6 ms·

His work on security in iOS is quite interesting, but he seems determined to spin everything for maximum publicity rather than, well, accuracy or truth, which i

by mnem 12y ago

His work on security in iOS is quite interesting, but he seems determined to spin everything for maximum publicity rather than, well, accuracy or truth, which is a shame. For example, on that blog post he writes about pcapd and developers: "Lets start with pcapd; I mentioned in my talk that pcapd has many legitimate uses such as these" Yet in the slides for his talk[1] under theories he writes" "Maybe for Developers for Debugging? No." There are many examples of things like this in his writing, where actual facts are unsaid in order to gain the maximum melodrama for a particular statement. On top of that he seems to continually avoid the point that to enable these you need physical access to the device (for the pairing process to have a machine marked as trusted). If you have physical access, enabling debug[2] features are probably the least of your worries. Anyway, rant over. It just annoys me that genuinely interesting information often seems to be spun by personalities to give it artificial gloss these days, making it all feel a bit slimy and self-serving. [1] https://pentest.com/ios_backdoors_attack_points_surveillance_mechanisms.pdf https://pentest.com/ios_backdoors_attack_points_surveillance... [2] Debug if you're Apple, Back Doors if you're Mr. Zdziarski

api 12y ago
You just described significant portions of the security industry, which runs on maximizing the fear and FUD factor. It's not just true of computer security. It's really true globally of the entire "security" sector, from infosec to police to the global "national security" defense/intelligence industry and so forth. Step 1: frighten, step 2: sell protection, step 3: profit. Not saying there aren't risks out there, just that the industry markets itself through bombast and sometimes exaggerates them. Back to the infosec realm, the simple truth is that the only absolutely secure system is one that is off and the only absolute privacy is in your own head (maybe). Everything else is a matter of degrees of risk, and the curve is hockey stick shaped. It's relatively easy to mitigate the big risks, but that leaves a long tail of small risks and small vulnerabilities that require an exponentially increasing amount of effort and inconvenience to deal with.
- kachnuv_ocasek 12y ago
  Well, apparently, even that is not enough.
- rqebmm 12y ago
  every industry trumps up the usefulness of their product, it's called marketing. It's on the consumer to cut through the marketing-speak and understand what they actually need to pay for.
  - UweSchmidt 12y ago
    It's also on each industry to inform truthfully and honestly. As the work to "cut through the marketing speak" can obstruct business activity there are already various laws in place to punish a too liberal interpretation of the word "marketing".
  - TeMPOraL 12y ago
    > every industry trumps up the usefulness of their product, it's called marketing. It should be called lying and bullshitting, and I strongly believe that we tolerate it far too much as a culture.
    - api 12y ago
      Marketing can degrade into con artistry. It isn't always, but it certainly can. That being said, I think in the long run people appreciate it if your marketing isn't scummy. (Not directly aimed at the original article, though I do think there's a lot of deceptive, confusing, and overly hyperbolic FUD in the security sector.)
- tripzilch 12y ago
  Well, yes, but without this huge marketing effort on the side of the infosec industry, we'd still be running the web on http instead of https, and we'd still have to convince people that XSS is bad and not just a "neat trick". Those are just the first two things from the top of my head that IMO rightly took great effort to be taken seriously by the mainstream (developers and consumers alike). Also I disagree with the "Uncertainty & Doubt" part of FUD. Security researchers are generally extremely clear about what exactly the issues and risks are, with few exceptions when required for responsible disclosure.
pessimizer 12y ago
>Yet in the slides for his talk[1] under theories he writes: >"Maybe for Developers for Debugging? No." Followed by 6 bullet point reasons why this isn't a general excuse for all of the backdoors - it's mentioned in reference to all of his findings and not specifically pcapd (which is only mentioned on 2 consecutive slides out of 60, separated from this statement about debugging by 15 slides.) Your comment is far more misleading than what he's written.
- Alupis 12y ago
  I don't own an iDevice, but Apple's nonchalant attitude regarding possible exploitable backdoors irks me.
  - coldtea 12y ago
    The fact that the other major mobile OSs gets 98% of the mobile malware (according to studies), makes this point about the "nonchalant attitude" rather week...
    - drdaeman 12y ago
      Apple is a respectable company who cares about their brand image, so they're obviously allowing only high-profile adversaries' malware on your device! </s>
    - bediger4000 12y ago
      The attitude you exhibit towards iOS doesn't fly when Linux advocates mention that Windows is the target of 98% of PC malware. And maybe it's true: 98% of the PC malware is targeted at Windows and 98% of the mobile malware is targeted at Android. I certainly take advantage of the Windows malware situation by running Linux, and not running any malware checkers.
    - Alupis 12y ago
      > The fact that the other major mobile OSs gets 98% of the mobile malware (according to studies), makes this point about the "nonchalant attitude" rather week... No it does not. It's not acceptable when any company is nonchalant about any security problem on their device, product or service. And, taking Android as an example, Google is very open about the malware and malicious app problem[1] -- and takes steps to help mitigate said problem. Apple is just straight-up telling users it's not a problem. There is a key difference here. [1] http://en.tempo.co/read/news/2014/03/01/240558528/Google-Admits-Malware-Threats-on-Android http://en.tempo.co/read/news/2014/03/01/240558528/Google-Adm...
irv 12y ago
"Yet in the slides for his talk[1] under theories he writes..." I think you may have misunderstood. He is at this point theorising why the service is enabled outside of developer mode, not why it exists at all.
cbsmith 12y ago
Just to be clear, are you suggesting that if the details aren't provided in a slide somewhere, than those details were not mentioned in the talk?
- mnem 12y ago
  No, definitely not. I was partially ranting :) I couldn't find a recording of any talks he gave, only the slides, so he may have covered that in those.
deleted 12y ago
[deleted]
DavideNL 12y ago
So if i understand correct, anyone who steals or temporarily has physical access to your iPhone can access your data including (email, etc)account passwords, which makes the encryption on the device completely useless. If that's not a serious back door, i don't know what is.. the melodrama seems in order.

