12 ms·

The CIA Campaign to Steal Apple's Secrets

372 points by lnguyen 12y ago

pasta_2 12y ago
A great ad for Apple's security.
- IBM 12y ago
  I agree. When the intelligence community has to resort to this, I think the everyman is ok: >At the 2011 Jamboree conference, there were two separate presentations on hacking the GID key on Apple’s processors. One was focused on non-invasively obtaining it by studying the electromagnetic emissions of — and the amount of power used by — the iPhone’s processor while encryption is being performed. Careful analysis of that information could be used to extract the encryption key. Such a tactic is known as a “side channel” attack. The second focused on a “method to physically extract the GID key.”
onion2k 12y ago
The implication of the article is that this is some sort of specific attack against Apple. Surely the reality is that the CIA, and pretty much all 3-letter agencies globally, in a concerted and organised way try to break the security of all secure devices. That's a big part of their job - you can't gather intelligence if you can't read it. The good things in the article are two-fold: firstly, Apple haven't just capitulated and handed over whatever is asked of them, and secondly the documents about the effort don't specifically mention any sort of success which could be interpreted as the agency failing. Of course, if they had been successful I imagine they'd keep as quiet as possible about it.
- Intermernet 12y ago
  I think the point of The Intercept releasing this Apple specific info (mostly, there's a bit about Microsoft being targeted as well) is to try to appeal to the large number of Apple customers. I'd love to see some of the other line items in the leaked CBJ document, as there are probably some other targeted attacks documented. Regarding Apple not capitulating, I'm giving them the benefit of the doubt, and assuming that they're telling the truth, but wouldn't the NSL system mean that Tim Cook couldn't reveal if Apple had been forced to release data? I'm hoping that he has a personal warrant canary policy, and would just remain silent if asked about something he can't talk about.
  - a3n 12y ago
    "No comment" from Cook would be an interesting standoff. If he were prosecuted for it, that would confirm something NSL-like. But would it be worth it to a CEO to go to jail for a few years for a principle?
    - Intermernet 12y ago
      That of course, depends on the strength of said CEO's principles. This would be, of course, one of the hardest tests of professional principles you could imagine a CEO going through. I personally think Mr Cook would be a good candidate for passing this test, as he seems to have a track record for standing up for what he believes in. I also have a feeling that the US government would think twice before taking on the Apple PR juggernaut head to head. It would be too closely matched for comfort. Apple probably have greater mind-share than any of the political parties. As you say, it would be an interesting standoff!
      - jkestner 12y ago
        It's a little discomforting that we're hoping that corporations, presumably guided by a profit motive, will defend us against the government formed for the people (though more heavily influenced by other corporations). Even if Apple is trustworthy for a company, I'm not going to enjoy the future in which we pick our favorite companies to enact policy. Now, this is obviously happening to Google, et al, as well, so a joint action by the captains of industry — an appeal to the public more than the court — will be more effective.
        mindcrime 12y ago
        Nothing wrong with "profit motive". Remember: It is not from the benevolence of the butcher, the brewer, or the baker that we expect our dinner, but from their regard to their own interest. ~~ Adam Smith That said, I'd personally like to see less power aggregated into the hands of both governments and big mega-corporations. But the big difference between the two, to my mind, is that governments have a near monopoly on "legitimate" use of force, and have lots of men with guns, tanks, bombers, nukes, etc. at their disposal. Corporations mostly lack those things, except to the extent that they collude with the governments.
ape4 12y ago
The CIA? Thought the NSA did this.
- adventured 12y ago
  Here's their mission statement: "Preempt threats and further US national security objectives by collecting intelligence that matters, producing objective all-source analysis, conducting effective covert action as directed by the President, and safeguarding the secrets that help keep our Nation safe." Historically the CIA and NSA have a competitive relationship, they vie for the same funding. I would think pursuing iPhone security would cross into the NSA's domain and that they wouldn't appreciate it, however the CIA has a budget 50% larger than the NSA and I'm sure they'd like to keep it that way by staying relevant.
okasaki 12y ago
The cynic in me feels that this might be part of a PR campaign coordinated between the US govt and US tech companies to try to give the impression of an adversarial relationship between the two. The article quotes Steven Bellovin: “Their attitude is basically amoral: whatever works is OK.” If you forgot the article, could you tell who this is talking about? The government or the corporations? It seems like it fits both pretty well. The two entities both have a lot to gain from cooperating. Why wouldn't they? Whatever works.
- IBM 12y ago
  Interesting twist when Glenn Greenwald/Snowden is now suspected of doing PR for tech companies.
  - Intermernet 12y ago
    I must have missed that release, do you have any links?
    - IBM 12y ago
      https://news.ycombinator.com/item?id=9176630 https://news.ycombinator.com/item?id=9176630
      - Intermernet 12y ago
        You may have posted the wrong link there. It seems to be a link to @okasaki's comment, which doesn't seem to pertain to the issue you mentioned, and contains no links of it's own. I assume copypasta error? I'd still appreciate it if you have any links, as I'm trying to map out the various accusations and counter-accusations in the Snowden case. It's a good study in information warfare :-)
