Slashdot Mirror
Apple's War Against Jailbreaking Now Makes Perfect Sense
An anonymous reader writes "Apple has always been extremely anti jailbreaking, but it might now have a good reason to plug up the exploits. As Hardware 2.0 argues, Apple's new iOS 7 Activation Lock anti-theft mechanism which renders stolen handsets useless (even after wiping) unless the owner's Apple ID is entered relies on having a secure, locked-down OS. Are the days of jailbreaking iOS coming to a close?" I can see a whole new variety of phone-based ransom-ware based on this capability, too.
timothy, you're going to have to explain how the implimentation of this feature by Apple in any way changes a developer's ability to create ransomware with similar functionality. 'Cause the way I see it, to be able to hijack the Authentication Lock, you're probably going to have to have sufficiently low-level access to just impliment your own lock.
No kidding!!! What do you say at this point?
The problem is, as with most anti-theft technology like this, it won't hurt the thieves as much as it will screw-over buyers of used hardware.
This will not cut down on theft as much as it will simply cripple the trust of the secondary market. After all, you can still steal an iPhone, stick it on Craigslist for cash, sell it to some poor sucker and get leave before he charges up the phone and figures out it was stolen and won't work.
Taxation is legalized theft, no more, no less.
How about "war against security exploits that allow malicious users to gain unrestricted access to your phone?"
I guess Linux and Microsoft are both engaged in a 'war against jailbreaking' too, when they close fucking security exploits.
Jesus christ - if you want root on your device, get a device that is built to allow that. Don't bitch that a company closes fucking security holes in its software.
Whats wrong with IMEI blacklisting.
The summary implies they've had this in the works for multiple iterations of iOS and never did it. I find it highly doubtful they were ready to implement this, but didn't for what, 5 consecutive versions of iOS?
How about an old fashioned fuse inside the chip? Blow the fuse, job done...
No sig today...
But we do want, insist actually, on root access for devices we own. If you can't log in as root, you don't own the device. Just give me the option to turn on root access using my Apple ID. Closing holes that allow for unauthorized privilege elevation is a good thing. Disallowing authorized use of the full functionality of a device is a bad thing.
Wow...
Would you steal a stereo? Would you steal a purse? Well, if you jailbreak your iPhone, you may as well!
Jailbreaking your iPhone prohibits Apple from protecting the safety of your loved ones. Think of the children.
TERRORISTS!!
Shenanigans!!
Anything to convince law-makers that having control over your own devices is evil.
Bah!
"Helping to keep you two steps ahead of the Thought Police!"
When you control the hardware the way Apple does, there is no problem in separating the lock-feature from the main operating system, similar to what happens with a Trusted Platform Module in a Laptop. In fact, one may argue that relying on the operating system to handle this as part of its regular codebase is hopeless, as it means any jailbroken device can also be "unlocked" again.
If they actually wanted to make this secure they would have separated it from the main OS.
Having said that, one can hardly argue against a company working to close known vulnerabilities and security issues within their software, so Apple really should be working hard to close these exploits regardless of the lock-feature.
- Jesper
My security clearance is so high I have to kill myself if I remember I have it...
They want to prevent anyone else from starting an app store in competition with theirs.
There is a simple solution to theft - initialize each device with a unique key, and give a copy of that key to the owner. By all means pre-load it with trust for the vendor key as well so that it can auto-update by default, but the master key goes to the user. The key might be a $2 USB drive in a little envelope that says "keep safe and don't open unless you want to modify the OS software - Vendor may not be able to repair devices without this key."
The average user just sticks the key in a drawer and gets the default experience. A user who wants to unlock the device just downloads their alternate firmware installer of choice and it will ask them to insert their key so that it can reflash the phone. Users could also disable the Vendor's keys if they wish. By all means let users generate their own keys and install those on the device as well (obviously this will require the previous key). In the case of business-owned phones the business would procure the phone and keep the key, and thus they can stay in control of the hardware even if they allow employees to use it.
