Forensic Expert Questions Covert 'Backdoor' Services Included in iOS by Apple

[wiz329]

I don't understand why people get so worked up about this sort of thing.

Those backdoors are there for your protection. They are put there for the exclusive use of the governments who we democratically elected. i.e.: the good guys.

We should all stop being so suspicious, and learn to fully trust the NSA and GCHQ. These guys are serious, trained professionals - not spotty nerds who are out to steal credit card numbers or pictures of your girlfriend!

As long as these backdoors are secure (and surely they are!), then we have nothing to fear.

Surely you must be trolling.

 

[PocketSand11]

There will probably be a Cydia tweak to remove this stuff within a few days, and then jailbroken phones will be more secure than regular ones
I'm not worried about the government using this, but if they can access my phone, hackers probably can as well.

 

[viacavour]

Yes and no. It's harder to do and open source software does not require that you trust the developers with updates. It's much better, but not perfect.

You can say whatever you want, but bigger leaks happened in open source software. It already proved that they are not much better.

Security is a tedious and difficult process. Not a label for endorsing open source or closed source software.

 

[3282868]

Edward Snowden says NSA workers often pass your nude photos around the office

LOL I know I shouldn't find this amusing, but adults are just children; we pretend to be mature but look at the state of the world. Fighting over religious land(s), how are NSA/Homeland divisions mock citizens like children on playgrounds. Interestingly, it's mostly men in power, I wonder how women would fare? Probably better.

Even on MacRumors. Age is just a number, we're all still kids. Pathetic.

This tongue-in-cheek tweet sums it up perfectly.

 

[unplugme71]

We have a choice. A choice not to buy Apple's products. A choice not to use smart phones. A choice not to be connected to the Internet. A choice to express what we want. A choice to do things legally or not.

If you choose you do illegal things, then this helps protect you. It helps protect you from doing it again.

I choose to use Apple's products. If it wants to monitor my usage, so be it. To me, I like to think my monitoring helps "improve" the device or service I use. The monitoring can be things to include - how long I use my phone, how well my battery lasts, how many text messages I write, using my voice for speech-to-text, etc. I use the services within the terms and what is legal in my country.

Now when my legal usage becomes a problem and I am faced by authorities, that's when I will step in and defend my rights.

I can't stop Apple from looking at my encrypted backups just like I can't stop someone at PNC Bank from viewing my checking account balance and transactions.

 

[n-evo]

Didn't Apple recently come out and say iOS included no such thing? Ouch.

 

[TsunamiTheClown]

IDK... I have a feeling we all know that Apple and Co. are doing this kind of thing all the time.

Most people cling to the "i'm not the bad guy" mentality to keep themselves from getting upset about it (or just don't give a damn).

But I think it is getting harder to ignore the fact that iDevices may be becoming the digital handcuff more and more.

 

[iChrist]

There is no reason to believe Apple would ever do anything to deliberately compromise the security of our data. Apple is the one company that strives to do everything to protect us and our privacy from prying eyes.

Or... they have the best marketing that was able to convince you of that.

 

[Mousse]

Nearly every proprietary OS has a "backdoor" access. If you're really paranoid about security, you can write your own OS or use an open source OS (Linux) where you can look through each line of code. Even then, you might not be completely secure. Say what?! A compiler can install a "backdoor" according Ken Thompson. Read the article he wrote in 1984, Reflections on Trusting Trust.

He's the TL;DR version, in the man's own words, "The moral is obvious. You can't trust code that you did not totally create yourself."

Well, you can always read through the source in Assembly language. Unless you're a Cylon, you're gonna miss a thing or two thousand.

 

[viacavour]

Didn't Apple recently come out and say iOS included no such thing? Ouch.

Yeah they did and they are probably right.

This so called security researcher doesn't seem to have real operational background. He's second guessing from a very limited view of iOS.

Or... they have the best marketing that was able to convince you of that.

I don't know man. People complain about Apple losing their edge in their TV ads. And yet when it comes to wild data leak claims like this, Apple suddenly become the best marketing ?

All they said was no, we don't do it. It's up to you to believe or not.

 

[Reason077]

Can't tell if you're doing some NSA-sponsored astroturfing or if you're just hopelessly naive. Either way, you're part of the problem.

If the NSA want me to do some online advocacy on their behalf, they know where to find me. Presumably.

 

[jav6454]

Given that a jailbreak expert found it, shouldn't a jailbreak tweak be able to block said functions?

 

[2984839]

You can say whatever you want, but bigger leaks happened in open source software. It already proved that they are not much better.

Security is a tedious and difficult process. Not a label for endorsing open source or closed source software.

We're talking about backdoors, not security in general. The fact is that the US government can compel a US company to put a backdoor in its closed source software and nobody will ever know. They can't do it nearly as covertly with open source software. They can take advantage of lazy developers and try to sneak it in themselves, but it stands a higher chance of being caught, though there are no guarantees obviously.

The much bigger threat is backdoored hardware, such as Intel's RDRAND instruction set, which nobody in their right mind would use.