        IBM 12y ago
        It's no error.
        12y ago
Asparagirl 12y ago
If I'm understanding this right, this article is claiming that the CIA served up [edit: could serve up, not proven they did, see comments below about plausibility] poisoned versions of XCode, which would then be used to make App Store apps that eventually phoned home to Langley with either app-specific data or whole-phone data. This raises so many questions, among them: 1) What was [edit: would be] the criteria for serving up a poisoned version instead of a real version of XCode to a dev? Was it [would it be] limited to downloadable versions or were DVD software copies affected too? One possibility came to mind: Does XCode come in different flavors based on county of sale/download, language, or a combo of the two? If so, would that be that criteria for their attempt to not target US citizens, by crudely targeting non-US and/or non-English app developer accounts? Because that would be the fakiest attempt yet at trying to claim plausible deniability, since so many apps with mainly American userbases are developed by overseas devs. 2) If a dev had a poisoned version of XCode, how could they not see a mysterious server being pinged during their development of the app? How could Apple not see something amiss during their QA of the app before they pushed it to the store? 3) If I were an evil genius Big Brother no holds barred government, I'd want data from messaging apps, social networks, and geolocation apps most of all, less so from things like single-player games. Thoughts on which apps are likely to be in the top 5 of their wishlist? 4) Does this mean that PhoneGap / Cordova / non-native HTML5 apps really are better? :-) Say, why did Facebook change to a native app again?
- IBM 12y ago
  They said they created a poisoned version of XCode, not that they were able to serve it up successfully to anyone.
  - Asparagirl 12y ago
    True, but Snowden's data haul is at least a year and a half old by now, and some of the files cited in this article date back longer than that. But I edited my comment to include your point: no hard proof that this technique was used...yet.
  - glitchdout 12y ago
    But they sure can serve it successfully. They control the cables through which everyone's internet traffic passes, and when you download a program (such as Xcode) they can substitute it with their poisoned program [1]. I'll quote: > All it takes is a single request from a victim passing a wiretap for exploitation to occur. Once the QUANTUM wiretap identifies the victim, it simply packet injects a 302 redirect to a FOXACID server. Now the victim’s browser starts talking to the FOXACID server, which quickly takes over the victim’s computer. ... or doesn't take over the victim's computer, but provides a download of a poisoned Xcode. These motherfuckers have compromised the whole internet. [1]: http://www.wired.com/2013/11/this-is-how-the-internet-backbone-has-been-turned-into-a-weapon/ http://www.wired.com/2013/11/this-is-how-the-internet-backbo...
rodgerd 12y ago
Apple should stage some sort of protest. Perhaps they should go on some sort of tax strike.
- a3n 12y ago
  I don't think it would have any material effect. Most if not all hyper-corporations route transactions off-shore, and hold cash off-shore, specifically to drastically reduce the amount of tax they pay.
  - rodgerd 12y ago
    That was the joke.
  - astrange 12y ago
    Apple is the #3 largest taxpayer in the US, and one of the few companies registered in California instead of Delaware.
    - a3n 12y ago
      No doubt. Nevertheless: https://duckduckgo.com/?q=apple+tax+ireland https://duckduckgo.com/?q=apple+tax+ireland The loophole(s) may have been closed, but I doubt Apple left them voluntarily.
p01926 12y ago
How much longer can this continue? We have American agencies attacking American companies "because terrorism". It's been 13 years since our trauma, maybe now's the time to remove the razor blade from our wrists, look ourselves in the mirror and just carry on. Bad stuff is always going to be in our future — stuff that will increasingly appear preventable between the Internet and a lot of hindsight — but our current solution is only making things worse. The war on terror, like all the metaphorical wars, is really a civil war. It needs to stop now.
- belorn 12y ago
  Unofficially, politicians has surrendered the "because terrorism" excuse for a while now, as they simply want access to everyones private information in order to see where the problem are going to be. Having the data helps plan and run successful elections, makes it easier to plan ahead, and gives them power over any department which doesn't has similar access. Imagine being in a political party while private intelligence contractor give you access to all the emails from the other side. You can know where all the activists are at any moment, and what the internal conflicts are, and what areas is focused. What would be your reaction if phones suddenly started to get encrypted?
  - prawn 12y ago
    I don't think they want that. They take this course because "this was preventable!" is very politically disruptive. None of them want to be the guy who voted against mandatory data retention only to play host to an attack on home soil months later. It's sad, but that's the reality.
    - gohrt 12y ago
      The history of government spying, at least as far back as J Edgar Hoover, as been about spying on members of the opposition, not about ass-covering. ass-covering is just the current halfway-excuse.
  - cmdkeen 12y ago
    You effectively had that during the latter Hoover years with the FBI. That the headquarters is still named after him is an indictment of the US approach to political corruption.
deleted 12y ago
[deleted]
chrisbennet 12y ago
It's interesting to see Ken Thompson's hypothetical compromised compiler being used for real. http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html
- angersock 12y ago
  Hah, yeah. The first bit of the article is very big about compromising XCode, and I couldn't help but think that Lockheed basically just got the .gov to pay them to "rediscover" Reflections on Trusting Trust.