by mnem 12y ago

api 12y ago

You just described significant portions of the security industry, which runs on maximizing the fear and FUD factor. It's not just true of computer security. It's really true globally of the entire "security" sector, from infosec to police to the global "national security" defense/intelligence industry and so forth. Step 1: frighten, step 2: sell protection, step 3: profit. Not saying there aren't risks out there, just that the industry markets itself through bombast and sometimes exaggerates them. Back to the infosec realm, the simple truth is that the only absolutely secure system is one that is off and the only absolute privacy is in your own head (maybe). Everything else is a matter of degrees of risk, and the curve is hockey stick shaped. It's relatively easy to mitigate the big risks, but that leaves a long tail of small risks and small vulnerabilities that require an exponentially increasing amount of effort and inconvenience to deal with.

kachnuv_ocasek 12y ago
Well, apparently, even that is not enough.
rqebmm 12y ago
every industry trumps up the usefulness of their product, it's called marketing. It's on the consumer to cut through the marketing-speak and understand what they actually need to pay for.
- UweSchmidt 12y ago
  It's also on each industry to inform truthfully and honestly. As the work to "cut through the marketing speak" can obstruct business activity there are already various laws in place to punish a too liberal interpretation of the word "marketing".
- TeMPOraL 12y ago
  > every industry trumps up the usefulness of their product, it's called marketing. It should be called lying and bullshitting, and I strongly believe that we tolerate it far too much as a culture.
  - api 12y ago
    Marketing can degrade into con artistry. It isn't always, but it certainly can. That being said, I think in the long run people appreciate it if your marketing isn't scummy. (Not directly aimed at the original article, though I do think there's a lot of deceptive, confusing, and overly hyperbolic FUD in the security sector.)
tripzilch 12y ago
Well, yes, but without this huge marketing effort on the side of the infosec industry, we'd still be running the web on http instead of https, and we'd still have to convince people that XSS is bad and not just a "neat trick". Those are just the first two things from the top of my head that IMO rightly took great effort to be taken seriously by the mainstream (developers and consumers alike). Also I disagree with the "Uncertainty & Doubt" part of FUD. Security researchers are generally extremely clear about what exactly the issues and risks are, with few exceptions when required for responsible disclosure.

pessimizer 12y ago

>Yet in the slides for his talk[1] under theories he writes: >"Maybe for Developers for Debugging? No." Followed by 6 bullet point reasons why this isn't a general excuse for all of the backdoors - it's mentioned in reference to all of his findings and not specifically pcapd (which is only mentioned on 2 consecutive slides out of 60, separated from this statement about debugging by 15 slides.) Your comment is far more misleading than what he's written.

Alupis 12y ago
I don't own an iDevice, but Apple's nonchalant attitude regarding possible exploitable backdoors irks me.
- coldtea 12y ago
  The fact that the other major mobile OSs gets 98% of the mobile malware (according to studies), makes this point about the "nonchalant attitude" rather week...
  - drdaeman 12y ago
    Apple is a respectable company who cares about their brand image, so they're obviously allowing only high-profile adversaries' malware on your device! </s>
  - bediger4000 12y ago
    The attitude you exhibit towards iOS doesn't fly when Linux advocates mention that Windows is the target of 98% of PC malware. And maybe it's true: 98% of the PC malware is targeted at Windows and 98% of the mobile malware is targeted at Android. I certainly take advantage of the Windows malware situation by running Linux, and not running any malware checkers.
  - Alupis 12y ago
    > The fact that the other major mobile OSs gets 98% of the mobile malware (according to studies), makes this point about the "nonchalant attitude" rather week... No it does not. It's not acceptable when any company is nonchalant about any security problem on their device, product or service. And, taking Android as an example, Google is very open about the malware and malicious app problem[1] -- and takes steps to help mitigate said problem. Apple is just straight-up telling users it's not a problem. There is a key difference here. [1] http://en.tempo.co/read/news/2014/03/01/240558528/Google-Admits-Malware-Threats-on-Android http://en.tempo.co/read/news/2014/03/01/240558528/Google-Adm...

irv 12y ago

"Yet in the slides for his talk[1] under theories he writes..." I think you may have misunderstood. He is at this point theorising why the service is enabled outside of developer mode, not why it exists at all.

cbsmith 12y ago

Just to be clear, are you suggesting that if the details aren't provided in a slide somewhere, than those details were not mentioned in the talk?

mnem 12y ago
No, definitely not. I was partially ranting :) I couldn't find a recording of any talks he gave, only the slides, so he may have covered that in those.

deleted 12y ago

[deleted]

DavideNL 12y ago

So if i understand correct, anyone who steals or temporarily has physical access to your iPhone can access your data including (email, etc)account passwords, which makes the encryption on the device completely useless. If that's not a serious back door, i don't know what is.. the melodrama seems in order.