iPhone and iPad users have long been able to laud the superior security of their devices over rivals. But it seems one crucial aspect has been forgotten: what if the hacker is Apple AAPL +0.83%?
Responding to an eye opening talk from forensic scientist Jonathan Zdziarski at the Hackers On Planet Earth conference on Friday Apple has issued a formal statement acknowledging the existence of services running on iOS which can bypass encryption to access user data (the classic ‘backdoor‘), but claims they do not compromise user privacy or security.
“We have designed iOS so that its diagnostic functions do not compromise user privacy and security, but still provides needed information to enterprise IT departments, developers and Apple for troubleshooting technical issues,” the statement reads.
“A user must have unlocked their device and agreed to trust another computer before that computer is able to access this limited diagnostic data. The user must agree to share this information, and data is never transferred without their consent.”
Apple also stated it has not worked alongside governments – foreign or domestic – to create security backdoors into its products.
On the face of it the statement makes sense, but in the context of what Zdziarski’s talk actually said? Not so much.
The Counter Argument
Zdziarski responded in kind saying “it looks like Apple might have inadvertently admitted that, in the classic sense of the word, they do indeed have back doors in iOS, however claim that the purpose is for ‘diagnostics’ and ‘enterprise’.”
“The problem with this is that these services dish out data (and bypass backup encryption) regardless of whether or not “Send Diagnostic Data to Apple” is turned on or off, and whether or not the device is managed by an enterprise policy of any kind… As a result, every single device has these features enabled and there’s no way to turn them off, nor [contrary to Apple’s statement] are users prompted for consent to send this kind of personal data off the device.”
In his original talk (slides now available online) Zdziarski reports services such as ‘lockdownd’, ‘pcapd’ and ‘mobile.file_relay’ have “been around for many years”, run completely hidden from the user and can bypass encrypted backups to obtain data including logins, contacts, voicemails and photos. Intercepting this data can be done over WiFi, USB and even potentially 3G and 4G data.
Zdziarski said the finding shocked him as he regards iOS security as “generally great”. He states he made repeated attempts to contact Apple, and Tim Cook in particular, about these services and their vulnerabilities, but never received a response.
The Ultimate Backdoor Key
If Apple is using this for diagnostics Zdziarski says it lacks any transparency (Apple only acknowledged its existence in response to the talk) and moreover makes an obvious target for hackers and home and foreign governments. Hack the background processes and they will grant complete access to iPhone data, bypassing all encryption. In fact leaked documents last year revealed the NSA actually pulled a similar tactic using a program dubbed ‘DROPOUTJEEP’ to pull information from iPhones, but that required physical access to the phone first.
In defence of Zdziarski he stresses: “I have NOT accused Apple of working with NSA, however I suspect (based on released documents) that some of these services MAY have been used by NSA to collect data on potential targets.”
“I am not suggesting some grand conspiracy; there are, however, some services running in iOS that shouldn’t be there, that were intentionally added by Apple as part of the firmware, and that bypass backup encryption while copying more of your personal data than ever should come off the phone for the average consumer.”
“I think at the very least, this warrants an explanation and disclosure to the some 600 million customers out there running iOS devices… My hope is that Apple will correct the problem. Nothing less, nothing more. I want these services off my phone. They don’t belong there.”
Apple Is Not Alone
The wider problem is Apple is far from alone in acting in such an autocratic manner. On Android, for example, ‘Google Play Services’ also runs silently in the background and officially has an innocent agenda “to update Google apps and apps from Google Play”.
In reality Play Services has limitless access to virtually every aspect of an Android phone and can even grant itself new permissions as and when needed (grabs above had to be spread over five screens). The user is never prompted and while Play Services can be easily disabled the vast majority of Android services and apps will not run without it making it unfeasible to ditch long term.
All of which prompts the need for a much bigger debate. In an era where so much of our data is held on devices with numerous sensors, data delivery and tracking methods why is it not a priority to rule on what corporations and governments can do with it in the first place?
Inevitably rules would be broken, but at least there would then be a set course of action and we’d know at what point the line was crossed in the first place. In fact we’d know there was a line.
Pepared by......