JohnLen 12y ago
Test
littletimmy 12y ago
I don't buy it. I really don't. We know about the incredibly close ties between silicon valley and the military. We know that the US government collects anything and everything, and that US corporations are complicit (or made to be complicit) in the act. It is most likely that Greenwald was leaked these documents to create a facade of government-corporate animosity to revive trust in US corporations, all the while there existing a backdoor to facilitate snooping.
- TillE 12y ago
  The article explains that these are all documents from Snowden. So they're simply taken from the full set that Greenwald has had since 2013, not any kind of new leak.
- zerohm 12y ago
  The Federal Government can make tech firms hand over any data they request. However, they can't stop tech firms from designing their products so that the tech firm never sees your personal data.
r0h1n 12y ago
What strikes me after this revelation is how unique the United States is, because: (a) it has dozens of companies that create technology the rest of the world uses, and (b) it has a govt. that secretly works to undermine the technology developed by those companies. You're not going to hear about many foreign govt's actively hacking their country's software products, simply because they could easily/secretly armtwist cos. into installing backdoors at the beginning. Take China for instance - do we think it needs to hack into, say, Huawei phones or Wechat? I don't think so. As a foreigner, that is why this "fight" between US software cos. and its govt. is so fascinating. It's made possible through a unique combination of capital, freedom and history. And I hope it remains that way, for the sake of the rest of the world too.
- flyryan 12y ago
  Your example isn't a particular good one. Huawei has been accused of backdooring their products for the Chinese government on numerous occasions, including presentations at DEFCON exposing those backdoors. There are also numerous cases of backdoors in Chinese cell phones.
  - lawnchair_larry 12y ago
    But his point was that China's government doesn't attack the company to get those.
    - wavefunction 12y ago
      How do we know how any putative arrangement of this type has come to be?
  - lucio 12y ago
    That's exactly what he's saying: "You're not going to hear about many foreign govt's actively hacking their country's software products, simply because they could easily/secretly armtwist cos. into installing backdoors at the beginning"
- task_queue 12y ago
MichaelCrawford 12y ago
This is a great argument for "Gentoo Android". While much of the iOS is Open Source or Free Software, the end-user can't really inspect the source that went into their particular device. Note that, to the extent that the CIA steals Apple secrets from foreign sources, they may not be violating any US laws. However Apple does the vast majority of its system software development in Cupertino, California. My next phone is going to be an Android that enables me to completely replace its firmware binary. While this does void the warranty, rather than having to be concerned about potentially skanky jailbreak exploits, one more or less just sets a flag with an Android SDK command-line tool, then you can install your own firmware. That will be of limited use in protecting me against hardware backdoors, but at least it will let me pretend that America is still The Land Of The Free. Among the reason I am so adamant about stuff like this, and that I use my real name when I post about it so publicly, is that I am related to Roger Sherman, the fourth signer of the US Declaration of Independence, as well as to William Tecumseh Sherman and George B. McClellan, the two Generals-in-Chief of the Union Army during the American Civil War. My mother was an active member of the Daughters of the American Revolution; I myself am entitled to membership in the Sons of the American Revolution.
- gryph0n 12y ago
  You might want to lookup the Replicant project. http://www.replicant.us http://www.replicant.us http://en.wikipedia.org/wiki/Replicant_(operating_system) http://en.wikipedia.org/wiki/Replicant_(operating_system) It looks like the development team could use some new contributors.
- nezza-_- 12y ago
  My next phone is going to be an Android that enables me to completely replace its firmware binary. I'm not aware of a single (modern) phone where you can replace the firmware of the baseband with something open source.
  - seba_dos1 12y ago
    Openmoko Neo Freerunner. Might fall a bit outside of "modern" category though (and of course, operating GSM baseband processor with altered firmware on public networks is illegal)
MichaelGG 12y ago
Every time I read about a private company being targeted, I remember how simply state-level spies have been compromised. Hanssen[1], for instance, betrayed the CIA over 22 years, for just $1.4M. The info leaked included info on other agents, at least one who was executed. Or [2], Walker gave crypto info to decrypt Navy messages. For a few grand a month. There's plenty more listed even on Wikipedia. The amounts involved seem... not that high. Now, sure, Apple almost certainly has higher security. (Quote from the above spy: "KMart has better security than the Navy.") But with state level resources, do we think employees can be flipped? Or, why is the NSA not getting to grads early on, helping their career, while having them really be agents all along? I'm on my phone and can't find the reference now, but there was a young physicist that leaked into on atomic weapons purely because he felt the US shouldn't have a monopoly on the capability. The chance that some bright, highly-sought, employee feeling that the US should have spy capabilities is approximately 1. Is every remotely sensitive employee routinely monitored? Their families? They never get into " life threatening " scenarios? Or embarrassing scenarios that they might feel is the end? (For some, that's as simple as getting a mistress pregnant, and not being able to bear others knowing.) Just seems like the human employees have got to be compromisable in one form or another, given the resources of the NSA and CIA. 1: http://en.m.wikipedia.org/wiki/Robert_Hanssen http://en.m.wikipedia.org/wiki/Robert_Hanssen 2: http://en.wikipedia.org/wiki/John_Anthony_Walker http://en.wikipedia.org/wiki/John_Anthony_Walker