Now users can reflash at will, but if somebody steals the phone they will be unable to do so. It would have minimal cost, and since the defaults are all idiot-proof those who don't care about the feature can ignore it and as long as they don't remove the Vendor key the vendor can still do anything they can do today. However, it would establish that the person who paid for the phone is the one who owns it. Since the key is a tangible object, it can be transferred if the owner wishes to do so, and I'd just make it a read-only simple USB drive so that it could be copied if desired as well - just like a car key.
Google signed up to Prism long before apple
troll harder
http://arstechnica.com/tech-policy/2013/06/new-leak-feds-can-access-anything-in-your-google-facebook-and-more/
http://www.google.com/nexus/4/
Apple's view towards jailbreaking can likely be summed up thus: Anyone is free to do whatever they want with their devices. Just don't expect support for unsupported things if it breaks. Found a security exploit in the OS? Thanks, we'll fix that right up.
Apple's view towards jailbreaking can likely be summed up thus: Anyone is free to do whatever they want with their devices. Just don't expect support for unsupported things if it breaks. Found a security exploit in the OS? Thanks, we'll fix that right up.
Apples view is your a criminal breaking DMCA http://www.copyright.gov/1201/2008/responses/apple-inc-31.pdf
Reminds me of overhearing a salesperson trying to convince a customer to put down the iPhone she was holding and buy an Android phone (I suspect higher commission on the Android).
"And another advantage is you don't have to pay for any applications unlike the iPhone. It's really easy and everyone does it."
I wept for Android developers.
This is *not* about permanently disabling or blacklisting a phone. This is about making the phone unusable for the thief, but keeping it technically sound so the rightful owner could still use it if it has been recovered. It'd be trivial to blacklist an IMEI, just as it would be to circumvent the blacklist by reprogramming the baseband controller. It'd be trivial to implement a "self destruct" on the phone that could be triggered remotely, but then you'd have a phone that would need at least one chip replaced before it'd work again. This is about non-destructive locking and it relies on the OS not being rooted. They may find a way to do that on newer hardware, but as I understand it, all current hardware has been "owned" sufficiently for a software-only compromise to be sufficient.
I was promised a flying car. Where is my flying car?
the fact that everything from the new mac pro to the ipad actively resists attempts to load any other operating system than the one its packaged with
Not quite. The new Mac Pro still lets you use Bootcamp to install Windows or you can do a direct EFI install of Windows Vista/7/8 without Bootcamp. You just have to copy the files on the DVD to a GPT partitioned USB drive and the Mac will natively boot the installer.
Or the police could do their job and arrest people who steal phones. They have a constant stream of evidence when the phone is on, and turn by turn directions to the thief's location. The thieves are being handed to them on a silver platter.
Actually there is a much simpler way to go about this problem (with theft) which would leave both Apple and the NSA out of the loop.
Every cellphone is equipped with an EMEI number which works similar to a network MAC address. It is a unique hardware identifier for each phone - on a global scale.
The EMEI is visible in the settings/control-panel section of any modern phone, and often also printed on either the box the device is supplied in, or a piece of paper inside. And it is used by every carrier on the planet as a part of the calling infrastructure.
All the carriers would need to do, is to allow a "blacklist" of EMEI numbers, so when your device is stolen you simply report the EMEI to the carrier and they blacklist it. To prevent abuse each device could be supplied with an anti-theft key generated by the initial operator or by the manufacturer (so only the holder of both the EMEI and theft-key can have it blacklisted).
The technical capability to do this already exists. Some operators have even implemented it in trials. Their reasons for not using it today is the fact that not all operators actually want to bust customers with stolen phones, and this system would be kind of pointless if only half the carriers implement it.
Enter regulation. The political system could easily pass a law that forces all carriers to implement this kind of EMEI-based anti theft system. It would take little to design, it would work for every phone on the planet regardless of make/model, and it would include only known technology (just a few bits and pieces to extend the existing EMEI database plus a front-office system to operate it).
Not implementing this is pure laziness (from carriers).
- Jesper
My security clearance is so high I have to kill myself if I remember I have it...