8 ms·
Identifying backdoors, attack points, and surveillance mechanisms in iOS devices
- majke 12y agoMr Zdziarski gave this talk also at the HOPE conference yesterday. It's highly recommended. Slides: http://www.zdziarski.com/blog/wp-content/uploads/2014/07/iOS_Backdoors_Attack_Points_Surveillance_Mechanisms.pdf http://www.zdziarski.com/blog/wp-content/uploads/2014/07/iOS... For the people wanting to secure their iphone, go to the end to the slide "Apple Configurator" and follow the described steps to disable your iphone from paring with anything.
- mooism2 12y agoStep 1: buy a Mac :-/
- antsar 12y agoNot exactly. > iPhone Configuration Utility 3.6.2 for Windows http://support.apple.com/kb/DL1466 http://support.apple.com/kb/DL1466
- mark_l_watson 12y agoThank you very much - bookmarked. BTW, Apple is missing a great opportunity in my opinion. They don't need a ton of user data to make money and could evolve into the secure consumer device company. I see only upside for Apple if they work towards making as secure as possible devices.
- eps 12y ago> evolve into the secure consumer device company They don't have this option. They are too big to not cooperate the US law enforcement and intelligence communities. They must cooperate, it's given. There are just way too many pressure points that can be exploited to make them cooperate, even against their will. If they start selling themselves as a secure and trustworthy device manufacturer you can rest assured it's just lip service and pure marketing.
- mark_l_watson 12y agoOK, thanks. Our government has ways to get what it wants.
- red_sparrow 12y agoI disagree...Apple's size makes it ideal for resistance - the government has been very pro-business for the last decade, and congress has been way too receptive to lobbying groups. If Apple, Google, and a few others really put some muscle into it, they could make a real difference.
- api 12y agoLobbying against environmental or financial regulations is one thing. Taking on the national security state is something else entirely. I don't think it's loony or hyperbolic to say that the military/intelligence world really runs the U.S. at many levels. The U.S. has been a national security state at the highest levels since WWII transformed America from a civilian-centered economy to a military one and created what Eisenhower called the "military industrial complex." The whole topic makes for very interesting history... look into the national security act of 1947 for a starting point. At lower levels you have a vestigial democracy and true "independent" free enterprise, but when you get to be a company the size of Apple you are too big to blend in with the ordinary civilian economy. Getting that large results in immediate audience before the king, which in America is the military/intelligence shadow state. I'd be very surprised if one can ascend to the billion-dollar stratum in America without some very interesting closed-door meetings with strict NDAs. I'm also sure that all kinds of next-level stuff kicks in when you start to become a major international corporation that does heavy business overseas, as Apple is. There are endless forms of soft power that can be brought to bear against a large company, especially a publicly traded one. You've got the standard issue tax evasion practices of every major corporation for starters. Don't want to help us spy on users? How about a high-resolution IRS audit and some "offshore banking reform" specifically targeted at you? Then there's anti-trust, which is obviously selectively enforced. Does Apple have anything that could be called a monopoly or a monopolistic business practice?
- snowwrestler 12y ago
- Nanzikambe 12y agoWhilst I see your point, and I would love a major mobile device manufacturer to enter that space, there's a large barrier for Apple: the underlying operating system is not open source. Whilst that remains the case, the question of security ultimately breaks down to Apple saying "Trust Us". Given recent revelations, that's not something that should be afforded to any company that fails to demonstrate a commitment to protecting the personal data of it users from everyone including itself. A 3rd party audit of the source would go some way toward building that trust, but falling short of a publicly available code-base allowing independent verification, I doubt it would be enough.
- joosters 12y agoHas anyone tried using the configurator? I'd give it a go but it looks like it might completely wipe devices prior to applying the settings.
- r0nin 12y agoyeah, if your device wasn't supervisioned before it would clean install - i guess but i haven't tried and/or checked otherwise if you can than reapply your backup.
- joosters 12y agoI found a way: you can apply the restriction to a non-supervised device, which simplifies the process. You don't need to re-install or wipe. Just create a profile with the restrictions, then follow the instructions at: http://support.apple.com/kb/HT5833 http://support.apple.com/kb/HT5833 (Edit to add: It's actually unclear if the non-pairing restriction gets applied when using this method, it doesn't seem to get listed in the profile details once on the device)
- RKearney 12y agoIt does not. The Allow pairing with non-Configurator hosts requires that the device be supervised.
- 616c 12y agoThat is optional. (Source: Me, administers over 100 Apple devices with Configuration in day-to-day operations.) The software is so-so, but asynchronously managing USB connected devices is annoying, even with a shiny Apple interface.
- ehPReth 12y agoIs there a video of this talk?