 

[alfonsog]

I think your explanation is old, and the recent leaks by Edward Snowden and other reports on how the CIA takes our privacy as a joke is alarming, any average joe is a target, doesn't matter if you're is rich, or coming from a suspicious country. Is it too much to ask for to go online or use a technological device without it's makers and the CIA mining my data and tracing my every move? You, i and million others may have never been a target but the minute we are be sure that breaching our privacy will be a piece of cake for them, and it's only because we keep thinking it will never be me, these things only happen in the movies.

Exactly, you and I and millions of others have never been a target. The CIA is run by people, if they find some humorous sext or innuendo they are gonna pass it around. Americans are still such prudes about privacy. The CIA isn't mining and tracing individuals specifically, unless they have a reason; they are looking for patterns in a matrix that might lead to suspicion. It's all back to my personal theory that failure in mathematics education has led to a dumbing down of our population where most don't understand basic percentages or statistics, allowing people to be brainwashed by false opinions.

 

[viacavour]

We're talking about backdoors, not security in general. The fact is that the US government can compel a US company to put a backdoor in its closed source software and nobody will ever know. They can't do it nearly as covertly with open source software. They can take advantage of lazy developers and try to sneak it in themselves, but it stands a higher chance of being caught, though there are no guarantees obviously.

The much bigger threat is backdoored hardware, such as Intel's RDRAND instruction set, which nobody in their right mind would use.

Backdoors are security issues ! Those weaknesses discovered over the past few months in open source software can be used to create backdoors. They have been there for 1-2 years or more. That's why everyone "panicked".

 

[Zxxv]

These services, such as "lockdownd," "pcapd" and "mobile.file_relay," can bypass encrypted backups to obtain data and can be utilized via USB, Wi-Fi and possibly cellular.

Works over wifi does it. hmmm

At the moment many keep wifi off because wifi networks and shops snoop. In a shop they use wifi to follow you around the store and their cameras track you.

In iOS 8 apple is introducing wifi masking (it maybe called something different). Your wifi will not broadcast to these wifi networks, you will appear invisible. So people will turn wifi on...

see the connection?

 

[2984839]

Didn't Apple recently come out and say iOS included no such thing? Ouch.

Yes, but their statements about government backdoors are completely meaningless. If they did have a backdoor and said so, they'd go to jail.

----------

Backdoors are security issues ! Those weaknesses discovered over the past few months in open source software can be used to create backdoor. That's why everyone "panicked".

Yes, and they were found and fixed by outside researchers. They would still be there if OpenSSL was closed source.

 

[viacavour]

Works over wifi does it. hmmm

At the moment many keep wifi off because wifi networks and shops snoop. In a shop they use wifi to follow you around the store and their cameras track you.

In iOS 8 apple is introducing wifi masking (it maybe called something different). Your wifi will not broadcast to these wifi networks, you will appear invisible. So people will turn wifi on...

see the connection?

Actually, most people I know keep Wifi off to save battery. It may have nothing to do with Wifi masking or no masking.

Keep your scare tactics to yourself.

 

[69Mustang]

Dude, check the post chain. I didn't bring it up. Someone else did !

{snipped for brevity}

True, someone else did bring up Android. But even after I tried to steer the dialog back to the topic, you still brought it up. Regarding what the OP stated, I put a big all caps IF in my quote. I have no idea if what he says is true or not. Just like I can't vouch for the validity of the information you provided. That's why I say the questions have merit. More so because of his assertion that companies are already using the backdoor for profit. No offense to you, and I'm sure you researched your info, but I would like some clarification from Apple for simple peace of mind. If Apple says it's not true or they have a reasonable explanation, then okay. They could lie as well, but at least there's an official response to tie back to if needed.

 

[viacavour]

Yes, and they were found and fixed by outside researchers. They would still be there if OpenSSL was closed source.

Nope, you have no proof. They may not be there if it's closed source. And Apple did find their own flaws in their gotofail bug too. Closed source software have external security researchers to help as well.

 

[carfac]

There is no reason to believe Apple would ever do anything to deliberately compromise the security of our data. Apple is the one company that strives to do everything to protect us and our privacy from prying eyes.

And Steve Jobs is still alive and well and living with Elvis on Maui....

Geez... wake up already!

 

[Zxxv]

Actually, most people I know keep Wifi off to save battery. It may have nothing to do with Wifi masking or no masking.

Keep your scare tactics to yourself.

Scare tactics. Does what I said add up? yes.

Are you scared? I have no control over this

 

[Crzyrio]

Steve Jobs did- he wouldn't allow anyone to have any backdoor into Apple software.

6 months after he died, Apple joined the PRISM program. The new Apple is not like the old Apple.

These 'backdoors' have been in iOS for years, including when Steve was there.

 

[viacavour]

Scare tactics. Does what I said add up? yes.

Are you scared? I have no control over this

Why would I be scared ? I am more afraid of people losing their common sense. So you do have some control by exercising some common sense.

 

[2984839]

Nope, you have no proof. They may not be there if it's closed source. And Apple did find their own flaws in their gotofail bug too. Closed source software have external security researchers to help as well.

External security researchers aren't going to be allowed to change deliberate or mandated backdoors. RSA does a heck of a lot of internal security auditing, yet they made DUAL_EC_DRBG the default regardless. Why? They were paid $10 million by the NSA to do so.