5 ms·

Apple's statement: "Apple has never worked with the NSA to create a backdoor in any of our products, including iPhone. Additionally, we have been unaware of th

Apple's statement: "Apple has never worked with the NSA to create a backdoor in any of our products, including iPhone. Additionally, we have been unaware of this alleged NSA program targeting our products. We care deeply about our customers’ privacy and security. Our team is continuously working to make our products even more secure, and we make it easy for customers to keep their software up to date with the latest advancements. Whenever we hear about attempts to undermine Apple’s industry-leading security, we thoroughly investigate and take appropriate steps to protect our customers. We will continue to use our resources to stay ahead of malicious hackers and defend our customers from security attacks, regardless of who’s behind them." Not that it will convince anyone around here, but at least they can be called liars if any evidence did turn up.

Touche 13y ago
It's interesting to say the least. If they are to be believed, what accounts for the NSA's claim of "100% success" with iPhones? Or is that just empty posturing?
- bananacurve 13y ago
  100% success if you have physical access. You certainly do not need to be the NSA for that.
- travisp 13y ago
  I can't find the exact "100% success" quote to put it into context, but for one thing, it's a six-plus year old document. It's possible that they had an exploit at the time. An exploit doesn't require Apple's cooperation. The document also doesn't claim this success remotely (only "A remote installation capability will be pursued for a future release", which really gives no clue as to how possible that was or is). We've always known that pretty much any mobile device can be vulnerable with physical access (that's what "jailbreaking" you phone is doing).
- astral303 13y ago
  Given that almost all early iPhone OS and iPhone have bugs and vulns that allow jailbreaks and carrier unlocks, it's completely unsurprising that the NSA had a 100% success physically. For example, iPhone 3GS released in 2009 can be jailbroken with 2010-era latest iOS 4: http://www.iclarified.com/jailbreak/iphone3gs/mac.php?firmware=4.3.5 http://www.iclarified.com/jailbreak/iphone3gs/mac.php?firmwa... I don't think you even need baseband access to do all the spying. I think all of that can be done on a jailbreak.
cracell 13y ago
One thing to take note of is that they specifically deny working with the NSA. They could very well be working with a contractor or another US government organization and not be lying. Not saying that they necessarily are. Based on what I've read about the NSA I think it's very plausible that the NSA both has a backdoor from Apple, one from the baseband software (http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone http://www.osnews.com/story/27416/The_second_operating_syste...), as well as a several hacks they've developed on their own. Their strategy is not a single path but rather as many attack vectors as possible.
- sigzero 13y ago
  Anything is plausible when there are no facts to show right? We have a document from 2007 and Apples denial. That is it.
streetnigga 13y ago
This is like RSA saying they had no secret contract to create a crypto backdoor. Really finely phrased, doesn't actually say much. Apple most likely wouldn't work directly with the NSA but with an entity like the FBI. The contract wouldn't be with the FBI but with a company also contracted out to do some of the work like Booz Allen Hamilton. I'm started to wonder who "we" actually means in these responses as well. Is this the stock-holder we, the CEO we, or we as in employees of Apple as a whole. I suspect it is not the latter one. We still don't know the point of entry for this malware and I have no more reason to suspect it is done by the shipping carriers than I have reason suspect the hardware makers themselves.
- mrobot 13y ago
  Where are people suspecting the shipping carriers?
  - dobbsbob 13y ago
    The NSA's recommended guide for creating a secure phone (fishbowl) lists supply chain compromise as a threat. Probably because they themselves manage to infiltrate manufacturing and distribution
corresation 13y ago
Isn't this very similar to earlier claims about the NSA seeing Google's data? Many believed that Google was doing the NSA's bidding. Many others felt that only the polar opposite could be true: That Google rejected the NSA's pleas and thus the data couldn't be seen. It seems to have turned out that fact was somewhere in between -- Google was an involuntary partner, but the NSA could monitor virtually all of their data via the data center to data center links. The same thing could be happening at Apple (or any business): They have all the best intentions in the world and want to build the most secure product they can, but there is a extrajudicial foe that answers to essentially no one.
- malandrew 13y ago
  Yeah, but we still don't know if anyone in Google provided aid. So long as National Security Letters exist, there will always be the possibility that an employee or business unit has been complicit without anyone who can speak for the company ever finding out.
  - corresation 13y ago
    Google explicitly denied voluntarily cooperating or working with the NSA in such a manner. While their denial was picked apart (just as the Apple one is, everyone declaring exclusions and perceived disclaimers), Google's statement effectively eliminated the possibility of an NSL silencing them. An NSL bars you from talking about something, but can't compel you to publicly lie (nor do I think a company with the might and influence of Google be bullied too easily). Of course this is all talking about Google as a corporation voluntarily doing something. Was someone in Google (or Apple or any other company) working on behalf of the NSA? There was early debates about whether that could even be legal, but at this point it seems that "anything goes" is the pattern, so possibly.
    - hindsightbias 13y ago
      There's absolutely nothing stopping the NSA/CIA from hiring a foreign national to work on their behalf, just like the DGSE could pay an American national in Palo Alto. Whether those employees could operate domestically w/o breaking the laws of their spymaster, maybe not. It's sorta telling to me that Google decided to go encryption on all intra-data after Snowden. No doubt they would have been briefed by agencies that they cooperate with about what the exposures would be. It's more likely that whatever chipsets common across smartphones or routers is the point of exploit. So the NSA and Samsung or whomever have to have a private agreement. Apple/Google don't have a need to know, but you think a few engineers might be curious.
adrianh 13y ago
"Apple has never worked with the NSA to create a backdoor in any of our products, including iPhone." WIGGLE ROOM ALERT: Apple might have worked with government contractors, just not the NSA directly. "Additionally, we have been unaware of this alleged NSA program targeting our products. We care deeply about our customers’ privacy and security." WIGGLE ROOM ALERT: They could very well be unaware of this program -- but aware of another program that hasn't been disclosed yet. For more on sneaky talk, read this fantastic Atlantic piece that dissects deliberately misleading statements by NSA officials: http://www.theatlantic.com/politics/archive/2013/12/how-americans-were-deceived-about-cell-phone-location-data/282239/ http://www.theatlantic.com/politics/archive/2013/12/how-amer... One key strategy they've had: they consistently deny specific programs, as opposed to general actions.
- sigzero 13y ago
  Give me a break.
eyeareque 13y ago
Think about what the NSA really did here in 2008. Apple didn't need to help the NSA do this. Here's why: The NSA exploited a bug in the iPhone in the same way that the jailbreak community has been doing since the iPhone came out in 2007. The only difference is that the NSA installed malware where as the jailbreak apps install Cydia. Remember jailbreakme.com? That is a browser based root vulnerability. Find an exploit in the iPhone's mail, sms, browser, or any other app, and you could too install malware. Of course this is not easy with the security of the iPhone, but with NSA like resources there is no such thing as bulletproof security.
- fit2rule 13y ago
  Plot-twist: the NSA is the jailbreaking community.

