Apple Disputes Some Details of Google's Project Zero Report on iOS Security Vulnerabilities [Updated]

[rafark]

The attack cannot just be narrow. This says a lot about how apple views its customers. This is the Internet, as long as the attack involves HTTP/HTML/CSS/JAVASCRIPT then anyone with a domain ($1/first year) and a web server (from $3/mo) could have done it. And there are dozens of millions of websites out there. It would be silly to think only a handful of sites out of 100+ million were taking advantage of the vulnerability.

 

[Naaaaak]

There is no excuse for Google failing to mention the fact that this hack was from a nation state actor and that it was narrowly targeted at China's Muslim ethnic minority.

Toss in the fact that they also left out the fact that Android had also been targeted, and there really is just no excuse whatsoever.

I maintain that the manner in which google went about their disclosure has brought more harm to the Apple community (in the form of needless hysteria and fear, but I guess the media needs to share in the blame as well) than it has helped.

The only two motivations I can see are Google wanting to harm a competitor, or them being worried about their ability to get back into China.

Neither is a good look.

Google disclosed the issues to Apple privately, then waited until the fixes were released, before disclosing them publicly.

Google didn't write a press release about these issues. Apple did.

Google's Project Zero team is mentioned frequently in Apple's security release notes. They have a history of discovering and correctly disclosing security problems on Apple platforms.

Their team could have said nothing and we'd be all worse off for it.

Meanwhile, Tim Apple hypes up privacy and security every chance he gets, even though iOS and macOS are probably closer to Windows 95-tier in terms of security.

 

[macfacts]

There is no excuse for Google failing to mention the fact that this hack was from a nation state actor and that it was narrowly targeted at China's Muslim ethnic minority.

There's no legit excuse for apple rolling over and failing to mention it was china doing the hacking.
[doublepost=1567941192][/doublepost]

Part of me wonders if Google uses Project Zero, at least in part, as a smoke screen to divert attention from their own unenviable security situation. We know of Google's own security problems with both Android and their Play Store - problems that hit the computer security news weekly. Are Technica alone can probably provide dozens of examples from just 2019. In contrast, Apple's security record from a news perspective is profoundly enviable, and I do understand if Google is anxious to take Apple down a peg or two just so it doesn't seem so bad in comparison.

Second, the usual Apple-bashing, be it deserved or undeserved, is practically a cultural phenomenon at this point, especially when you know the competition and opinion journalists have a tendency to exaggerate the scale of the actual issue. I guess this is a package deal when you are an Apple product user.

Third, while I understand people expecting or desiring a different sort of response from Apple, I actually appreciate what Apple has provided here. The omission of any detail about compromised websites by Google was (IMO) unnecessary, and left me as an iOS user wanting more info (i.e. was my device exploited visiting tech blog x?). As someone living in Singapore, while the Uighur situation is obviously horrendous, Google's report did nothing to answer any burning questions I might have, and simply served to generate more alarm than it otherwise should have.

In this regard, Apple's response actually provided a lot more context. I now know that this wasn’t randomly hitting thousands of users all over the world (thus increasing chance of detection), but thousands of very specific users in a very specific bit of the world.

Knowing the compromised sites were also going after Android and Windows devices (albeit with less exotic exploits) is also useful additional info, I think (but the critics will likely say that I am deflecting).

I don't understand the criticism levelled at Apple in this regard. It is not the business of Apple's software security team to condemn the unpleasant surveillance regimes of governments. If anything, Apple has gone one step further by pointing the finger directly at the Chinese, something I don't believe anyone else has done. Not even Google, whom in theory should have been able to take the high road here because it doesn't have any business ties with China.

I suppose one could argue that Apple kinda brought it on themselves, by allowing themselves to become too addicted to China's inexpensive and competent labour chain, which in turn gives Apple a strong incentive to turn a blind eye towards China's criminal behaviour, both locally and internationally. For Apple's sake, I hope that they take their manufacturing out of China sooner than later.

@macfacts Now that I have had some time to think this through, I retract my earlier statement about Google lying. While Google technically did tell the truth, what they have done here is even more disingenuous and dishonest than if they had just flat-out lied, IMO.

Got it. The hack was real but it only affected a small number of users. Seems like that is the typical apple response.

 

[Abazigal]

Google disclosed the issues to Apple privately, then waited until the fixes were released, before disclosing them publicly.

