6 ms·

Mr Zdziarski gave this talk also at the HOPE conference yesterday. It's highly recommended. Slides: http://www.zdziarski.com/blog/wp-content/uploads/2014/07/iO

by majke 12y ago

Mr Zdziarski gave this talk also at the HOPE conference yesterday. It's highly recommended. Slides: http://www.zdziarski.com/blog/wp-content/uploads/2014/07/iOS_Backdoors_Attack_Points_Surveillance_Mechanisms.pdf http://www.zdziarski.com/blog/wp-content/uploads/2014/07/iOS... For the people wanting to secure their iphone, go to the end to the slide "Apple Configurator" and follow the described steps to disable your iphone from paring with anything.

mooism2 12y ago
Step 1: buy a Mac :-/
- antsar 12y ago
  Not exactly. > iPhone Configuration Utility 3.6.2 for Windows http://support.apple.com/kb/DL1466 http://support.apple.com/kb/DL1466
mark_l_watson 12y ago
Thank you very much - bookmarked. BTW, Apple is missing a great opportunity in my opinion. They don't need a ton of user data to make money and could evolve into the secure consumer device company. I see only upside for Apple if they work towards making as secure as possible devices.
- eps 12y ago
  > evolve into the secure consumer device company They don't have this option. They are too big to not cooperate the US law enforcement and intelligence communities. They must cooperate, it's given. There are just way too many pressure points that can be exploited to make them cooperate, even against their will. If they start selling themselves as a secure and trustworthy device manufacturer you can rest assured it's just lip service and pure marketing.
  - mark_l_watson 12y ago
    OK, thanks. Our government has ways to get what it wants.
  - red_sparrow 12y ago
    I disagree...Apple's size makes it ideal for resistance - the government has been very pro-business for the last decade, and congress has been way too receptive to lobbying groups. If Apple, Google, and a few others really put some muscle into it, they could make a real difference.
    - api 12y ago
      Lobbying against environmental or financial regulations is one thing. Taking on the national security state is something else entirely. I don't think it's loony or hyperbolic to say that the military/intelligence world really runs the U.S. at many levels. The U.S. has been a national security state at the highest levels since WWII transformed America from a civilian-centered economy to a military one and created what Eisenhower called the "military industrial complex." The whole topic makes for very interesting history... look into the national security act of 1947 for a starting point. At lower levels you have a vestigial democracy and true "independent" free enterprise, but when you get to be a company the size of Apple you are too big to blend in with the ordinary civilian economy. Getting that large results in immediate audience before the king, which in America is the military/intelligence shadow state. I'd be very surprised if one can ascend to the billion-dollar stratum in America without some very interesting closed-door meetings with strict NDAs. I'm also sure that all kinds of next-level stuff kicks in when you start to become a major international corporation that does heavy business overseas, as Apple is. There are endless forms of soft power that can be brought to bear against a large company, especially a publicly traded one. You've got the standard issue tax evasion practices of every major corporation for starters. Don't want to help us spy on users? How about a high-resolution IRS audit and some "offshore banking reform" specifically targeted at you? Then there's anti-trust, which is obviously selectively enforced. Does Apple have anything that could be called a monopoly or a monopolistic business practice?
