Forensic Expert Questions Covert 'Backdoor' Services Included in iOS by Apple

[viacavour]

Nothing you said negates what the OP is discussing. It's more secure than Android? So what? That has nothing to do with the subject of the OP. IF the OP is correct in it's assertions, how is more secure than Android going to change the fact of a backdoor in iOS?

Of course it does. Some people are trying to use this article to say that Mac users have double standard when judging Android. We are not.

iOS is still much more secure than Android. Plus what that dude presented are only half truths. There are other facilities in iOS's multi-layer security to prevent an attacker from stealing all data from the device. Sensitive data are encrypted multiple times, and even signed if necessary.

 

[OS X Dude]

Forensic Expert Questions Covert 'Backdoor' Services Included in iOS by Apple

CarrierIQ was removed from iOS 5 and it is likely it was in each revision of iOS prior to that. It was most likely replaced with something in house and more convert (what they mention in this article) since CarrierIQ has such a horrid reputation. So secret behind the scenes data collection certainly "happened under Jobs".

https://www.macrumors.com/2011/12/0...q-in-ios-5-complete-removal-coming-in-future/

As I said in my post, his hands may have been tied with the prospect of litigation. But as posters above say, things definitely got worse after his departure.

 

[dollystereo]

This really sucks, anyway, I have never trusted apple about my information.
All the big data companies do the same, sell your data, it's all about that.

 

[pickaxe]

Steve Jobs did- he wouldn't allow anyone to have any backdoor into Apple software.

6 months after he died, Apple joined the PRISM program. The new Apple is not like the old Apple.

This is what Apple fans actually believe.

 

[GoodWatch]

I don't understand why people get so worked up about this sort of thing.

Those backdoors are there for your protection. They are put there for the exclusive use of the governments who we democratically elected. i.e.: the good guys.

We should all stop being so suspicious, and learn to fully trust the NSA and GCHQ. These guys are serious, trained professionals - not spotty nerds who are out to steal credit card numbers or pictures of your girlfriend!

As long as these backdoors are secure (and surely they are!), then we have nothing to fear.

You are so right, Apple isn't like Google at all. It's just for our protection.

 

[DYER]

I don't understand why people get so worked up about this sort of thing.

Those backdoors are there for your protection. They are put there for the exclusive use of the governments who we democratically elected. i.e.: the good guys.

We should all stop being so suspicious, and learn to fully trust the NSA and GCHQ. These guys are serious, trained professionals - not spotty nerds who are out to steal credit card numbers or pictures of your girlfriend!

As long as these backdoors are secure (and surely they are!), then we have nothing to fear.

You have actually got to be kidding me.
Yes that's a brilliant way of looking at it, because no government organisation has ever exploited their people.

And you saying that the backdoors are secure... that's hilarious.
You don't live in the real world.

On another note, I'm not even vaguely surprised to hear this is going on, it should be fairly obvious to work out this is happening. It's a shame to see larger companies 'in-bed' with governments but that's simply the nature of the beast.

Will it stop me from using my iPhone? No of course not, it just annoys me knowing that apparently no one is entitled to a private life.

 

[viacavour]

This really sucks, anyway, I have never trusted apple about my information.
All the big data companies do the same, sell your data, it's all about that.

I don't care if you trust big companies like Apple, but nothing in the article says that Apple sell your data. I use a different email account for iCloud, and it hasn't been spammed yet.

----------

As I said in my post, his hands may have been tied with the prospect of litigation. But as posters above say, things definitely got worse after his departure.

What got worse after Jobs' departure ? Security got better.

The level of trust got worse for all US businesses because of the NSA leak. This would happen even if Jobs were alive today.

 

[Sydde]

Anyone have a Time Capsule? For some strange reason, it simply does not want to function without an internet connection. At the very least, it will not set up unless it is online. I am not exactly clear why that is, if there are no backdoors involved.

 

[braddick]

Read the slides he provided. All your data can be pulled off your device, remotely. private photos, contacts, massages, emails, even records you have deleted. This data can be valuable to "anyone".

The effort to do so VS the payday in doing so isn't worth it.
(I know with others, certainly that's not the case- yet with many of us this rings true.)

 

[mytakeontech]

There is no reason to believe Apple would ever do anything to deliberately compromise the security of our data. Apple is the one company that strives to do everything to protect us and our privacy from prying eyes.

Looks like you don't need to drink coolaid for some more time. You can be taken off the dose until some time in future.

 

[ChrisA]

Yeah. No thanks. Get this crap off my phone.

The ONLY way you can ever be sure is to use open sourse software and build it yourself.

 

[wizard]

My god man you need to see a doctor.

Only drug dealers and criminals would have to be worry about this.