Google didn't write a press release about these issues. Apple did.

Google's Project Zero team is mentioned frequently in Apple's security release notes. They have a history of discovering and correctly disclosing security problems on Apple platforms.

Their team could have said nothing and we'd be all worse off for it.

Meanwhile, Tim Apple hypes up privacy and security every chance he gets, even though iOS and macOS are probably closer to Windows 95-tier in terms of security.

The chief reason why Apple even felt compelled to release a statement of their own is precisely because Google was so vague and threatened to create more problems and uncertainty than it was supposed to address.

Which brings me to what I feel is the bigger issue at hand. That this report came from Google. And Google simply cannot be a neutral party here. A security group is revealing flaws in a product for which their employer is the primary competitor. Billions of dollars are at stake in public perception of these competing platforms.

I am not discounting the work that these Google researchers have done. They found critical flaws, and ultimately did the right thing in disclosing them and helping them get fixed. But it’s irresponsible of the Google Zero team to pretend they’re a neutral party here. They know that journalists will pounce on whatever they say (all the more when it’s Apple) and whip it up into a compelling narrative. They know that their security work relies on a delicate truce between two competitors. But because of who they work for, because of whose name is on their work, they risk undermining their whole effort unless they assiduously stick to the facts.

Instead, the team has chosen to speculate in public about the internal failure of a competitor. When they imagine — without really knowing — that they see “code that likely skipped QA or likely had little testing or review before being shipped to users,” that’s a shot across the bow.

So either the security team needs to stay factual and stick to the evidence when talking about a competitor’s projects, or spin themselves off them from Google. They are literally playing with fire here, with their credibility on the line.

 

[Abazigal]

There's no legit excuse for apple rolling over and failing to mention it was china doing the hacking.

Does Apple really need to mention the Chinese? What's the point, when it is blatantly obvious to anyone with common sense that the Chinese gov't is behind this.

Got it. The hack was real but it only affected a small number of users. Seems like that is the typical apple response.

As an Apple user, it’s the response that would be meaningful and useful to me. I know the scope of the problem and have a clearer idea of whether I was affected or not.

Which again is a lot more than what google provided.

 

[macfacts]

So either the security team needs to stay factual and stick to the evidence when talking about a competitor’s projects, or spin themselves off them from Google. They are literally playing with fire here, with their credibility on the line.

The report stated the exploits were in iOS 10 and up, over 2 years old but apple is trying to make us believe the timeframe of this hack was only 2 months with no evidence supporting that claim.

 

[I7guy]

...

Got it. The hack was real but it only affected a small number of users. Seems like that is the typical apple response.

Makes sense based on the market share folderol or argument. /s
[doublepost=1567944106][/doublepost]

The report stated the exploits were in iOS 10 and up, over 2 years old but apple is trying to make us believe the timeframe of this hack was only 2 months with no evidence supporting that claim.

So Apple is flat out lying, according to you?
[doublepost=1567944244][/doublepost]

...Meanwhile, Tim Apple hypes up privacy and security every chance he gets, even though iOS and macOS are probably closer to Windows 95-tier in terms of security.

Doesn’t really say much about android then which must be closer to windows 3.1 then.

 

[Abazigal]

The report stated the exploits were in iOS 10 and up, over 2 years old but apple is trying to make us believe the timeframe of this hack was only 2 months with no evidence supporting that claim.

The two aren't mutually exclusive.

That the exploit has been around since iOS 10, theoretically giving hackers the ability to infect fully iPhones for at least two years doesn't mean that our iPhones have in fact been exposed for that long. The report makes no mention of how long the affected sites were actively and indiscriminately exploiting iPhone users, which to me is the more important and relevant statistic.

Instead, the report chooses to omit just enough information to paint a far worse picture than what probably really happened and put Apple in the worst light possible.

And I don't believe that given their resources, the Project Zero team didn't know that the website affected were those related to the Uighur community, that the threat was likely contained, or the impact that their ambiguously-worded report would have, given the press's tendency to pounce on any piece of Apple-related news and blow it completely out of proportion.

This is why I say that while Project Zero may be a great organization in terms of the value of the work that they do, they are undeniably Google through and through, and either they were extraordinarily clumsy in their announcement, or they were throwing mud deliberately.

 

[Abazigal]

Google disclosed the issues to Apple privately, then waited until the fixes were released, before disclosing them publicly.