- jcr 12y agoI haven't found the specific talk, but HOPE 2014 has live feeds (July 18-20), and "archives" although it seems the archives are not up yet. http://radio.hope.net/feeds/ http://radio.hope.net/feeds/ http://radio.hope.net/archive.html http://radio.hope.net/archive.html http://radio.hope.net/ http://radio.hope.net/
- ehPReth 12y agoThanks!
- benguild 12y agoI'm confused. Normally one cannot "pair" a device without entering the passcode to unlock it. Is this not the case?
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]
- kevinchen 12y agoYes, but one issue is that you could be pressured into pairing the device. Or someone can brute force the passcode to access the pairing UI. The slides mention a way to bypass pairing, but I don't think ever mentioned how.
- makomk 12y agoApple can boot the device over USB using a custom image that doesn't require the passcode. Other people can't because it needs to be signed with Apple's key in order to run.
- benguild 12y agoGot it. But if you say "don't allow pairing" they're SOL from a software perspective? I find that hard to believe... but either way, who knows really.
- dunham 12y agoYes, the device needs to be unlocked to pair it, otherwise it doesn't access to the keys needed to create the pairing record. The pairing record (stored on your desktop) helps avoid needing to unlock the device for subsequent access. I believe the device still needs an AfterFirstUnlock key to decrypt the escrow keys, so a cold-booted device wouldn't be accessible even if it was paired.
- thejosh 12y agoFor only $31.50 you can find this out.
- wyager 12y agoI was able to log in with my university credentials and get free access.
- testuser12345 12y agoConvert the report to pdf and upload it to https://pdf.yt/ https://pdf.yt/
- K2h 12y agolooks like someone did http://pdf.yt/d/1dKWAxs03AvnYqkt http://pdf.yt/d/1dKWAxs03AvnYqkt
- iamshs 12y agoTangent: This is a good site for PDFs, immensely better than scribd. Whenever I click a link in the PDF (for eg. pg 17), the document zoomed in permanently. I cannot find a way to revert back to original zoom, even opening the link again does not help. So whoever is running the site, please look into this bug.
- ehPReth 12y agoHere's the project's GitHub issue page: https://github.com/joepie91/pdfy/issues https://github.com/joepie91/pdfy/issues
- antsar 12y agoCtrl+Scroll worked for me in Firefox on Windows 7. Though I see no reason why clicking a link should result in the zoom level changing, so it does seem like a bug.
- 12y ago
- deleted 12y ago[deleted]
- wyager 12y ago>This is due to iOS' behavior of automatically joining networks whose name (not MAC address) it recognizes, such as “linksys” or “attwifi”. Discriminating by MAC addresses would not help at all. MAC addresses are trivial to spoof, even though they are "in hardware". It would be cool if we had a standardized trust-on-first-use cryptographic authentication model for wireless APs, like we do with SSH right now. You connect to the AP, it sends you its pubkey, your phone says "Do you want to trust AP with key AB:CD:BE:EF...". The discriminating paranoid person can choose to make sure this is the right key hash, and the average person gets at least limited protection from later AP spoofing attacks.
- x1798DE 12y agoYeah, I've been shocked by how easy it is to get a brand new router and set it up with the same SSID and password and every device I have auto-connects like it's the same thing. If you have the AP password, it's trivial to set up a fake second router in the same vicinity (you don't even have to touch the original one) with a stronger signal and have everyone connect through your gateway. Of course, once you have the AP password there's a lot you can do to the network traffic anyway, but it'd still be nice if the computer would pop something up and say, "The configuration of this device does not match the known configuration - do you still want to connect?"
- nwh 12y agoOSX and I assume iOS does do detection of this. If you connect to an AP that was WPA2 encrypted in the past, and has the same name but no encryption now, it gives you a big scary warning and bails out.
- terminalcommand 12y agoOne could always set-up a Ja-sager with WPA2.
- im3w1l 12y agoI guess this is to combat password stealing attempts in particular, and not AP spoofing in general?
- jug5 12y agoFull text: https://pdf.yt/d/1dKWAxs03AvnYqkt https://pdf.yt/d/1dKWAxs03AvnYqkt
- testuser12345 12y agoThanks for sharing!
- ejr 12y agoMods, please change the article URL to this.
- chmars 12y agoThe URL should IMHO be http://www.zdziarski.com/blog/?p=3441 http://www.zdziarski.com/blog/?p=3441 (primary source) or even directly http://www.zdziarski.com/blog/wp-content/uploads/2014/07/iOS_Backdoors_Attack_Points_Surveillance_Mechanisms.pdf http://www.zdziarski.com/blog/wp-content/uploads/2014/07/iOS....
- dang 12y agoI agree. We changed the url to that second link from http://www.sciencedirect.com/science/article/pii/S1742287614000036 http://www.sciencedirect.com/science/article/pii/S1742287614.... Linking directly to the pdf would go against what the author says he wants there.