    - snowwrestler 12y ago
- Nanzikambe 12y ago
  Whilst I see your point, and I would love a major mobile device manufacturer to enter that space, there's a large barrier for Apple: the underlying operating system is not open source. Whilst that remains the case, the question of security ultimately breaks down to Apple saying "Trust Us". Given recent revelations, that's not something that should be afforded to any company that fails to demonstrate a commitment to protecting the personal data of it users from everyone including itself. A 3rd party audit of the source would go some way toward building that trust, but falling short of a publicly available code-base allowing independent verification, I doubt it would be enough.
joosters 12y ago
Has anyone tried using the configurator? I'd give it a go but it looks like it might completely wipe devices prior to applying the settings.
- r0nin 12y ago
  yeah, if your device wasn't supervisioned before it would clean install - i guess but i haven't tried and/or checked otherwise if you can than reapply your backup.
  - joosters 12y ago
    I found a way: you can apply the restriction to a non-supervised device, which simplifies the process. You don't need to re-install or wipe. Just create a profile with the restrictions, then follow the instructions at: http://support.apple.com/kb/HT5833 http://support.apple.com/kb/HT5833 (Edit to add: It's actually unclear if the non-pairing restriction gets applied when using this method, it doesn't seem to get listed in the profile details once on the device)
    - RKearney 12y ago
      It does not. The Allow pairing with non-Configurator hosts requires that the device be supervised.
- 616c 12y ago
  That is optional. (Source: Me, administers over 100 Apple devices with Configuration in day-to-day operations.) The software is so-so, but asynchronously managing USB connected devices is annoying, even with a shiny Apple interface.
ehPReth 12y ago
Is there a video of this talk?
- jcr 12y ago
  I haven't found the specific talk, but HOPE 2014 has live feeds (July 18-20), and "archives" although it seems the archives are not up yet. http://radio.hope.net/feeds/ http://radio.hope.net/feeds/ http://radio.hope.net/archive.html http://radio.hope.net/archive.html http://radio.hope.net/ http://radio.hope.net/
  - ehPReth 12y ago
    Thanks!
benguild 12y ago
I'm confused. Normally one cannot "pair" a device without entering the passcode to unlock it. Is this not the case?
- deleted 12y ago
  [deleted]
- deleted 12y ago
  [deleted]
- kevinchen 12y ago
  Yes, but one issue is that you could be pressured into pairing the device. Or someone can brute force the passcode to access the pairing UI. The slides mention a way to bypass pairing, but I don't think ever mentioned how.
  - makomk 12y ago
    Apple can boot the device over USB using a custom image that doesn't require the passcode. Other people can't because it needs to be signed with Apple's key in order to run.
    - benguild 12y ago
      Got it. But if you say "don't allow pairing" they're SOL from a software perspective? I find that hard to believe... but either way, who knows really.
- dunham 12y ago
  Yes, the device needs to be unlocked to pair it, otherwise it doesn't access to the keys needed to create the pairing record. The pairing record (stored on your desktop) helps avoid needing to unlock the device for subsequent access. I believe the device still needs an AfterFirstUnlock key to decrypt the escrow keys, so a cold-booted device wouldn't be accessible even if it was paired.