Baloney. If these capabilities are real you can count on drug dealers and criminal exploring them to use against people like you and me.

Kids... be sure those back doors are not meant to see the porn you are watching.

What does that have to do with anything? Do you even understand what this discussion is about?

What is amazing is the ego of the people who say: ohhh... I do not trust Apple any more! And they are in the internet posting. An smart person just do not post anything in first place in public places.

You really don't get it do you? This has nothing to do with trusting Apple, it has everything to do with a government you can't trust and with the fact that backdoor a can be exploited by anybody. Just consider how the IRS has been used to harass and prosecute people for political leanings - we simply do not have a government we can trust.

Then you are complaining when a plane goes down or when there is a terrorist act: where was the CIA?

Well first of four approach to terrorism is way too timid, you deal with terrorist by whipping them out and stop crying about civilian casualties. The CIA has little impact in this regard as they don't have the capability to nuke anyone. In any event this is the NSA and you should ask yourself when was the last time someone working at the NSA killed anyone!

Today they can track your messages, position, everything! and trust me, that is an issue that has stopped gang members from committing murders.

First off gang members are to stupid to even understand what is going on. Beyond that the few that have a little bit of intelligence simply leave their cell phones at home.

If I have an iPhone and I get murdered, the police will know where I was and the messages exchanged and they can compare my position with the suspects.

If you get murdered we will have one less delusional person walking the streets. Sorry to say this but people so out of touch will rarely be missed.

I am very free for Apple to be doing that, as I say, I live in the real world, I am not a show off ego maniac kid.

Nope you area childish individual who has a mind full of mush. Even if we had a perfect government, which we don't, security weak spots will be exploited by the criminal world. It is a given and is demonstrated everyday.

 

[69Mustang]

Of course it does. Some people are trying to use this article to say that Mac users are using double standard. We are not.

iOS is still secure than Android. Plus what that dude present is only half truths. There are other facilities in iOS's multi-layer security to prevent an attacker from stealing all data from the device. Sensitive data are encrypted multiple times, and even signed if necessary.

Why are you bringing up Android? It has absolutely nothing to do with the topic. What does it matter to an iOS owner what capability Android has. None. According to the OP, there are companies already using the backdoor to sell services to law enforcement.

Personally, I think the guy asks some valid questions. Excerpted from ZDNet article:
Zdziarski's questions for Apple include:

1. Why is there a packet sniffer running on 600 million personal iOS devices instead of moved to the developer mount?
2. Why are there undocumented services that bypass user backup encryption that dump mass amounts of personal data from the phone?
3. Why is most of my user data still not encrypted with the PIN or passphrase, enabling the invasion of my personal privacy by YOU?
4. Why is there still no mechanism to review the devices my iPhone is paired with, so I can delete ones that don’t belong?

Again, if any of that is true, I would like to know why.

 

[kwijbo]

Care to explain again, Mr. Cook?

(skip to 42 seconds, can't get the URL parameters to work with the embed tag)

 

[Rog210]

I don't understand why people get so worked up about this sort of thing.

Those backdoors are there for your protection. They are put there for the exclusive use of the governments who we democratically elected. i.e.: the good guys.

We should all stop being so suspicious, and learn to fully trust the NSA and GCHQ. These guys are serious, trained professionals - not spotty nerds who are out to steal credit card numbers or pictures of your girlfriend!

As long as these backdoors are secure (and surely they are!), then we have nothing to fear.

Can't tell if you're doing some NSA-sponsored astroturfing or if you're just hopelessly naive. Either way, you're part of the problem.

 

[viacavour]

I googled around. com.apple.mobile.file_relay is just a service to sync your data to iTunes, and other connected device. You can google it yourself too.

Of course this has to happen above the backup layer. Otherwise how would iTunes understand the data it synced ? >_<

At this point, I think the presenter is full of *****.

 

[bdkennedy1]

There is no reason to believe Apple would ever do anything to deliberately compromise the security of our data. Apple is the one company that strives to do everything to protect us and our privacy from prying eyes.

And your opinion is based on what? What Apple has told you?

 

[AdonisSMU]

Wow talk about double standards. Apple fanboys criticize Google for this all the time when it now looks like Apple is just as bad an offender if not worse the sentiment is it's ok?

Google is a data mining company. Apple is a hardware sales company. The two strategies are different from a business perspective. If users see Apple as being a security threat, they won't buy new hardware.

 

[viacavour]

Why are you bringing up Android?

Dude, check the post chain. I didn't bring it up. Someone else did !

Personally, I think the guy asks some valid questions. Excerpted from ZDNet article:

He deliberately or unintentionally hide other iOS security services. I don't think the questions are valid or even relevant if those layers are considered.