- downandout 12y ago
  > Or, why is the NSA not getting to grads early on, helping their career, while having them really be agents all along? It would be naive to think that they (and other agencies around the world) aren't already doing this.
  - mcantelon 12y ago
    Yeah, I kind of assumed this was standard operating procedure, like Anderson Cooper's "internship" at the CIA.
- deleted 12y ago
  [deleted]
0xCMP 12y ago
Seriously. This isn't even bad. Go to DEFCON and you'll see a ton of people doing this crap. There is a reason a bunch of paranoid people (includes me) bought faraday cages for our phones. Everyone is trying to break in to the little black boxes we carry around with some of our most personal information. They have ACTUALLY done bad crap. This is normal security research. There is no need to blow normal research and security work out of proportion. Xcode is signed, they can't just modify it and let it go. The OS X updater is also likely secure and maybe they just figured out how to trick their own computers to install a keylogger. Good, but it probably doesn't work that well. And it's fine! It's research! Lets focus on the actual violations, not the tools. Exploits and social engineering doesn't compromise: people do. Focus on the people who broke the rules which make sure our country isn't manipulated in to an oligarchy.
- jmcmichael 12y ago
  The difference is that when the intelligence community discovers a hole in US-produced software, they will keep it to themselves to exploit the computers of individuals around the world in various operations of dubious value and/or legality. At DEFCON, exploits are publicized so that software vendors and algorithm developers are motivated to strengthen the security of what they produce so that the software that all of use is more effective against attackers.
- deveac 12y ago
  >Seriously. This isn't even bad....There is no need to blow normal research and security work out of proportion. Is normal security research done with the goal of finding/creating holes with the purpose of keeping them secret in order to use them as attack vectors without letting the owners of the compromised systems know about the vulnerabilities? What's bad about this is the purpose of the research (not to discover and strengthen security, but instead to destroy it), combined with the weaponization of it (the entire goal of doing the research is to use the exploits), and the actor carrying out the attacks (the state). It's obvious on its face why this is alarming.
Zelphyr 12y ago
As many have noted, this does need to stop but it won't. And the problem lies squarely with you and me. Try this experiment: Ask a group of 5-10 people around you to raise their hands if they've been pissed off at any branch or level of their government. Then ask them to keep their hands up if they've contacted their representatives about that issue. Finally, ask them if the method of contact they used was the phone or written (not email) letter. I'll bet dollars to donuts that not a single hand will be in the air. You and I are the problem because we don't hold our representatives accountable. We really only pay attention (and marginal attention at that) during election time by buying into the campaign bullshit. At best we sign an online petition but the politicians barely care about that. They know that its easy even for the most apathetic to click a button. Sure, in cases like net neutrality it can get their attention but I'll submit that what really got their attention was the number of phone calls they were getting. Yes, I specifically am to blame because I haven't called or written my representatives. That's going to stop. We need to be on the horn with these people frequently. Weekly. When they're in town we need to be in their faces. They said, "If you see something, say something." Well, I see corruption and I'm going to point right at them and tell them. Will you join me? EDIT: I should add that we need to be contacting them when we approve of the work they're doing. They need data. Most of the feedback they receive is negative (and for good reason) but without positive feedback they're left searching and unfortunately the guys who claim to have the answers are the lobbyists. But remember, there are around 15,000 lobbyists in Washington D.C. but 131,144,000 voters voted in the 2012 Presidential election. I like our chances, if only we get involved.
- ripb 12y ago
  >Will you join me? I wonder how many people are genuinely afraid of raising their own profile in such a way. I'm not American, but I would certainly be partaking in any political action against the actions being discussed here. Although as it is, I'm very hesitant to even level criticism at the CIA on HN. I'm by no means an important person, but from what we've learned I don't even want to register on the radar of these entities.
  - Zelphyr 12y ago
shashu10 12y ago
I'd much rather have my iPhone hacked by Anonymous
lotsofmangos 12y ago
“Tearing apart the products of U.S. manufacturers and potentially putting backdoors in software distributed by unknowing developers all seems to be going a bit beyond ‘targeting bad guys.’ It may be a means to an end, but it’s a hell of a means.” The trouble with the means justifying the ends, is that ends are fictions invented to enable the telling of stories. Outside the structures required for stories, there is only ever really the means.
Nanzikambe 12y ago
Am I missing something? Isn't their targetting of Xcode as massive as if they'd just announced they'd backdoored Gnu gcc? I mean whether they've backdoored the regular version available to all or only those in use by specific developers, the implication (to me) would be that binaries/applications/etc produced would then be automatically backdoored or at very least weakened? Disclaimer: I know zip about Xcode or dev in the Apple ecosystem