Google didn't write a press release about these issues. Apple did.

Google's Project Zero team is mentioned frequently in Apple's security release notes. They have a history of discovering and correctly disclosing security problems on Apple platforms.

Their team could have said nothing and we'd be all worse off for it.

Meanwhile, Tim Apple hypes up privacy and security every chance he gets, even though iOS and macOS are probably closer to Windows 95-tier in terms of security.

I am simply saying that Apple is (understandably) trying to minimize the commercial damage from Google's announcement of their flaw, and that a lot of the moral caterwauling was naive at best.

Apple clearly makes a major effort to make their OS as secure as possible. That does not guarantee 100% security, and the Google team may well not have found everyone who has been affected by these flaws. Or all of the flaws. On the other hand, Apple clearly moved quickly to correct these flaws, and we have current evidence that only a small population was targeted by one of the most highly motivated 800 lb gorillas in the room, which was not the impression in the initial headlines.

 

[gatorguy2]

There is no excuse for Google failing to mention the fact that this hack was from a nation state actor and that it was narrowly targeted at China's Muslim ethnic minority.

Toss in the fact that they also left out the fact that Android had also been targeted, and there really is just no excuse whatsoever.

I maintain that the manner in which google went about their disclosure has brought more harm to the Apple community (in the form of needless hysteria and fear, but I guess the media needs to share in the blame as well) than it has helped.

The only two motivations I can see are Google wanting to harm a competitor, or them being worried about their ability to get back into China.

Neither is a good look.

Is "anonymous source says" now acceptable proof? For all we know the unidentified source claiming Windows was exploited on those same sites (Microsoft denies it) and Android too (Apple doesn't say that nor does anyone willing to be named) may have been a PR agent acting for Apple. Surely you've heard of plausible deniability.

The only verifiable evidence that Android might have been targeted as well comes from a NAMED source, Volexity.
So what does the independent security research firm have to say?

Only one of the those eleven identified watering holes may have tried to exploit Android devices as well....
but using an exploit that Google closed with Chrome 60 back in 2017.

I will absolutely agree Project Zero's blog should have been far more reassuring that this particular effort was a specifically regional one. Unless you read carefully if was too easy to come away with the impression of millions at risk from that specific set of exploits. I didn't particularly care for the inferences either. Tit for Tat is a playground ploy.

But with that said this is but one of them that was reported. As has been noted elsewhere there are almost certainly others that have not been, perhaps some not discovered. This one was stumbled upon by the Threat Analysis Group, and one of around 200 others privately disclosed to Apple by Project Zero.

Neither iOS nor Google Android is completely safe from a skilled and incentivised attacker. But BOTH are exceptionally secure for 99% of the general population 99% of the time. Neither should ever be promoted as insecure. particularly for penile measuring purposes, because they are not despite the overwrought and breathless pronunciations of blogs and publications trying to incite response and attract readers. Blind fans of any platform promoting FUD (malware infested, spying, selling you) do no service to you, or me, or Mike and Minnie Smith in Anytown who end up so misinformed and scared about tech in general that they end up mistrusting all of it, Apple included.

A slice of Stagefright anyone, with Quadrooter for frosting?

 

[I7guy]

...

Second, the usual Apple-bashing, be it deserved or undeserved, is practically a cultural phenomenon at this point, especially when you know the competition and opinion journalists have a tendency to exaggerate the scale of the actual issue. I guess this is a package deal when you are an Apple product user..

It’s my opinion Apple customers outside of this bubble go about their lives just using the product not participating in the narrow minutiae that many in here engage in. The critics make a mountaintop out of a molehill while the fans tear down the mountaintop into a molehill...and so it goes.

 

[Strelok]

Something that some people still don’t seem to have understood with all this is that Apple fixed the exploit within a week of being notified by Google’s team. You can’t fix what you don’t know.

 

[Lalatoon]

Only a double standard in some people's mind as some would want Apple not to do business in China. However, the difference is it's pretty open the business arrangement as opposed to an unknown number of websites (1 to infinity) infecting an unknown number of iphones (1 to infinity)

That's a much different conversation than this thread is about.