Katemi P.Methsela
Responding to an eye opening talk from forensic scientist Jonathan Zdziarski at the Hackers On Planet Earth conference on Friday Apple has issued a formal statement acknowledging the existence of services running on iOS which can bypass encryption to access user data (the classic ‘backdoor‘), but claims they do not compromise user privacy or security.
“We have designed iOS so that its diagnostic functions do not compromise user privacy and security, but still provides needed information to enterprise IT departments, developers and Apple for troubleshooting technical issues,” the statement reads.
“A user must have unlocked their device and agreed to trust another computer before that computer is able to access this limited diagnostic data. The user must agree to share this information, and data is never transferred without their consent.”
Apple also stated it has not worked alongside governments – foreign or domestic – to create security backdoors into its products.
On the face of it the statement makes sense, but in the context of what Zdziarski’s talk actually said? Not so much.
The Counter Argument
Zdziarski responded in kind saying “it looks like Apple might have inadvertently admitted that, in the classic sense of the word, they do indeed have back doors in iOS, however claim that the purpose is for ‘diagnostics’ and ‘enterprise’.”
“The problem with this is that these services dish out data (and bypass backup encryption) regardless of whether or not “Send Diagnostic Data to Apple” is turned on or off, and whether or not the device is managed by an enterprise policy of any kind… As a result, every single device has these features enabled and there’s no way to turn them off, nor [contrary to Apple’s statement] are users prompted for consent to send this kind of personal data off the device.”
In his original talk (slides now available online) Zdziarski reports services such as ‘lockdownd’, ‘pcapd’ and ‘mobile.file_relay’ have “been around for many years”, run completely hidden from the user and can bypass encrypted backups to obtain data including logins, contacts, voicemails and photos. Intercepting this data can be done over WiFi, USB and even potentially 3G and 4G data.
Zdziarski said the finding shocked him as he regards iOS security as “generally great”. He states he made repeated attempts to contact Apple, and Tim Cook in particular, about these services and their vulnerabilities, but never received a response.
Zdziarski’s Talk Summary Slide
The Ultimate Backdoor Key
If Apple is using this for diagnostics Zdziarski says it lacks any transparency (Apple only acknowledged its existence in response to the talk) and moreover makes an obvious target for hackers and home and foreign governments. Hack the background processes and they will grant complete access to iPhone data, bypassing all encryption. In fact leaked documents last year revealed the NSA actually pulled a similar tactic using a program dubbed ‘DROPOUTJEEP’ to pull information from iPhones, but that required physical access to the phone first.
In defence of Zdziarski he stresses: “I have NOT accused Apple of working with NSA, however I suspect (based on released documents) that some of these services MAY have been used by NSA to collect data on potential targets.”
“I am not suggesting some grand conspiracy; there are, however, some services running in iOS that shouldn’t be there, that were intentionally added by Apple as part of the firmware, and that bypass backup encryption while copying more of your personal data than ever should come off the phone for the average consumer.”
“I think at the very least, this warrants an explanation and disclosure to the some 600 million customers out there running iOS devices… My hope is that Apple will correct the problem. Nothing less, nothing more. I want these services off my phone. They don’t belong there.”
Google Play Services – Android permissions
Apple Is Not Alone
The wider problem is Apple is far from alone in acting in such an autocratic manner. On Android, for example, ‘Google Play Services’ also runs silently in the background and officially has an innocent agenda “to update Google apps and apps from Google Play”.
In reality Play Services has limitless access to virtually every aspect of an Android phone and can even grant itself new permissions as and when needed (grabs above had to be spread over five screens). The user is never prompted and while Play Services can be easily disabled the vast majority of Android services and apps will not run without it making it unfeasible to ditch long term.
All of which prompts the need for a much bigger debate. In an era where so much of our data is held on devices with numerous sensors, data delivery and tracking methods why is it not a priority to rule on what corporations and governments can do with it in the first place?
Inevitably rules would be broken, but at least there would then be a set course of action and we’d know at what point the line was crossed in the first place. In fact we’d know there was a line.
Pepared by......
Katemi P.Methsela
0 comments:
Post a Comment