- higherpurpose 12y ago> In October 2013, Quarkslab exposed design flaws(iMessage privacy) in Apple’s iMessage protocol demonstrating that Apple does, despite its vehement denial,have the technical capability to intercept private iMessage traffic if they so desired, or were coerced to under a court order. The iMessage protocol is touted to use end-to-end encryption, however Quarkslab revealed in their research that the asymmetric keys generated to perform this encryption are exchanged through key directory servers centrally managed by Apple, which allow for substitute keys to be injected to allow eavesdropping to be performed. Similarly, the group revealed that certificate pinning, a very common and easy-to-implement certificate chain security mechanism, was not implemented in iMessage, potentially allowing malicious parties to perform MiTM attacks against iMessage in the same fashion. So much for iMessage security. Also, ProtonMail works much in the same way (central key management), for anyone wondering, so it should be vulnerable to the same type of attacks.
- chippy 12y agoWhat are "close access methods"? Would bluetooth or iBeacon or Wifi be used with that, or does it need a cable, or actual button pressing, for example?
- comex 12y agoYou would have to attach a cable and, on recent iOS versions, press a button to trust the device (and I think enter the passcode - not sure - but not if the device gets shipped to Apple).
- newaccountfool 12y agoI know each publisher is different, but is there a guideline amount of how much each researcher gets when they are published in such journals?
- gburt 12y agoNone. (seriously, generally you pay for your articles to be published, academic publishing has a long way to come...)
- ac29 12y ago-$2000 is fairly common. As mentioned below, authors have to pay publication fees. Most journals are for profit and closed-access, though this is starting to change somewhat. Somewhat ironically, being published in these journals is a prerequisite for how researchers actually do get paid: by grants, usually taxpayer funded.
- newaccountfool 12y agoIs it also true that some organisations also pay their employees if they publish papers, I've heard this happens in the security field.
- mseri 12y agoIt doesn't happen in physics and mathematics. On the other hand you will probably be fired if you don't publish...
- dm2 12y agoWhy does Apple re-enable Bluetooth everytime you update iOS? "STOP RESISTING, WE WANT TO TRACK YOU" (iBeacon)
- astrange 12y agoiBeacon is purely passive and cannot track you.
- deleted 12y ago[deleted]
- YooLi 12y agoThis is not at all how ibeacon works.
- deleted 12y ago[deleted]
- mcintyre1994 12y agoYou could in theory set up a Bluetooth surveillance network though couldn't you? I really doubt that's remotely the goal for Apple but Bluetooth always on would make it possible I think.
- rsynnott 12y agoIt'd be quite a lot easier to do this with wifi, and indeed such systems exist, for monitoring people in shops etc. iOS 8 makes it substantially harder for these to work effectively (through randomised MAC addresses when looking for networks), which seems like an indication that Apple isn't interested in facilitating this sort of thing.
- bdowling 12y agoThe iBeacon transmitter may be passive, but the signal is typically passed to an app running on a phone, which can do anything, including post all it's position and time info to a server online. The good news is that it appears to be opt-in. In most, if not all, instances a user needs to install an app and enable location services before the iBeacon will trigger anything. No app listening for a particular beacon or set of beacons, no problem. Of course, there could also be malicious code running on the phone, installed by the government or spies, that could silently record everything. That could work now with gps, voice and video recording, wifi network positioning, etc. iBeacon is just one more set of data to collect.
- simscitizen 12y agoThe packet tracer is an interface to a tcpdump-like facility that's used for debugging. It requires you to connect the device to a Mac host. The interface is publicly documented: https://developer.apple.com/library/Mac/qa/qa1176/_index.html#//apple_ref/doc/uid/DTS10001707-CH1-SECIOSPACKETTRACING https://developer.apple.com/library/Mac/qa/qa1176/_index.htm...
- ibisum 12y agoCome on, this is a full packet dump of whatever you want. So .. why is it enabled by default, why isn't it in the developer image (only) if its so vital, and so on. This was intentionally architected for exploit.
- jwr 12y agoThe key takeaway for me here is that it is much more difficult to access data on iOS devices if they are switched off. So, if you are in a situation where you can expect that your device will be accessed (e.g. crossing the US border), switch it off ahead of time.
- iamshs 12y agoAnd according to new diktat, you will have to turn your phone on while crossing borders (I guess only restricted to TSA yet) [1]. So once it is on, it will let you have all the packet sniffer log dump. And on US borders, non-US citizens will be made to enter their PINs [2]. Key takeaway for me is why is phone logging so much data without there being a need for it, and even eating into data capacity. [1]- http://www.theguardian.com/world/2014/jul/06/tsa-cellphones-explosives-security-flights-us-bound http://www.theguardian.com/world/2014/jul/06/tsa-cellphones-... [2] - http://www.forbes.com/sites/kashmirhill/2013/02/21/the-privacy-price-to-cross-the-border/ http://www.forbes.com/sites/kashmirhill/2013/02/21/the-priva...