372 points by lnguyen 12y ago

pasta_2 12y ago

A great ad for Apple's security.

IBM 12y ago
I agree. When the intelligence community has to resort to this, I think the everyman is ok: >At the 2011 Jamboree conference, there were two separate presentations on hacking the GID key on Apple’s processors. One was focused on non-invasively obtaining it by studying the electromagnetic emissions of — and the amount of power used by — the iPhone’s processor while encryption is being performed. Careful analysis of that information could be used to extract the encryption key. Such a tactic is known as a “side channel” attack. The second focused on a “method to physically extract the GID key.”

onion2k 12y ago

The implication of the article is that this is some sort of specific attack against Apple. Surely the reality is that the CIA, and pretty much all 3-letter agencies globally, in a concerted and organised way try to break the security of all secure devices. That's a big part of their job - you can't gather intelligence if you can't read it. The good things in the article are two-fold: firstly, Apple haven't just capitulated and handed over whatever is asked of them, and secondly the documents about the effort don't specifically mention any sort of success which could be interpreted as the agency failing. Of course, if they had been successful I imagine they'd keep as quiet as possible about it.

Intermernet 12y ago
I think the point of The Intercept releasing this Apple specific info (mostly, there's a bit about Microsoft being targeted as well) is to try to appeal to the large number of Apple customers. I'd love to see some of the other line items in the leaked CBJ document, as there are probably some other targeted attacks documented. Regarding Apple not capitulating, I'm giving them the benefit of the doubt, and assuming that they're telling the truth, but wouldn't the NSL system mean that Tim Cook couldn't reveal if Apple had been forced to release data? I'm hoping that he has a personal warrant canary policy, and would just remain silent if asked about something he can't talk about.
- a3n 12y ago
  "No comment" from Cook would be an interesting standoff. If he were prosecuted for it, that would confirm something NSL-like. But would it be worth it to a CEO to go to jail for a few years for a principle?
  - Intermernet 12y ago
    That of course, depends on the strength of said CEO's principles. This would be, of course, one of the hardest tests of professional principles you could imagine a CEO going through. I personally think Mr Cook would be a good candidate for passing this test, as he seems to have a track record for standing up for what he believes in. I also have a feeling that the US government would think twice before taking on the Apple PR juggernaut head to head. It would be too closely matched for comfort. Apple probably have greater mind-share than any of the political parties. As you say, it would be an interesting standoff!
    - jkestner 12y ago
      It's a little discomforting that we're hoping that corporations, presumably guided by a profit motive, will defend us against the government formed for the people (though more heavily influenced by other corporations). Even if Apple is trustworthy for a company, I'm not going to enjoy the future in which we pick our favorite companies to enact policy. Now, this is obviously happening to Google, et al, as well, so a joint action by the captains of industry — an appeal to the public more than the court — will be more effective.
      - mindcrime 12y ago
        Nothing wrong with "profit motive". Remember: It is not from the benevolence of the butcher, the brewer, or the baker that we expect our dinner, but from their regard to their own interest. ~~ Adam Smith That said, I'd personally like to see less power aggregated into the hands of both governments and big mega-corporations. But the big difference between the two, to my mind, is that governments have a near monopoly on "legitimate" use of force, and have lots of men with guns, tanks, bombers, nukes, etc. at their disposal. Corporations mostly lack those things, except to the extent that they collude with the governments.

ape4 12y ago

The CIA? Thought the NSA did this.

adventured 12y ago
Here's their mission statement: "Preempt threats and further US national security objectives by collecting intelligence that matters, producing objective all-source analysis, conducting effective covert action as directed by the President, and safeguarding the secrets that help keep our Nation safe." Historically the CIA and NSA have a competitive relationship, they vie for the same funding. I would think pursuing iPhone security would cross into the NSA's domain and that they wouldn't appreciate it, however the CIA has a budget 50% larger than the NSA and I'm sure they'd like to keep it that way by staying relevant.

okasaki 12y ago

The cynic in me feels that this might be part of a PR campaign coordinated between the US govt and US tech companies to try to give the impression of an adversarial relationship between the two. The article quotes Steven Bellovin: “Their attitude is basically amoral: whatever works is OK.” If you forgot the article, could you tell who this is talking about? The government or the corporations? It seems like it fits both pretty well. The two entities both have a lot to gain from cooperating. Why wouldn't they? Whatever works.

