5 ms·

There's another technical surveillance method here that I feel more people should be talking about: monitoring iMessage communication. iMessage is extremely se

by abalone 12y ago

There's another technical surveillance method here that I feel more people should be talking about: monitoring iMessage communication. iMessage is extremely secure[1], except for the fact that Apple controls the device list for iCloud accounts. The method would simply be for Apple to silently add another device to a target's account which is under law enforcement's control. I say "silently" in that they would need to hide it from the target's iCloud management UI to stay clandestine, but that's it, just a minor UI change. iMessage clients will then graciously encrypt and send a copy of every message to/from the target to the monitoring device. This would still work even with impossible-to-crack encryption. It wouldn't allow access to old messages, just stuff after the monitoring was enabled. It's the modern wiretap. It mirrors wiretapping in that sufficiently sophisticated people could discover the "bug" by looking at how many devices iMessage is sending copies to when messaging the target (just inspecting the size of outgoing data with a network monitoring tool would probably suffice), but it would go a long way and probably be effective for a high percentage of cases. The main thrust of the article is that encryption is not new, just the extent of it, particularly iMessage. Here's a way around that. [1] http://images.apple.com/iphone/business/docs/iOS_Security_Feb14.pdf http://images.apple.com/iphone/business/docs/iOS_Security_Fe...

girvo 12y ago
> by looking at how many devices iMessage is sending copies to when messaging the target Is iMessage centralised? I'm pretty certain it is, and if that is the case then you couldn't find out if you were tapped or not; one message gets sent to the server (perhaps with a list of the devices you want to send it to) and the server under Apple/LEO control sends a copy to their "device".
- hwatson 12y ago
  Each message is encrypted individually for each device that will be receiving the message. As a result, unless Apple slip a public key they have control over into the keys reported for the receiver, they cannot read your messages. (This is why abalone mentions that Apple do not have access to your old messages.) http://blog.quarkslab.com/imessage-privacy.html http://blog.quarkslab.com/imessage-privacy.html goes into detail as to how the key exchange process works.
dantiberian 12y ago
Whenever you add a device to your pool of iMessage devices, all of the other devices get a popup message telling them. This is the step where each of the other devices get the decryption key for that device. My hunch is that Apple doesn't have a way to prevent the popup messages so if they were forced to add a law enforcement iPhone to an iMessage pool then the target would notice an extra device was added.
- jshevek 12y ago
  Maybe I don't understand the problem, but it seems to me that it would be very simple for apple to prevent the popup messages at their discretion, since they write and control the software that causes the popup to happen in the first place.
  - eridius 12y ago
    They would have to update the OS on the device first. And that's definitely not something that can be done silently. I'm assuming here that the OS already doesn't have the ability to suppress the popup, and I think that's a safe assumption because Apple doesn't want to have this ability.
    - ObviousScience 12y ago
      > And that's definitely not something that can be done silently. Can you link me to a technical analysis about this? It would be one of the few phones where the baseband/SIM couldn't make changes to the system.
      - eridius 12y ago
        iMessage has nothing at all to do with the baseband or SIM. And carriers definitely can't push updates to the OS. Only Apple has the technical capability to produce updates to the OS, if for no other reason than the fact that all OS code must be codesigned with Apple's certificate, and only Apple has the keys. But since the baseband can't update the OS anyway, that's a moot point. I don't have a link for a technical analysis of this, but I shouldn't need one. It should be self-evident that updating the OS is a process that is very obvious to the user. It's also something that Apple has never done without explicit action by the user to perform such an update. It would in fact be incredibly dangerous to update the OS without explicit action, if for no other reason than the fact that this would not give the user the chance to back up their phone in case something goes wrong.
bni 12y ago
That would only catch messages sent to the target, not messages that the target sent itself. For example if I send a iMessage to a friend on my Mac, I won't see my sent message on my iPhone later.
- hrktb 12y ago
  iMessage syncs the sent messages across the devices as well. The might be some conditions on the sync (e.g. messages sent before the device was added to the account, or message older than x months during which the device was offline, etc..) but I'm looking at my mac app and I definitely my iPhone messages.
xcrunner529 12y ago
well also mentioned in the security document is that if you do an iCloud backup the iMessage security is sort of negated...the archive is "clear text" in that it's encrypted by Apple's keys and such instead of the device key. Hence why you can restore it to other devices.

by abalone 12y ago

girvo 12y ago

> by looking at how many devices iMessage is sending copies to when messaging the target Is iMessage centralised? I'm pretty certain it is, and if that is the case then you couldn't find out if you were tapped or not; one message gets sent to the server (perhaps with a list of the devices you want to send it to) and the server under Apple/LEO control sends a copy to their "device".

hwatson 12y ago
Each message is encrypted individually for each device that will be receiving the message. As a result, unless Apple slip a public key they have control over into the keys reported for the receiver, they cannot read your messages. (This is why abalone mentions that Apple do not have access to your old messages.) http://blog.quarkslab.com/imessage-privacy.html http://blog.quarkslab.com/imessage-privacy.html goes into detail as to how the key exchange process works.

dantiberian 12y ago

Whenever you add a device to your pool of iMessage devices, all of the other devices get a popup message telling them. This is the step where each of the other devices get the decryption key for that device. My hunch is that Apple doesn't have a way to prevent the popup messages so if they were forced to add a law enforcement iPhone to an iMessage pool then the target would notice an extra device was added.

jshevek 12y ago
Maybe I don't understand the problem, but it seems to me that it would be very simple for apple to prevent the popup messages at their discretion, since they write and control the software that causes the popup to happen in the first place.
- eridius 12y ago
  They would have to update the OS on the device first. And that's definitely not something that can be done silently. I'm assuming here that the OS already doesn't have the ability to suppress the popup, and I think that's a safe assumption because Apple doesn't want to have this ability.
  - ObviousScience 12y ago
    > And that's definitely not something that can be done silently. Can you link me to a technical analysis about this? It would be one of the few phones where the baseband/SIM couldn't make changes to the system.
    - eridius 12y ago
      iMessage has nothing at all to do with the baseband or SIM. And carriers definitely can't push updates to the OS. Only Apple has the technical capability to produce updates to the OS, if for no other reason than the fact that all OS code must be codesigned with Apple's certificate, and only Apple has the keys. But since the baseband can't update the OS anyway, that's a moot point. I don't have a link for a technical analysis of this, but I shouldn't need one. It should be self-evident that updating the OS is a process that is very obvious to the user. It's also something that Apple has never done without explicit action by the user to perform such an update. It would in fact be incredibly dangerous to update the OS without explicit action, if for no other reason than the fact that this would not give the user the chance to back up their phone in case something goes wrong.

bni 12y ago

That would only catch messages sent to the target, not messages that the target sent itself. For example if I send a iMessage to a friend on my Mac, I won't see my sent message on my iPhone later.

hrktb 12y ago
iMessage syncs the sent messages across the devices as well. The might be some conditions on the sync (e.g. messages sent before the device was added to the account, or message older than x months during which the device was offline, etc..) but I'm looking at my mac app and I definitely my iPhone messages.

xcrunner529 12y ago

well also mentioned in the security document is that if you do an iCloud backup the iMessage security is sort of negated...the archive is "clear text" in that it's encrypted by Apple's keys and such instead of the device key. Hence why you can restore it to other devices.