Slashdot Mirror


Apple Denies Helping NSA Subvert iPhone

New submitter aissixtir sends word that Apple has responded to allegations that the NSA has backdoor access to iPhones. Apple said, "Apple has never worked with the NSA to create a backdoor in any of our products, including iPhone. Additionally, we have been unaware of this alleged NSA program targeting our products. ... Whenever we hear about attempts to undermine Apple’s industry-leading security, we thoroughly investigate and take appropriate steps to protect our customers. We will continue to use our resources to stay ahead of malicious hackers and defend our customers from security attacks, regardless of who’s behind them."

284 comments

  1. They can't stop unlockers by Anonymous Coward · · Score: 5, Insightful

    What makes you think they could stop the NSA?

    1. Re:They can't stop unlockers by MacDork · · Score: 5, Informative

      I hate how this story has warped into an Apple bash. Go watch the original presentation.

      Jacob Applebaum detailed the latest revelations on the NSA at 30c3 wherein he describes software to launch automated malware attacks "designed for at scale explotation" which is being used for "fishing expeditions, it's more like fishing crusades ... targeting Muslims." He describes NSA drones being used to wirelessly compromise wifi routers from a distance of 8 miles. Also mentioned, the NSA is shipping compromised American hardware ordered online including iPhones, Dell PowerEdge servers, HP servers, Solaris servers, and more. He wraps up the talk mentioning "a specialized technology for beaming energy into you and the computer systems around you" to compromise systems. Up to 1KW of energy specifically. It's clear from his presentation that what the NSA is doing is not just passive collection. It is not the digital equivalent of a wiretap. It is the digital equivalent of a drone firing a hellfire missle on you.

      Apple is a very small aspect of this story. The NSA has militarized the internet.

    2. Re:They can't stop unlockers by Anonymous Coward · · Score: 0, Insightful

      Apple loses every single pwn2own competition, so yeah, it is pretty ridiculous that they claim to have industry leading security.

    3. Re:They can't stop unlockers by 93+Escort+Wagon · · Score: 4, Funny

      I hate how this story has warped into an Apple bash.

      Well, it's because all the Android owners are enjoying this opportunity, secure in the knowledge that their Java-based apps are keeping their personal information safe!

      --
      #DeleteChrome
    4. Re:They can't stop unlockers by Anonymous Coward · · Score: 0

      well you won't last long here, the voice of reason is NOT appreciated.

    5. Re:They can't stop unlockers by Anonymous Coward · · Score: 1

      The apple angle is the NSA slide that states that they can always break into apple software everytime - a guarantee that is being given here by the NSA.

      The question is how can they guarantee being able to hack/break it 100% of the time.

      Now that is different from where they have found a backdoor that might get blocked etc or a method that was not deliberately created by the company and may work only work 99% of the time

    6. Re:They can't stop unlockers by Anonymous Coward · · Score: 1

      Of course there's an inherent bias there, in that the most desirable prize is for cracking the Apple product.

    7. Re:They can't stop unlockers by Anonymous Coward · · Score: 0

      it took your 34 minutes to come up with THAT?!?

    8. Re:They can't stop unlockers by Taco+Cowboy · · Score: 2

      What makes you think they could stop the NSA?

      What makes you think they ever want to stop the NSA ?

      --
      Muchas Gracias, Señor Edward Snowden !
    9. Re: They can't stop unlockers by EvilSS · · Score: 3

      You should do standup

      --
      I browse on +1 so AC's need not respond, I won't see it.
    10. Re:They can't stop unlockers by EdIII · · Score: 1, Troll

      What Apple deserves to be bashed over is the ridiculous claim of industry leading security.

      That's the part that's hilarious.

      It's as funny as Ford using the Pinto as an example of industry leading automobile safety...

    11. Re:They can't stop unlockers by craigminah · · Score: 3, Insightful

      What makes you think Apple would break the law and admit they helped the NSA (sure they signed NDA beforehand)?

    12. Re:They can't stop unlockers by craigminah · · Score: 3, Funny

      Yup...who wants to pwn then own a POS Windows computer?

