5 ms·

If you want to find fault with Apple on privacy and security, one place to start would be its apparent lack of leadership on the increasing threat from maliciou

by leoc 11y ago

If you want to find fault with Apple on privacy and security, one place to start would be its apparent lack of leadership on the increasing threat from malicious USB (and no doubt Thunderbolt) devices. Likely no-one is better-placed than Apple to do something about this: it has the money and the market-share, a large engineering staff, a consumer-friendly reputation to defend and enhance, the UI expertise to come up with security provisions that users will actually understand and tolerate, and a history of clout and leadership in local-bus standards. But instead it seems to still have its head firmly stuck in the sand. Would it hurt so much to just throw a USB C condom into the box of the new MacBook, as an easy starting measure?

pilsetnieks 11y ago
- "apparent" - you don't know what they're doing about this on the inside. I doubt they're pretending there are no such issues and not working on it but their closed nature does hurt their appearance in these kinds of situations. - a USB condom is not a solution, it only prevents power sources using data channels. Data devices, which you still might want to use occasionally, are even more likely to be compromised. Plus, it does nothing if the attacker has physical access to the machine.
- leoc 11y ago
  > a USB condom is not a solution, it only prevents power sources using data channels. Of course it is not a perfect solution, but (like a real condom) it is a partial solution to the infection problem that is effective and not very burdensome. Charging is a major mode of vulnerability to USB attacks, quite likely the single biggest. And compared to the big, multi-sided task of redesigning USB and the systems around it, providing a USB condom for charging is cheap and straightforward. > "apparent" - you don't know what they're doing about this on the inside. Yes, this is why I used that qualifier. However, for a variety of reasons it does not seem probable that they happen to be preparing a big push on this issue internally.
rolandr 11y ago
I'm not sure why Apple should be singled out for addressing this. Plus, you're talking about a security issue that requires physical access to a machine - something a bit different from the issues of privacy, malware, NSA snooping, etc. It would seem more sensible to focus on those working up the USB specification (Intel, HP, NEC, etc.) to deliver a standard and hardware implementations less prone to attacks. Plus, pretty much _every_ USB stack has these issues - wasn't it Linux where we starting seeing proofs of concept? Actually, Apple has shown foresight in its hardware selection, as they have consistently selected Intel processors with Vt-d/IOMMU support (to this day, it remains difficult to find IOMMU-enabled notebook computers). This has allowed OSX to isolate Thunderbolt and neuter attacks: http://ilostmynotes.blogspot.com/2014/11/thunderbolt-dma-attacks-on-os-x.html http://ilostmynotes.blogspot.com/2014/11/thunderbolt-dma-att... Possibly a similar thing might be done for USB controllers as well...
- justabystander 11y ago
  > I'm not sure why Apple should be singled out for addressing this. You're correct in that it's not an Apple-only security issue. I'm not sure if the person you're replying to meant to imply that. However, Apple has never been particularly concerned with pointing out security vulnerabilities. Up until three years ago they were claiming that OSX didn't get viruses and that you could be safe by doing nothing. (http://www.theatlantic.com/technology/archive/2012/06/its-official-apple-computers-are-no-longer-virus-free/258902/ http://www.theatlantic.com/technology/archive/2012/06/its-of...) That's why Apple gets a lot of flak from security-oriented folk. They mislead tons of people into thinking that "Macs don't get viruses". And I still hear self-proclaimed geniuses who tell me this, and why it's the reason they'll only use Apple products. Considering Apple changed their slogan to "built to be safe" after being heavily compromised and criticized by the media, they do deserve a push to take care of hardware security issues by default. After all, security is built in, right? Shouldn't they make some proactive security efforts after advertising to their users repeatedly with the premise that their users shouldn't care about security? > Actually, Apple has shown foresight in its hardware selection That link you share came around four years after OSX (and Windows) had the login screen compromised with Firewire hacking devices (http://www.hermann-uwe.de/blog/physical-memory-attacks-via-firewire-dma-part-1-overview-and-mitigation http://www.hermann-uwe.de/blog/physical-memory-attacks-via-f...). Of which Apple was the primary vendor involved in pushing the standard. Not only that, it's talking about more modern devices being secure from an exploit that was used to compromise early Thunderbolt-enabled computers roughly two-and-a-half years prior (http://www.breaknenter.org/2012/02/adventures-with-daisy-in-thunderbolt-dma-land-hacking-macs-through-the-thunderbolt-interface/ http://www.breaknenter.org/2012/02/adventures-with-daisy-in-... and http://www.breaknenter.org/projects/inception/ http://www.breaknenter.org/projects/inception/). The fact that Apple started utilizing IOMMU to counter DMA attacks and moved away from Firewire isn't foresight - it's reactive. Admitted, a good reaction. That's how a lot of security procedures end up. But let's not pretend that they're ahead of the game on security when they aren't. > Possibly a similar thing might be done for USB controllers as wel It's been done for USB, Firewire, Thunderbolt, any hotpluggable PCI/PCI-e expansion port/socket (because you can plug the above in unless it's disabled in the OS). Pretty much anything with DMA in it is an issue. > Plus, you're talking about a security issue that requires physical access to a machine You're assuming direct malicious intent. Which might be the case for jealous spouses and high-value targets. But a far more likely consumer scenario is handing your USB stick to a friend with a compromised computer to share a file. After he plugs it in, his malware-infested computer overwrites the USB device's firmware as a new attack vector. When you get it back and use it again, your computer becomes infected. It's not common now, but it's not really that far fetched.