Touche 13y ago

It's interesting to say the least. If they are to be believed, what accounts for the NSA's claim of "100% success" with iPhones? Or is that just empty posturing?

bananacurve 13y ago
100% success if you have physical access. You certainly do not need to be the NSA for that.
travisp 13y ago
I can't find the exact "100% success" quote to put it into context, but for one thing, it's a six-plus year old document. It's possible that they had an exploit at the time. An exploit doesn't require Apple's cooperation. The document also doesn't claim this success remotely (only "A remote installation capability will be pursued for a future release", which really gives no clue as to how possible that was or is). We've always known that pretty much any mobile device can be vulnerable with physical access (that's what "jailbreaking" you phone is doing).
astral303 13y ago
Given that almost all early iPhone OS and iPhone have bugs and vulns that allow jailbreaks and carrier unlocks, it's completely unsurprising that the NSA had a 100% success physically. For example, iPhone 3GS released in 2009 can be jailbroken with 2010-era latest iOS 4: http://www.iclarified.com/jailbreak/iphone3gs/mac.php?firmware=4.3.5 http://www.iclarified.com/jailbreak/iphone3gs/mac.php?firmwa... I don't think you even need baseband access to do all the spying. I think all of that can be done on a jailbreak.

cracell 13y ago

One thing to take note of is that they specifically deny working with the NSA. They could very well be working with a contractor or another US government organization and not be lying. Not saying that they necessarily are. Based on what I've read about the NSA I think it's very plausible that the NSA both has a backdoor from Apple, one from the baseband software (http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone http://www.osnews.com/story/27416/The_second_operating_syste...), as well as a several hacks they've developed on their own. Their strategy is not a single path but rather as many attack vectors as possible.

sigzero 13y ago
Anything is plausible when there are no facts to show right? We have a document from 2007 and Apples denial. That is it.