    13. Re:They can't stop unlockers by phrostie · · Score: 1

      Thanks for the link

    14. Re:They can't stop unlockers by the_B0fh · · Score: 5, Insightful

      As I had to point out to other people. This was from 2008. The original iPhone, and maybe the iPhone 3G. Do you know what that means? Those did not come with encryption. iPhone 3GS and onwards had encryption. I forgot if the hardware encryption was built in to the 3GS or started with the 4, but it's there.

      Do you know what that means? The original iPhone could be mounted as a disk, and everyone knows what happens when you have physical access to a system, and it doesn't have full disk encryption - you get to screw with the file system, and install shit.

      What happens on the iPhones with encryption (that is always enabled if you have a passcode - actually it is always enabled, but if you don't have a passcode, it just passes it through)? Even if you have hardware access, you do not have the ability to drop files and screw with it.

      The bigger question Android users should ask themselves - why do Androids not come with full device encryption enabled by default? Why are Androids, by default, still vulnerable to the kind of attack that Apple fixed in 2009?

      And please don't tell me Android v4 have full device encryption. That's a joke. It takes 45 minutes to enable encryption on my Nexus 4. You have to login twice after a reboot to use your phone. And the encryption is already broken - just ask Cellebrite - they proudly tell you they can do forensics on encrypted Android image.

      So - Android users - why do you settle for less?

    15. Re:They can't stop unlockers by couchslug · · Score: 1

      The internet is a military invention. Don't use it for secure comms and never want to use it for secure comms.

      No electronic comms are truly secure against a well-funded attacker.

      --
      "This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
    16. Re:They can't stop unlockers by Anonymous Coward · · Score: 0

      Do you work directly for Samsung or just their PR firm, shill?

    17. Re:They can't stop unlockers by WaffleMonster · · Score: 4, Insightful

      The bigger question Android users should ask themselves - why do Androids not come with full device encryption enabled by default? Why are Androids, by default, still vulnerable to the kind of attack that Apple fixed in 2009?

      What good is encryption if Google can remotely install any software it damn well pleases on your handset without your knowledge or approval?

    18. Re:They can't stop unlockers by mbkennel · · Score: 1

      "It is the digital equivalent of a drone firing a hellfire missle on you."

      Other than the dismemberment, arson and homicide?

    19. Re:They can't stop unlockers by ahabswhale · · Score: 1

      That would be interesting if it were actually true.

      --
      Are agnostics skeptical of unicorns too?
    20. Re:They can't stop unlockers by lxs · · Score: 1

      Give him a break. Getting special attention at every border crossing and hanging out with Crazy Julian would make anyone a bit loopy and given to hyperbole.

    21. Re:They can't stop unlockers by fisted · · Score: 1

      ...said the obvious fanboy.

    22. Re:They can't stop unlockers by Anonymous Coward · · Score: 0

      Two Words: Plausible Deniability.

      Jobs was the one working with the NSA, which allowed Apple to act innocent when in fact they were not.

    23. Re:They can't stop unlockers by Anonymous Coward · · Score: 0

      I can tell you've never used the horribly pathetic Objective C language.

    24. Re:They can't stop unlockers by Anonymous Coward · · Score: 1

      Encryption only protects the phone while it is powered off, it is useless while the phone is on. I hopefully don't have to explain why, but based on the rest of your post I imagine that you are unaware that the key needs to be stored in RAM for the OS to access the disk, and that means that the key is readily available.

      If the attacker has physical access, the crypto key is still based on a PIN and (hopefully) some fixed number related to the hardware. The PIN is easy to guess in an offline attack, and the hardware info is also easily accessible. Therefore, full disk crypto doesn't help here either.

      While the phone is powered on, if there is a vulnerability in the software you can kindly ask the OS to send all the data you want over the USB port or over the network to a server somewhere. Since the OS has complete access to the disk, encryption does nothing to stop this attack.

      So - iOS users - why don't you know computer security?

    25. Re:They can't stop unlockers by Anonymous Coward · · Score: 0

      Of course there's an inherent bias there, in that the most desirable prize is for cracking the Apple product.