by leoc 11y ago

pilsetnieks 11y ago

- "apparent" - you don't know what they're doing about this on the inside. I doubt they're pretending there are no such issues and not working on it but their closed nature does hurt their appearance in these kinds of situations. - a USB condom is not a solution, it only prevents power sources using data channels. Data devices, which you still might want to use occasionally, are even more likely to be compromised. Plus, it does nothing if the attacker has physical access to the machine.

leoc 11y ago
> a USB condom is not a solution, it only prevents power sources using data channels. Of course it is not a perfect solution, but (like a real condom) it is a partial solution to the infection problem that is effective and not very burdensome. Charging is a major mode of vulnerability to USB attacks, quite likely the single biggest. And compared to the big, multi-sided task of redesigning USB and the systems around it, providing a USB condom for charging is cheap and straightforward. > "apparent" - you don't know what they're doing about this on the inside. Yes, this is why I used that qualifier. However, for a variety of reasons it does not seem probable that they happen to be preparing a big push on this issue internally.

rolandr 11y ago

I'm not sure why Apple should be singled out for addressing this. Plus, you're talking about a security issue that requires physical access to a machine - something a bit different from the issues of privacy, malware, NSA snooping, etc. It would seem more sensible to focus on those working up the USB specification (Intel, HP, NEC, etc.) to deliver a standard and hardware implementations less prone to attacks. Plus, pretty much _every_ USB stack has these issues - wasn't it Linux where we starting seeing proofs of concept? Actually, Apple has shown foresight in its hardware selection, as they have consistently selected Intel processors with Vt-d/IOMMU support (to this day, it remains difficult to find IOMMU-enabled notebook computers). This has allowed OSX to isolate Thunderbolt and neuter attacks: http://ilostmynotes.blogspot.com/2014/11/thunderbolt-dma-attacks-on-os-x.html http://ilostmynotes.blogspot.com/2014/11/thunderbolt-dma-att... Possibly a similar thing might be done for USB controllers as well...

justabystander 11y ago
> I'm not sure why Apple should be singled out for addressing this. You're correct in that it's not an Apple-only security issue. I'm not sure if the person you're replying to meant to imply that. However, Apple has never been particularly concerned with pointing out security vulnerabilities. Up until three years ago they were claiming that OSX didn't get viruses and that you could be safe by doing nothing. (http://www.theatlantic.com/technology/archive/2012/06/its-official-apple-computers-are-no-longer-virus-free/258902/ http://www.theatlantic.com/technology/archive/2012/06/its-of...) That's why Apple gets a lot of flak from security-oriented folk. They mislead tons of people into thinking that "Macs don't get viruses". And I still hear self-proclaimed geniuses who tell me this, and why it's the reason they'll only use Apple products. Considering Apple changed their slogan to "built to be safe" after being heavily compromised and criticized by the media, they do deserve a push to take care of hardware security issues by default. After all, security is built in, right? Shouldn't they make some proactive security efforts after advertising to their users repeatedly with the premise that their users shouldn't care about security? > Actually, Apple has shown foresight in its hardware selection That link you share came around four years after OSX (and Windows) had the login screen compromised with Firewire hacking devices (http://www.hermann-uwe.de/blog/physical-memory-attacks-via-firewire-dma-part-1-overview-and-mitigation http://www.hermann-uwe.de/blog/physical-memory-attacks-via-f...). Of which Apple was the primary vendor involved in pushing the standard. Not only that, it's talking about more modern devices being secure from an exploit that was used to compromise early Thunderbolt-enabled computers roughly two-and-a-half years prior (http://www.breaknenter.org/2012/02/adventures-with-daisy-in-thunderbolt-dma-land-hacking-macs-through-the-thunderbolt-interface/ http://www.breaknenter.org/2012/02/adventures-with-daisy-in-... and http://www.breaknenter.org/projects/inception/ http://www.breaknenter.org/projects/inception/). The fact that Apple started utilizing IOMMU to counter DMA attacks and moved away from Firewire isn't foresight - it's reactive. Admitted, a good reaction. That's how a lot of security procedures end up. But let's not pretend that they're ahead of the game on security when they aren't. > Possibly a similar thing might be done for USB controllers as wel It's been done for USB, Firewire, Thunderbolt, any hotpluggable PCI/PCI-e expansion port/socket (because you can plug the above in unless it's disabled in the OS). Pretty much anything with DMA in it is an issue. > Plus, you're talking about a security issue that requires physical access to a machine You're assuming direct malicious intent. Which might be the case for jealous spouses and high-value targets. But a far more likely consumer scenario is handing your USB stick to a friend with a compromised computer to share a file. After he plugs it in, his malware-infested computer overwrites the USB device's firmware as a new attack vector. When you get it back and use it again, your computer becomes infected. It's not common now, but it's not really that far fetched.