Zdziarski's questions for Apple include:

1. Why is there a packet sniffer running on 600 million personal iOS devices instead of moved to the developer mount?

Why not ? It is useful for field diagnosis for the telcos. The presenter lacks operational experiences. The attackers won't be able to launch the sniffer or other tools remotely since iOS is locked down. We haven't seen any advisories that indicate so.

*If* the attacker can launch the sniffer remotely, that means the iOS security has been compromised. He or she can easily download other custom tools himself even if the sniffer is not there.

Apple simply has to decide what gets installed by default since the lowest HDD capacity is only 8GB these days.

If Apple want to do something hanky-panky behind our back, do you think they will separate the daemon into pcapd and name it ostensibly ? Same goes for the mobile.file_relay. That's just so stupid for an alleged covet operation.

The presenter is just looking for an agenda that's not there. It's all his agenda.

2. Why are there undocumented services that bypass user backup encryption that dump mass amounts of personal data from the phone?

Again, the presenter is stupid. Google for com.apple.mobile.file_relay, you can find the source code, and its purposes. It's for syncing to iTunes. It has to happen above backup or encryption layer because apps like iTunes need to know what gets sync'ed and when. Here, I want to point out that the presenter sucks big time as a IT personnel.

And as I mentioned, there are other security layers to prevent abuse. e.g., when you connect the device to a PC/Mac, you get the "Trust this device" dialog first.

3. Why is most of my user data still not encrypted with the PIN or passphrase, enabling the invasion of my personal privacy by YOU?

Again, google for it. This was already explained by some sites when iOS7 was introduced. The device key encrypted storage is for speeding up (and lower power use) of mass encryption/decryption. It is useful when you try to switch device, or when you forget your passcode, or lost your device.

There are other encryption facilities such as the Data Protection API for encrypting sensitive data. You don't need to encrypt Angry Bird or Flappy Bird.

4. Why is there still no mechanism to review the devices my iPhone is paired with, so I can delete ones that don’t belong?

The last time I checked, you can go to Bluetooth to see what devices are paired, and unpair them accordingly. You can also forget WiFi access points and unplug USB/Lightning devices. I don't even know what the presenter is talking about.

edit: btw, you can also go to Settings and look for the option "Diagnostics & Usage". If you agree to data submission, Apple will show you what data it collects so that you can change your mind if you want to.

 

[2984839]

The fact that Apple holds the signing keys used to sign kernels, bootloaders, and software on the device AND has the ability to push updates at will means they have complete and total backdoor access, even if there is no actual backdoor present on the device (though there probably is).

Even if Apple didn't want to comply, they have no choice. A US based company providing closed source software that includes encryption software will be compelled, threatened, or bribed to comply. That's how we got interception equipment installed at all telecom companies. It's how we got the backdoored DUAL_EC_DRBG as the default PRNG in RSA's BSafe library. No closed source software that provides security functions should be trusted, and certainly no closed source OS should be trusted.

 

[dannyyankou]

I expect iOS 7.1.3 with "security fixes".

 

[mr.bee]

There is no reason to believe Apple would ever do anything to deliberately compromise the security of our data. Apple is the one company that strives to do everything to have an advantage on the market and will use privacy as a selling feature when it fits best

fixed

 

[viacavour]

The fact that Apple holds the signing keys used to sign kernels, bootloaders, and software on the device AND has the ability to push updates at will means they have complete and total backdoor access, even if there is no actual backdoor present on the device (though there probably is).

Even if Apple didn't want to comply, they have no choice. A US based company providing closed source software that includes encryption software will be compelled, threatened, or bribed to comply. That's how we got interception equipment installed at all telecom companies. It's how we got the backdoored DUAL_EC_DRBG as the default PRNG in RSA's BSafe library. No closed source software that provides security functions should be trusted, and certainly no closed source OS should be trusted.

These apply to open source software too ! As evident in the past few months. And they happened again, and will happen again to open source software.

 

[springsup]

I don't understand why people get so worked up about this sort of thing.

Those backdoors are there for your protection. They are put there for the exclusive use of the governments who we democratically elected. i.e.: the good guys.

We should all stop being so suspicious, and learn to fully trust the NSA and GCHQ. These guys are serious, trained professionals - not spotty nerds who are out to steal credit card numbers or pictures of your girlfriend!

As long as these backdoors are secure (and surely they are!), then we have nothing to fear.

Edward Snowden says NSA workers often pass your nude photos around the office

 

[2984839]

These apply to open source software too ! As evident in the past few months. And they happened again, and will happen again.

Yes and no. It's harder to do and open source software does not require that you trust the developers with updates. It's much better, but not perfect.