, but they have not released specification and implementation details, so you don't know if it has backdoors.
- EPWN3D 8mo agoI don't think you know what security by obscurity is.
- alwillis 8mo agoHe sure doesn’t.
- alwillis 8mo ago> So if your phone is infected, you have no way of knowing this, because there is no software that can scan it. You cannot trust it. Not true. There are commercial apps that can scan your iPhone for vulnerabilities and exploits [1]. Apple goes through ridiculous lengths regarding security on their platforms [2]. > Memory Tagging Extension (MTE) Apple has implemented, but they have not released the specification. It's based on the Memory Tagging Extension (MTE) added to the ARMv8.5 architecture in 2019, co-designed by ARM and Google [3]. MTE support has recently been added to Android 12+ and some Linux distros like recent Fedora and Ubuntu 24.04. Apple's Memory Integrity Enforcement (MIE) is based on MTE. Now that Apple designs its own ARM-based processors, they used MTE as a starting point for Apple Silicon. The iPhone 17 series and the iPhone Air shipped with MIE enabled in September. The point of these technologies is to enable software that hasn't been written in memory-safe languages (many millions of lines of C, C++, etc. that will never be rewritten) to run safely. Although it's starting to change, the vast majority of the rendering engines used by Safari, Chrome, and Firefox are written in C/C++; so it makes sense to address potential browser vulnerabilities at the hardware level. [1]: https://iverify.io/products/enterprise-protection https://iverify.io/products/enterprise-protection [2]: https://support.apple.com/guide/security/toc https://support.apple.com/guide/security/toc [3]: https://www.usenix.org/system/files/login/articles/login_summer19_03_serebryany.pdf https://www.usenix.org/system/files/login/articles/login_sum...
- zem 8mo ago[flagged]
- shell0x 8mo agoTrump ruined America's reputation forever imho. He keeps changing his mind every day and keeps talking bullshit. At this point the trashy drug dealer trying to sell to school kids is more reputable than the USA
- mindslight 8mo agoNo, Trump did not ruin America's reputation. No matter how many billions he steals, how many kids he rapes, how many Americans his terror squads execute, one man cannot ruin America's reputation. What has ruined America's reputation is all of the people continuing to support and enable this sick man - from the politicians and surveillance industry titans who are in on the con, to the grassroots supporters who won't set aside their (understandable!) grievances and would rather see our country destroyed. That is who has ruined America's reputation.
- aa-jv 8mo agoAmericas reputation was ruined by decades of war crimes, crimes against humanity, and violations of human rights at massive scales - and the American peoples' utter inability to reign in their own very, very real war criminals. Trump is just one in a long, long line of American war criminals who should long ago have faced justice in The Hague. Americans can't understand this because Americans hate being embarrassed by their states' misdeeds, but its very real. The rest of the world sees the crimes, even if American's are too cowardly to also do so ..
- mindslight 8mo agoBut was it really, though? Don't get me wrong - I've long shared your condemnations, even as an American! Although for us who acknowledge them, I wouldn't say it's "too cowardly" - rather we're quite disenfranchised and the cognitive dissonance tendency is for Americans to see the government as something apart from themselves. So it's more like that I can't practically do much about these criminals acting in my name. But I mean, the global community basically gave a Nobel Peace Prize to Obama for not being Bush. I'd say the relationships got patched up pretty quickly there. Global domestic surveillance? So nice for the US to take the heat for FVEY et al. If anything starting a war in Iran is back to business as usual, with (the leadership of) most countries seemingly giving a tacit green light.
- markus_zhang 8mo agoMany components of Coruna have never been seen before, he points out, and the whole toolkit appears to have been created by a “single author,” as he puts it. I wonder who wrote it. Must be someone really good at it. Someone who might never give a talk in a conference.
- simulator5g 8mo ago“The Coruna Virus”. Nice.
- testaburger 8mo agodoes tahoe 26.3 protect against this?
- LastMuel 8mo ago> Google notes that Apple patched vulnerabilities used by Coruna in the latest versions of its mobile operating system, iOS 26, so its exploitation techniques are only confirmed to work against iOS 13 through 17.2.1.
- testaburger 8mo agothanks! sorry I meant to say IOS 26.3
- alwillis 8mo ago> does tahoe 26.3 protect against this? Apparently if you have Lockdown mode enabled, then yes.
- Obscurity4340 8mo ago> Google also notes that Coruna checks if an iOS devices has Apple's most stringent security setting, known as Lockdown Mode, enabled, and doesn’t attempt to hack it if so.
- nameconflicts 8mo agoSo, under which government was this hacking toolkit developed?
- Kiboneu 8mo ago> Google also notes that Coruna checks if an iOS devices has Apple's most stringent security setting, known as Lockdown Mode, enabled, and doesn’t attempt to hack it if so. :)
- MarkFields 8mo ago[dead]
- hulitu 8mo ago> US Government iPhone-Hacking Toolkit in foreign spy and criminal hands Why repeat yourself ? (US Government, criminal hands)