streetnigga 13y ago

This is like RSA saying they had no secret contract to create a crypto backdoor. Really finely phrased, doesn't actually say much. Apple most likely wouldn't work directly with the NSA but with an entity like the FBI. The contract wouldn't be with the FBI but with a company also contracted out to do some of the work like Booz Allen Hamilton. I'm started to wonder who "we" actually means in these responses as well. Is this the stock-holder we, the CEO we, or we as in employees of Apple as a whole. I suspect it is not the latter one. We still don't know the point of entry for this malware and I have no more reason to suspect it is done by the shipping carriers than I have reason suspect the hardware makers themselves.

mrobot 13y ago
Where are people suspecting the shipping carriers?
- dobbsbob 13y ago
  The NSA's recommended guide for creating a secure phone (fishbowl) lists supply chain compromise as a threat. Probably because they themselves manage to infiltrate manufacturing and distribution

corresation 13y ago

Isn't this very similar to earlier claims about the NSA seeing Google's data? Many believed that Google was doing the NSA's bidding. Many others felt that only the polar opposite could be true: That Google rejected the NSA's pleas and thus the data couldn't be seen. It seems to have turned out that fact was somewhere in between -- Google was an involuntary partner, but the NSA could monitor virtually all of their data via the data center to data center links. The same thing could be happening at Apple (or any business): They have all the best intentions in the world and want to build the most secure product they can, but there is a extrajudicial foe that answers to essentially no one.

malandrew 13y ago
Yeah, but we still don't know if anyone in Google provided aid. So long as National Security Letters exist, there will always be the possibility that an employee or business unit has been complicit without anyone who can speak for the company ever finding out.
- corresation 13y ago
  Google explicitly denied voluntarily cooperating or working with the NSA in such a manner. While their denial was picked apart (just as the Apple one is, everyone declaring exclusions and perceived disclaimers), Google's statement effectively eliminated the possibility of an NSL silencing them. An NSL bars you from talking about something, but can't compel you to publicly lie (nor do I think a company with the might and influence of Google be bullied too easily). Of course this is all talking about Google as a corporation voluntarily doing something. Was someone in Google (or Apple or any other company) working on behalf of the NSA? There was early debates about whether that could even be legal, but at this point it seems that "anything goes" is the pattern, so possibly.
  - hindsightbias 13y ago
    There's absolutely nothing stopping the NSA/CIA from hiring a foreign national to work on their behalf, just like the DGSE could pay an American national in Palo Alto. Whether those employees could operate domestically w/o breaking the laws of their spymaster, maybe not. It's sorta telling to me that Google decided to go encryption on all intra-data after Snowden. No doubt they would have been briefed by agencies that they cooperate with about what the exposures would be. It's more likely that whatever chipsets common across smartphones or routers is the point of exploit. So the NSA and Samsung or whomever have to have a private agreement. Apple/Google don't have a need to know, but you think a few engineers might be curious.

adrianh 13y ago

"Apple has never worked with the NSA to create a backdoor in any of our products, including iPhone." WIGGLE ROOM ALERT: Apple might have worked with government contractors, just not the NSA directly. "Additionally, we have been unaware of this alleged NSA program targeting our products. We care deeply about our customers’ privacy and security." WIGGLE ROOM ALERT: They could very well be unaware of this program -- but aware of another program that hasn't been disclosed yet. For more on sneaky talk, read this fantastic Atlantic piece that dissects deliberately misleading statements by NSA officials: http://www.theatlantic.com/politics/archive/2013/12/how-americans-were-deceived-about-cell-phone-location-data/282239/ http://www.theatlantic.com/politics/archive/2013/12/how-amer... One key strategy they've had: they consistently deny specific programs, as opposed to general actions.

sigzero 13y ago
Give me a break.

eyeareque 13y ago

Think about what the NSA really did here in 2008. Apple didn't need to help the NSA do this. Here's why: The NSA exploited a bug in the iPhone in the same way that the jailbreak community has been doing since the iPhone came out in 2007. The only difference is that the NSA installed malware where as the jailbreak apps install Cydia. Remember jailbreakme.com? That is a browser based root vulnerability. Find an exploit in the iPhone's mail, sms, browser, or any other app, and you could too install malware. Of course this is not easy with the security of the iPhone, but with NSA like resources there is no such thing as bulletproof security.

fit2rule 13y ago
Plot-twist: the NSA is the jailbreaking community.