IBM 12y ago
Interesting twist when Glenn Greenwald/Snowden is now suspected of doing PR for tech companies.
- Intermernet 12y ago
  I must have missed that release, do you have any links?
  - IBM 12y ago
    https://news.ycombinator.com/item?id=9176630 https://news.ycombinator.com/item?id=9176630
    - Intermernet 12y ago
      You may have posted the wrong link there. It seems to be a link to @okasaki's comment, which doesn't seem to pertain to the issue you mentioned, and contains no links of it's own. I assume copypasta error? I'd still appreciate it if you have any links, as I'm trying to map out the various accusations and counter-accusations in the Snowden case. It's a good study in information warfare :-)
      - IBM 12y ago
        It's no error.
      - 12y ago

Asparagirl 12y ago

If I'm understanding this right, this article is claiming that the CIA served up [edit: could serve up, not proven they did, see comments below about plausibility] poisoned versions of XCode, which would then be used to make App Store apps that eventually phoned home to Langley with either app-specific data or whole-phone data. This raises so many questions, among them: 1) What was [edit: would be] the criteria for serving up a poisoned version instead of a real version of XCode to a dev? Was it [would it be] limited to downloadable versions or were DVD software copies affected too? One possibility came to mind: Does XCode come in different flavors based on county of sale/download, language, or a combo of the two? If so, would that be that criteria for their attempt to not target US citizens, by crudely targeting non-US and/or non-English app developer accounts? Because that would be the fakiest attempt yet at trying to claim plausible deniability, since so many apps with mainly American userbases are developed by overseas devs. 2) If a dev had a poisoned version of XCode, how could they not see a mysterious server being pinged during their development of the app? How could Apple not see something amiss during their QA of the app before they pushed it to the store? 3) If I were an evil genius Big Brother no holds barred government, I'd want data from messaging apps, social networks, and geolocation apps most of all, less so from things like single-player games. Thoughts on which apps are likely to be in the top 5 of their wishlist? 4) Does this mean that PhoneGap / Cordova / non-native HTML5 apps really are better? :-) Say, why did Facebook change to a native app again?

IBM 12y ago
They said they created a poisoned version of XCode, not that they were able to serve it up successfully to anyone.
- Asparagirl 12y ago
  True, but Snowden's data haul is at least a year and a half old by now, and some of the files cited in this article date back longer than that. But I edited my comment to include your point: no hard proof that this technique was used...yet.
- glitchdout 12y ago
  But they sure can serve it successfully. They control the cables through which everyone's internet traffic passes, and when you download a program (such as Xcode) they can substitute it with their poisoned program [1]. I'll quote: > All it takes is a single request from a victim passing a wiretap for exploitation to occur. Once the QUANTUM wiretap identifies the victim, it simply packet injects a 302 redirect to a FOXACID server. Now the victim’s browser starts talking to the FOXACID server, which quickly takes over the victim’s computer. ... or doesn't take over the victim's computer, but provides a download of a poisoned Xcode. These motherfuckers have compromised the whole internet. [1]: http://www.wired.com/2013/11/this-is-how-the-internet-backbone-has-been-turned-into-a-weapon/ http://www.wired.com/2013/11/this-is-how-the-internet-backbo...

rodgerd 12y ago

Apple should stage some sort of protest. Perhaps they should go on some sort of tax strike.

a3n 12y ago
I don't think it would have any material effect. Most if not all hyper-corporations route transactions off-shore, and hold cash off-shore, specifically to drastically reduce the amount of tax they pay.
- rodgerd 12y ago
  That was the joke.
- astrange 12y ago
  Apple is the #3 largest taxpayer in the US, and one of the few companies registered in California instead of Delaware.
  - a3n 12y ago
    No doubt. Nevertheless: https://duckduckgo.com/?q=apple+tax+ireland https://duckduckgo.com/?q=apple+tax+ireland The loophole(s) may have been closed, but I doubt Apple left them voluntarily.

p01926 12y ago

How much longer can this continue? We have American agencies attacking American companies "because terrorism". It's been 13 years since our trauma, maybe now's the time to remove the razor blade from our wrists, look ourselves in the mirror and just carry on. Bad stuff is always going to be in our future — stuff that will increasingly appear preventable between the Internet and a lot of hindsight — but our current solution is only making things worse. The war on terror, like all the metaphorical wars, is really a civil war. It needs to stop now.

belorn 12y ago
Unofficially, politicians has surrendered the "because terrorism" excuse for a while now, as they simply want access to everyones private information in order to see where the problem are going to be. Having the data helps plan and run successful elections, makes it easier to plan ahead, and gives them power over any department which doesn't has similar access. Imagine being in a political party while private intelligence contractor give you access to all the emails from the other side. You can know where all the activists are at any moment, and what the internal conflicts are, and what areas is focused. What would be your reaction if phones suddenly started to get encrypted?
- prawn 12y ago
  I don't think they want that. They take this course because "this was preventable!" is very politically disruptive. None of them want to be the guy who voted against mandatory data retention only to play host to an attack on home soil months later. It's sad, but that's the reality.
  - gohrt 12y ago
    The history of government spying, at least as far back as J Edgar Hoover, as been about spying on members of the opposition, not about ass-covering. ass-covering is just the current halfway-excuse.
- cmdkeen 12y ago
  You effectively had that during the latter Hoover years with the FBI. That the headquarters is still named after him is an indictment of the US approach to political corruption.

deleted 12y ago

[deleted]

chrisbennet 12y ago

It's interesting to see Ken Thompson's hypothetical compromised compiler being used for real. http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html

angersock 12y ago
Hah, yeah. The first bit of the article is very big about compromising XCode, and I couldn't help but think that Lockheed basically just got the .gov to pay them to "rediscover" Reflections on Trusting Trust.