      That's a very cleverly worded statement, and almost passes for truth.
      Here, I'll help make it even closer:

      Of course there's an inherent bias there, in that Apple offers up the most desirable target for cracking.
      In the "wild", Windows presented the more desirable target, at least in years past. That is rapidly changing. It used to be that not much aside from a full-blown computer was really a desirable hacking target. But these days damn near everything has some kind of integration.

    26. Re:They can't stop unlockers by shentino · · Score: 1

      Retroactive immunity.

    27. Re:They can't stop unlockers by EdIII · · Score: 1, Troll

      In this particular case I should be working for Sony apparently.

      While those bastards may be black evil to the core... at least they were able to secure their console (and it's theirs, not the person who paid for it) from those pesky hackers that pay them hard money for the opportunity.

      How can Apple say industry leading security in a discussion about iPhone with a straight face?

      Come on. It has nothing to do with fanboism, shills, or any other bullshit.

      The iPhone is so full of security holes it gets a jailbreak for each and every attempt they make at securing it. It's not like they have anything that can defeat law enforcement or a forensic team either.

      Really. It's like a screen door manufacturer saying they're leaders in home security products. ROFL.

    28. Re:They can't stop unlockers by Anonymous Coward · · Score: 0

      This is stupid. It is like saying why Android user not pick iPhones as it has finger print security.

    29. Re:They can't stop unlockers by ImOuttaHere · · Score: 1

      ... The NSA has militarized the internet.

      EXACTLY!

      So much for network neutrality. The NSA has put paid to that dream.

    30. Re:They can't stop unlockers by mjwx · · Score: 4, Informative

      Of course there's an inherent bias there, in that the most desirable prize is for cracking the Apple product.

      Actually it isn't.

      The higher cash prizes were for the non-Apple products.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    31. Re:They can't stop unlockers by mjwx · · Score: 1, Insightful

      The bigger question Android users should ask themselves - why do Androids not come with full device encryption enabled by default? Why are Androids, by default, still vulnerable to the kind of attack that Apple fixed in 2009?

      What good is encryption if Google can remotely install any software it damn well pleases on your handset without your knowledge or approval?

      The same can be said for Apple and Apple devices. Apple reserve the right to screw with your device without warning or explanation. At the very least Google is open about what it does and why, Apple just says "do not question us".

      Beyond this, if you wanted to you can install a non-Google AOSP ROM and you are outside Googles reach. Can you do that with IOS?

      Sorry if facts dont agree with your sad sounding Google bash, carry on regardless.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    32. Re:They can't stop unlockers by Plumpaquatsch · · Score: 1

      The apple angle is the NSA slide from 2008 that states that they can always break into apple software everytime as long as "the software" is an iPhone and they have physical access to it- a guarantee that is being given here by the NSA. meaning they say its being build and they will have it ready real soon

      FTFY

      --
      Of course news about a fake are Fake News.
    33. Re:They can't stop unlockers by Anonymous Coward · · Score: 0

      Are you a fascist? You read 1984, and thought, hmm, I want that! And now here we are, and you are protecting a fascist company. YOU are now also the enemy. You will be defeated.

    34. Re:They can't stop unlockers by Rosyna · · Score: 4, Insightful

      Google has removed apps that are banned from the Google Play store from people's devices remotely. Apple has not.

      Is an unknown fear in the future somehow better for you to digest than that fear being played out in the past and present? (Apple's "may" versus Google's "has and does and will continue to do")

      I still have the "Asian Boobs" apps I downloaded off the App Store on my iPhone even though it has long, long since been removed from App Store. (Yes, it's actually called "Asian Boobs")

    35. Re:They can't stop unlockers by Rosyna · · Score: 1

      If the attacker has physical access, the crypto key is still based on a PIN and (hopefully) some fixed number related to the hardware. The PIN is easy to guess in an offline attack, and the hardware info is also easily accessible. Therefore, full disk crypto doesn't help here either.