by majke 12y ago

mooism2 12y ago

Step 1: buy a Mac :-/

antsar 12y ago
Not exactly. > iPhone Configuration Utility 3.6.2 for Windows http://support.apple.com/kb/DL1466 http://support.apple.com/kb/DL1466

mark_l_watson 12y ago

Thank you very much - bookmarked. BTW, Apple is missing a great opportunity in my opinion. They don't need a ton of user data to make money and could evolve into the secure consumer device company. I see only upside for Apple if they work towards making as secure as possible devices.

eps 12y ago
> evolve into the secure consumer device company They don't have this option. They are too big to not cooperate the US law enforcement and intelligence communities. They must cooperate, it's given. There are just way too many pressure points that can be exploited to make them cooperate, even against their will. If they start selling themselves as a secure and trustworthy device manufacturer you can rest assured it's just lip service and pure marketing.
- mark_l_watson 12y ago
  OK, thanks. Our government has ways to get what it wants.
- red_sparrow 12y ago
  I disagree...Apple's size makes it ideal for resistance - the government has been very pro-business for the last decade, and congress has been way too receptive to lobbying groups. If Apple, Google, and a few others really put some muscle into it, they could make a real difference.
  - api 12y ago
    Lobbying against environmental or financial regulations is one thing. Taking on the national security state is something else entirely. I don't think it's loony or hyperbolic to say that the military/intelligence world really runs the U.S. at many levels. The U.S. has been a national security state at the highest levels since WWII transformed America from a civilian-centered economy to a military one and created what Eisenhower called the "military industrial complex." The whole topic makes for very interesting history... look into the national security act of 1947 for a starting point. At lower levels you have a vestigial democracy and true "independent" free enterprise, but when you get to be a company the size of Apple you are too big to blend in with the ordinary civilian economy. Getting that large results in immediate audience before the king, which in America is the military/intelligence shadow state. I'd be very surprised if one can ascend to the billion-dollar stratum in America without some very interesting closed-door meetings with strict NDAs. I'm also sure that all kinds of next-level stuff kicks in when you start to become a major international corporation that does heavy business overseas, as Apple is. There are endless forms of soft power that can be brought to bear against a large company, especially a publicly traded one. You've got the standard issue tax evasion practices of every major corporation for starters. Don't want to help us spy on users? How about a high-resolution IRS audit and some "offshore banking reform" specifically targeted at you? Then there's anti-trust, which is obviously selectively enforced. Does Apple have anything that could be called a monopoly or a monopolistic business practice?
  - snowwrestler 12y ago
Nanzikambe 12y ago
Whilst I see your point, and I would love a major mobile device manufacturer to enter that space, there's a large barrier for Apple: the underlying operating system is not open source. Whilst that remains the case, the question of security ultimately breaks down to Apple saying "Trust Us". Given recent revelations, that's not something that should be afforded to any company that fails to demonstrate a commitment to protecting the personal data of it users from everyone including itself. A 3rd party audit of the source would go some way toward building that trust, but falling short of a publicly available code-base allowing independent verification, I doubt it would be enough.

joosters 12y ago

Has anyone tried using the configurator? I'd give it a go but it looks like it might completely wipe devices prior to applying the settings.

r0nin 12y ago
yeah, if your device wasn't supervisioned before it would clean install - i guess but i haven't tried and/or checked otherwise if you can than reapply your backup.
- joosters 12y ago
  I found a way: you can apply the restriction to a non-supervised device, which simplifies the process. You don't need to re-install or wipe. Just create a profile with the restrictions, then follow the instructions at: http://support.apple.com/kb/HT5833 http://support.apple.com/kb/HT5833 (Edit to add: It's actually unclear if the non-pairing restriction gets applied when using this method, it doesn't seem to get listed in the profile details once on the device)
  - RKearney 12y ago
    It does not. The Allow pairing with non-Configurator hosts requires that the device be supervised.
616c 12y ago
That is optional. (Source: Me, administers over 100 Apple devices with Configuration in day-to-day operations.) The software is so-so, but asynchronously managing USB connected devices is annoying, even with a shiny Apple interface.

ehPReth 12y ago

Is there a video of this talk?

jcr 12y ago
I haven't found the specific talk, but HOPE 2014 has live feeds (July 18-20), and "archives" although it seems the archives are not up yet. http://radio.hope.net/feeds/ http://radio.hope.net/feeds/ http://radio.hope.net/archive.html http://radio.hope.net/archive.html http://radio.hope.net/ http://radio.hope.net/
- ehPReth 12y ago
  Thanks!

benguild 12y ago

I'm confused. Normally one cannot "pair" a device without entering the passcode to unlock it. Is this not the case?

deleted 12y ago
[deleted]
deleted 12y ago
[deleted]
kevinchen 12y ago
Yes, but one issue is that you could be pressured into pairing the device. Or someone can brute force the passcode to access the pairing UI. The slides mention a way to bypass pairing, but I don't think ever mentioned how.
- makomk 12y ago
  Apple can boot the device over USB using a custom image that doesn't require the passcode. Other people can't because it needs to be signed with Apple's key in order to run.
  - benguild 12y ago
    Got it. But if you say "don't allow pairing" they're SOL from a software perspective? I find that hard to believe... but either way, who knows really.
dunham 12y ago
Yes, the device needs to be unlocked to pair it, otherwise it doesn't access to the keys needed to create the pairing record. The pairing record (stored on your desktop) helps avoid needing to unlock the device for subsequent access. I believe the device still needs an AfterFirstUnlock key to decrypt the escrow keys, so a cold-booted device wouldn't be accessible even if it was paired.