JohnLen 12y ago

Test

littletimmy 12y ago

I don't buy it. I really don't. We know about the incredibly close ties between silicon valley and the military. We know that the US government collects anything and everything, and that US corporations are complicit (or made to be complicit) in the act. It is most likely that Greenwald was leaked these documents to create a facade of government-corporate animosity to revive trust in US corporations, all the while there existing a backdoor to facilitate snooping.

TillE 12y ago
The article explains that these are all documents from Snowden. So they're simply taken from the full set that Greenwald has had since 2013, not any kind of new leak.
zerohm 12y ago
The Federal Government can make tech firms hand over any data they request. However, they can't stop tech firms from designing their products so that the tech firm never sees your personal data.

r0h1n 12y ago

What strikes me after this revelation is how unique the United States is, because: (a) it has dozens of companies that create technology the rest of the world uses, and (b) it has a govt. that secretly works to undermine the technology developed by those companies. You're not going to hear about many foreign govt's actively hacking their country's software products, simply because they could easily/secretly armtwist cos. into installing backdoors at the beginning. Take China for instance - do we think it needs to hack into, say, Huawei phones or Wechat? I don't think so. As a foreigner, that is why this "fight" between US software cos. and its govt. is so fascinating. It's made possible through a unique combination of capital, freedom and history. And I hope it remains that way, for the sake of the rest of the world too.

flyryan 12y ago
Your example isn't a particular good one. Huawei has been accused of backdooring their products for the Chinese government on numerous occasions, including presentations at DEFCON exposing those backdoors. There are also numerous cases of backdoors in Chinese cell phones.
- lawnchair_larry 12y ago
  But his point was that China's government doesn't attack the company to get those.
  - wavefunction 12y ago
    How do we know how any putative arrangement of this type has come to be?
- lucio 12y ago
  That's exactly what he's saying: "You're not going to hear about many foreign govt's actively hacking their country's software products, simply because they could easily/secretly armtwist cos. into installing backdoors at the beginning"
task_queue 12y ago

MichaelCrawford 12y ago

This is a great argument for "Gentoo Android". While much of the iOS is Open Source or Free Software, the end-user can't really inspect the source that went into their particular device. Note that, to the extent that the CIA steals Apple secrets from foreign sources, they may not be violating any US laws. However Apple does the vast majority of its system software development in Cupertino, California. My next phone is going to be an Android that enables me to completely replace its firmware binary. While this does void the warranty, rather than having to be concerned about potentially skanky jailbreak exploits, one more or less just sets a flag with an Android SDK command-line tool, then you can install your own firmware. That will be of limited use in protecting me against hardware backdoors, but at least it will let me pretend that America is still The Land Of The Free. Among the reason I am so adamant about stuff like this, and that I use my real name when I post about it so publicly, is that I am related to Roger Sherman, the fourth signer of the US Declaration of Independence, as well as to William Tecumseh Sherman and George B. McClellan, the two Generals-in-Chief of the Union Army during the American Civil War. My mother was an active member of the Daughters of the American Revolution; I myself am entitled to membership in the Sons of the American Revolution.

gryph0n 12y ago
You might want to lookup the Replicant project. http://www.replicant.us http://www.replicant.us http://en.wikipedia.org/wiki/Replicant_(operating_system) http://en.wikipedia.org/wiki/Replicant_(operating_system) It looks like the development team could use some new contributors.
nezza-_- 12y ago
My next phone is going to be an Android that enables me to completely replace its firmware binary. I'm not aware of a single (modern) phone where you can replace the firmware of the baseband with something open source.
- seba_dos1 12y ago
  Openmoko Neo Freerunner. Might fall a bit outside of "modern" category though (and of course, operating GSM baseband processor with altered firmware on public networks is illegal)

MichaelGG 12y ago

Every time I read about a private company being targeted, I remember how simply state-level spies have been compromised. Hanssen[1], for instance, betrayed the CIA over 22 years, for just $1.4M. The info leaked included info on other agents, at least one who was executed. Or [2], Walker gave crypto info to decrypt Navy messages. For a few grand a month. There's plenty more listed even on Wikipedia. The amounts involved seem... not that high. Now, sure, Apple almost certainly has higher security. (Quote from the above spy: "KMart has better security than the Navy.") But with state level resources, do we think employees can be flipped? Or, why is the NSA not getting to grads early on, helping their career, while having them really be agents all along? I'm on my phone and can't find the reference now, but there was a young physicist that leaked into on atomic weapons purely because he felt the US shouldn't have a monopoly on the capability. The chance that some bright, highly-sought, employee feeling that the US should have spy capabilities is approximately 1. Is every remotely sensitive employee routinely monitored? Their families? They never get into " life threatening " scenarios? Or embarrassing scenarios that they might feel is the end? (For some, that's as simple as getting a mistress pregnant, and not being able to bear others knowing.) Just seems like the human employees have got to be compromisable in one form or another, given the resources of the NSA and CIA. 1: http://en.m.wikipedia.org/wiki/Robert_Hanssen http://en.m.wikipedia.org/wiki/Robert_Hanssen 2: http://en.wikipedia.org/wiki/John_Anthony_Walker http://en.wikipedia.org/wiki/John_Anthony_Walker

downandout 12y ago
> Or, why is the NSA not getting to grads early on, helping their career, while having them really be agents all along? It would be naive to think that they (and other agencies around the world) aren't already doing this.
- mcantelon 12y ago
  Yeah, I kind of assumed this was standard operating procedure, like Anderson Cooper's "internship" at the CIA.
deleted 12y ago
[deleted]