      Apple documents how it figures out the encryption keys... you could look that up instead of saying "hopefully". Furthermore, you can't "guess" it in an offline attack easily. Well, if you have six months or so and a robot arm to do it, then maybe. Every time you enter an incorrect PIN, it takes longer and longer before you can attempt a different pin. Going from 0000 to 0010 will take around half a business day. Then it gets worse!

    36. Re:They can't stop unlockers by erikkemperman · · Score: 2

      Give me the phone's owner and a wrench, I'll have the pincode out real quick. There is an xkcd link for this but my hangover is killing me.

      --
      Gosh, thanks. That must be why the other ships call me Meatfucker -- GCU Grey Area (Eccentric)
    37. Re:They can't stop unlockers by the_B0fh · · Score: 2

      You are embarrassed to post under your real name aren't you, posting a bunch of strawmens and then shooting them down. I like all your ifs and buts and thens.

      And redirecting attention away from a vulnerability that is current *OPEN* on a default Android, away from a supposed vulnerability in iOS.

      Champion debating skills here I see.

    38. Re:They can't stop unlockers by gnasher719 · · Score: 1

      What Apple deserves to be bashed over is the ridiculous claim of industry leading security.

      So which phone has better security, and why?

    39. Re:They can't stop unlockers by knarf · · Score: 2, Insightful

      Google can only do things on Android phones which have Google apps installed. Installing Google apps is optional for anyone with a rooted phone.

      I have several devices running Android - tablets and phones. None of them run Google apps, nor the Google framework, nor any other Google-specific software. These devices run self-compiled Android distributions, some of them tailored to the application (eg. removed services from ServiceManager, etc).

      Try that with iOS. Nice try.

      --
      --frank[at]unternet.org
    40. Re:They can't stop unlockers by gnasher719 · · Score: 3, Insightful

      What makes you think Apple would break the law and admit they helped the NSA (sure they signed NDA beforehand)?

      There are laws that prevent companies from saying things. There are no laws that can force a company to lie. Actually, there are laws that make it illegal for a publicly traded company to lie about certain things. So possible things that Apple could do are:

      1. Say "we helped the NSA" - illegal and stupid if they did, illegal and stupid if they didn't.
      2. Say nothing. Perfectly legal. Possibly a hint that they helped the NSA, because you'd want to tell the world if you didn't.
      3. Say "we didn't help the NSA" - illegal if they did, perfectly legal if they didn't.

    41. Re:They can't stop unlockers by puto · · Score: 0

      Apple can remotely remove and disable apps from the Iphone.. Also, when Apple took down the original Siri servers, and only allowed the 4s to connect, not everyone else who had the App working on previous Idevices, they suddenly had a non working app. Which is the same as removing it. And Apple did this to force upgrades...

      --
      The Revolution Will Not Be Televised
    42. Re:They can't stop unlockers by Anonymous Coward · · Score: 1

      Android has full disk encryption. The ordinary out-of-the-box full disk encryption from the Linux kernel.

      Cellebrite can doubtless brute force the typical user's 4-digit PIN in about ten seconds, and if you give them an Android device with a 40 character passphrase lock, they'll say they had "technical problems" and refund your money. Because they can't get in.

      Android isn't special in this regard, it really is just using the kernel's ordinary block device encryption. Really. The source code is right there, go look for yourself.

      Nothing anybody can do can make a 4 digit PIN lock safe against brute force by a sophisticated adversary, so if you want to be protected from such shenanigans you need a long (and thus, tedious to enter) passphrase.

    43. Re:They can't stop unlockers by cbiltcliffe · · Score: 1

      Well, the stink from the fart probably knocked him out for a while, so it might have been only a few minutes of actual, you know...consciousness....

      --
      "City hall" in German is "Rathaus" Kinda explains a few things......
    44. Re:They can't stop unlockers by TigerPlish · · Score: 1

      Apple is a very small aspect of this story. The NSA has militarized the internet.

      The apple doesn't fall from the tree -- the internet's daddy was DARPAnet, brought to you by DARPA, who is part of Dept. of Defense -- good 'ole DoD.

      In other words, the internet is a military brat. It wasn't militarized, it was born into a military family.