So you're saying its okay for you that Apple as a self-proclaimed champion of privacy will not respect the privacy of its Chinese user base so that they can do business in China and profit billions of dollars? I think its not just Apple having double standard

 

[I7guy]

So you're saying its okay for you that Apple as a self-proclaimed champion of privacy will not respect the privacy of its Chinese user base so that they can do business in China and profit billions of dollars? I think its not just Apple having double standard

Yes. I’m saying Apple, and all other companies have to do what they need to do in order to do business outside of the United States. And as a champion of privacy the arrangement of iCloud is known and people can decide for themselves if they want to use iPhone and what features of iPhone to use. As long as it’s out in the open let the people decide.

 

[Lalatoon]

The chief reason why Apple even felt compelled to release a statement of their own is precisely because Google was so vague and threatened to create more problems and uncertainty than it was supposed to address.

Which brings me to what I feel is the bigger issue at hand. That this report came from Google. And Google simply cannot be a neutral party here. A security group is revealing flaws in a product for which their employer is the primary competitor. Billions of dollars are at stake in public perception of these competing platforms.

I am not discounting the work that these Google researchers have done. They found critical flaws, and ultimately did the right thing in disclosing them and helping them get fixed. But it’s irresponsible of the Google Zero team to pretend they’re a neutral party here. They know that journalists will pounce on whatever they say (all the more when it’s Apple) and whip it up into a compelling narrative. They know that their security work relies on a delicate truce between two competitors. But because of who they work for, because of whose name is on their work, they risk undermining their whole effort unless they assiduously stick to the facts.

Instead, the team has chosen to speculate in public about the internal failure of a competitor. When they imagine — without really knowing — that they see “code that likely skipped QA or likely had little testing or review before being shipped to users,” that’s a shot across the bow.

So either the security team needs to stay factual and stick to the evidence when talking about a competitor’s projects, or spin themselves off them from Google. They are literally playing with fire here, with their credibility on the line.

If you read the report, there is no hint of malice or bias or whatsoever, it is purely a technical report and very detailed at that. It was Apple who spin the whole story to whatever it is now. If they could have just admitted that they had the vulnerability and fixed it and will promise that will not happen again then this could have been not an issue at all.

How about before we start barking we read the report first.

https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html

 

[Abazigal]

So you're saying its okay for you that Apple as a self-proclaimed champion of privacy will not respect the privacy of its Chinese user base so that they can do business in China and profit billions of dollars? I think its not just Apple having double standard

I don't get why anyone is expecting sainthood out of a large corporation. Apple has publicly stated that they intend to adhere to the laws and rules of any country they choose to operate in. This means that yes, when they operate in China, they will have to follow the rules laid out by the Chinese government.

If you want to boycott China over the treatment of the Uighurs, I would not urge you to stop.

I reiterate my earlier points. A flaw was found, Apple moved quickly to correct it, and I am going by Apple's word that only a small population of users was targeted by a state actor. Because it wasn't randomly hitting users all over the world, this made it harder to detect (which goes against Google's insinuation that this was the result of "cases of code which seems to have never worked, code that likely skipped QA or likely had little testing or review before being shipped to users".

In the same vein, it is not the job of Apple's security team to call out on the unpleasant surveillance regimes of governments, but to provide context to the earlier accusations (eg: who exactly were affected, and for how long), which is precisely what they did.

A lot of this could have been avoided had Google Zero been a lot less vague and disingenuous in the way they worded their report.

If you read the report, there is no hint of malice or bias or whatsoever, it is purely a technical report and very detailed at that. It was Apple who spin the whole story to whatever it is now. If they could have just admitted that they had the vulnerability and fixed it and will promise that will not happen again then this could have been not an issue at all.

How about before we start barking we read the report first.

https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html

I have read the report, and have highlighted the parts I felt were disingenuous in my response above.

It didn't occur to me before, but I am starting to get more and more suspicious as to Google's real intentions behind setting up their Zero team.

 

[Lalatoon]

Yes. I’m saying Apple, and all other companies have to do what they need to do in order to do business outside of the United States. And as a champion of privacy the arrangement of iCloud is known and people can decide for themselves if they want to use iPhone and what features of iPhone to use. As long as it’s out in the open let the people decide.

In regards with China and Apple and privacy, its not just about iCloud but a lot more. Anyway, your response says it all. I have no come back for that. It is safe to say you are one of Apples greatest fan because you are willing to defend the company's darker side.

 

[I7guy]

...If they could have just admitted that they had the vulnerability and fixed it and will promise that will not happen again then this could have been not an issue at all...