0xCMP 12y ago

Seriously. This isn't even bad. Go to DEFCON and you'll see a ton of people doing this crap. There is a reason a bunch of paranoid people (includes me) bought faraday cages for our phones. Everyone is trying to break in to the little black boxes we carry around with some of our most personal information. They have ACTUALLY done bad crap. This is normal security research. There is no need to blow normal research and security work out of proportion. Xcode is signed, they can't just modify it and let it go. The OS X updater is also likely secure and maybe they just figured out how to trick their own computers to install a keylogger. Good, but it probably doesn't work that well. And it's fine! It's research! Lets focus on the actual violations, not the tools. Exploits and social engineering doesn't compromise: people do. Focus on the people who broke the rules which make sure our country isn't manipulated in to an oligarchy.

jmcmichael 12y ago
The difference is that when the intelligence community discovers a hole in US-produced software, they will keep it to themselves to exploit the computers of individuals around the world in various operations of dubious value and/or legality. At DEFCON, exploits are publicized so that software vendors and algorithm developers are motivated to strengthen the security of what they produce so that the software that all of use is more effective against attackers.
deveac 12y ago
>Seriously. This isn't even bad....There is no need to blow normal research and security work out of proportion. Is normal security research done with the goal of finding/creating holes with the purpose of keeping them secret in order to use them as attack vectors without letting the owners of the compromised systems know about the vulnerabilities? What's bad about this is the purpose of the research (not to discover and strengthen security, but instead to destroy it), combined with the weaponization of it (the entire goal of doing the research is to use the exploits), and the actor carrying out the attacks (the state). It's obvious on its face why this is alarming.

Zelphyr 12y ago

As many have noted, this does need to stop but it won't. And the problem lies squarely with you and me. Try this experiment: Ask a group of 5-10 people around you to raise their hands if they've been pissed off at any branch or level of their government. Then ask them to keep their hands up if they've contacted their representatives about that issue. Finally, ask them if the method of contact they used was the phone or written (not email) letter. I'll bet dollars to donuts that not a single hand will be in the air. You and I are the problem because we don't hold our representatives accountable. We really only pay attention (and marginal attention at that) during election time by buying into the campaign bullshit. At best we sign an online petition but the politicians barely care about that. They know that its easy even for the most apathetic to click a button. Sure, in cases like net neutrality it can get their attention but I'll submit that what really got their attention was the number of phone calls they were getting. Yes, I specifically am to blame because I haven't called or written my representatives. That's going to stop. We need to be on the horn with these people frequently. Weekly. When they're in town we need to be in their faces. They said, "If you see something, say something." Well, I see corruption and I'm going to point right at them and tell them. Will you join me? EDIT: I should add that we need to be contacting them when we approve of the work they're doing. They need data. Most of the feedback they receive is negative (and for good reason) but without positive feedback they're left searching and unfortunately the guys who claim to have the answers are the lobbyists. But remember, there are around 15,000 lobbyists in Washington D.C. but 131,144,000 voters voted in the 2012 Presidential election. I like our chances, if only we get involved.

ripb 12y ago
>Will you join me? I wonder how many people are genuinely afraid of raising their own profile in such a way. I'm not American, but I would certainly be partaking in any political action against the actions being discussed here. Although as it is, I'm very hesitant to even level criticism at the CIA on HN. I'm by no means an important person, but from what we've learned I don't even want to register on the radar of these entities.
- Zelphyr 12y ago

shashu10 12y ago

I'd much rather have my iPhone hacked by Anonymous

lotsofmangos 12y ago

“Tearing apart the products of U.S. manufacturers and potentially putting backdoors in software distributed by unknowing developers all seems to be going a bit beyond ‘targeting bad guys.’ It may be a means to an end, but it’s a hell of a means.” The trouble with the means justifying the ends, is that ends are fictions invented to enable the telling of stories. Outside the structures required for stories, there is only ever really the means.

Nanzikambe 12y ago

Am I missing something? Isn't their targetting of Xcode as massive as if they'd just announced they'd backdoored Gnu gcc? I mean whether they've backdoored the regular version available to all or only those in use by specific developers, the implication (to me) would be that binaries/applications/etc produced would then be automatically backdoored or at very least weakened? Disclaimer: I know zip about Xcode or dev in the Apple ecosystem