This doesn’t track. How is Apple( or any company) supposed to promise they won't have a future bug. And ten months after the fact, the critics have decided this is an issue, while the fans don't see any of this as an issue. Seems to be a normal day here in MR.

Of course a zero day is bad and every platform has them or has had them. IOS can pride itself in that this stuff is mostly contained.

 

[gatorguy2]

Something that some people still don’t seem to have understood with all this is that Apple fixed the exploit within a week of being notified by Google’s team. You can’t fix what you don’t know.

Yup, an excellent response time. Google's Android team is not always (but sometimes) as quick. Kudos to Apple.

 

[I7guy]

In regards with China and Apple and privacy, its not just about iCloud but a lot more. Anyway, your response says it all. I have no come back for that. It is safe to say you are one of Apples greatest fan because you are willing to defend the company's darker side.

The company has no dark side, it's doing what it needs to in order to business all over the world. However, I like the labels, and if I'm a fan, does that make you a critic willing to criticize the company needlessly?

 

[ipponrg]

The company has no dark side, it's doing what it needs to in order to business all over the world

Isn’t that the epitome of a dark side?

Do you think you can do business all over the world without having dark sides? There have been so many concrete examples of Apple not being that white knight that you and others are spouting. I am not sure why you continue to preach this

 

[Lalatoon]

The company has no dark side, it's doing what it needs to in order to business all over the world. However, I like the labels, and if I'm a fan, does that make you a critic willing to criticize the company needlessly?

Like I said you are the greatest fan.

Needlessly? For us who are not a member of any company greatest fan club, it is worth mentioning that Apple a self proclaimed champion of privacy in US is disregarding the basic privacy rights of other people in another nation just to continue selling its product and profiting billions. It is safe to say that this act is much worse that Google or Facebook. At least Facebook and Google is not dancing with the Chinese totalitarian government.

 

[I7guy]

Isn’t that the epitome of a dark side?
...

One word answer. NO. You can try to say it's a dark side, but it isn't. It's complying with internation regulations.

Like I said you are the greatest fan.

This has been discussed ad-nauseum and the great critics of MR seems to have all gotten it wrong. But labeling a poster is far afield of the thread topic.

 

[Lalatoon]

This doesn’t track. How is Apple( or any company) supposed to promise they won't have a future bug. And ten months after the fact, the critics have decided this is an issue, while the fans don't see any of this as an issue. Seems to be a normal day here in MR.

Of course a zero day is bad and every platform has them or has had them. IOS can pride itself in that this stuff is mostly contained.

Its 8 months since the exploit was discovered Feb and its still September.

Its the opposite, understanding that every system has its zero day that could have been the end of it however Apple released their statement. In my opinion which I know you dont care about Apple just ridiculed itself.

 

[Abazigal]

Like I said you are the greatest fan.

Needlessly? For us who are not a member of any company greatest fan club, it is worth mentioning that Apple a self proclaimed champion of privacy in US is disregarding the basic privacy rights of other people in another nation just to continue selling its product and profiting billions. It is safe to say that this act is much worse that Google or Facebook. At least Facebook and Google is not dancing with the Chinese totalitarian government.

I think you are conflating security with privacy.

While I won't go so far as to claim that Apple's software is 100% secure, I think that most can agree that Apple has done a respectable job overall with iOS in particular and that it is far better than the vast majority of commercial OSes. Yes, there have been problems, but that’s to be expected. It’s not at all accurate to say or imply that iOS (or macOS) are any less secure than any other widely used operating systems.

That’s not to say Apple can’t or shouldn’t improve. Security is a constant game of whack-a-mole at the end of the day. They can and they should. But OSes are hard. Everyone knows this.

When it comes to privacy, however, I feel there is no contest. Apple does care more about user privacy moreso than other commercial OS providers and absolutely does more to protect and respect the privacy of its users. Sure, mistakes are absolutely made (as in the recent Siri fiasco), but as a whole, I find that Apple goes out of its way to protect users’ privacy even when it slows progress on software (again, see Siri). It’s easy to argue that this is easy for Apple since hardware is their main business, but who cares? The end result is the same. Increased respect for user privacy.

Security and privacy, while linked, are not the same. What happened was a security issue that was fixed in February (as of iOS 12.1.4), soon after Apple was made aware of it. What exactly are we arguing about again?