      --
      The "Civilized World" jumped the shark ca. 1973.
    45. Re:They can't stop unlockers by Anonymous Coward · · Score: 1

      Cellebrite recover the raw physical contents of the iPhone disk, and then they try all 10000 possible 4 digit passcodes, in under a second. Bingo, all the data is decrypted.

      The iPhone "disk encryption" is utterly miserably worthless unless you've selected a tricky passphrase. Look over the shoulders of a few iPhone users. Did they just type a sixteen character passphrase? No? It was a four digit PIN, just like the out-of-box settings of an iPhone? Then the disk encryption is just security theatre, a pretence that they're being protected while leaving them vulnerable.

      THAT is why Android doesn't bother claiming you have "disk encryption" by default, because such "encryption" is worthless without a strong key

      Cellebrite's big claim on Android is that they can use ADB to pull all the data off a phone. Just one caveat, the phone needs USB debugging enabled. Hmm, how do you get that? Well, the user has to unlock the phone, enable the hidden developer mode on the phone, then check a setting box labelled "USB debugging" which comes with warnings about people accessing all your data. Huh. If the user is willing to unlock their phone and run stuff for you I'd suggest you've got a much smaller forensic problem than you first thought.

    46. Re:They can't stop unlockers by fafalone · · Score: 1

      It's a good thing making something illegal completely stops it from occurring.

    47. Re:They can't stop unlockers by Anonymous Coward · · Score: 0

      The fact that their devices always get cracked is not proof that they do not have industry leading security. For all I know, their devices could be the last ones cracked at those events. In which case they have the best security. Or they could be cracked first, in which case they have the worst.

      Since you have failed to mention exactly where they lie on the "First Cracked - Last Cracked" line, I have to imagine that it would be devastating to your "Apple Sucks" position.

      And no, I'm not an Apple fanboy. I own zero Apple products. I just hate faulty logic.

    48. Re:They can't stop unlockers by Anonymous Coward · · Score: 1

      It is against the law to tell if you complied or worked with the NSA. You are required by law to lie! Sorry but Apple cooperated and now they are seeing their business crash due to the fact that they did and the NSA is to blame!

    49. Re:They can't stop unlockers by craigminah · · Score: 1

      Ever hear of cover stories? Apple could easily have a cover they could tell to make them appear to have complied with the law and not helped the NSA even if they did help the NSA. This is a form of legal lying.

    50. Re:They can't stop unlockers by Anonymous Coward · · Score: 0

      Really? Cause they didn't lose in 2013.

      And in many previous years it was only lost when they attacked outdates versions.

    51. Re: They can't stop unlockers by Anonymous Coward · · Score: 0

      Not everyone is a shill. Do yourself a favor and quit assuming because someone voices their opinion, it means they are a company stooge.

    52. Re:They can't stop unlockers by sjames · · Score: 1

      You can mount the SD card as a disk via USB, but you can't see the system volume that way.

    53. Re:They can't stop unlockers by 7-Vodka · · Score: 2

      What good is encryption if your contacts don't use it?

      --

      Liberty.

    54. Re:They can't stop unlockers by djdanlib · · Score: 1

      Legality is all about clever interpretation of language. Depending on what your definition of "is", is, or whatever. Here are some alternate interpretations for your enjoyment.

      We reviewed the code = we looked at some code. This does not mean code was changed. In fact, it probably wasn't changed.

      Ensure our customers' security = too nebulous to be meaningful. Security according to whom? Security in which sense? Do they think that the overall security of everyone is improved if their users can be spied upon to prevent violent crimes happening to other users? What is the timeframe between an exploit and a patch? You can't fix everything, because fixing costs money - so how much exploitation / negative PR does it have to reach before it gets acted upon?

      Industry-leading security = some freebies for your game of buzzword bingo. You can't measure security like that. Sure, you can compile some metrics from past data, and maybe have a metric that you can compare to another company's metric, but that doesn't give you a complete picture of security. What about what the users are encouraged to do by popular software and blogs? The end-user's security is out of your control. As it should be.

      Take appropriate steps = some coders were tasked with presenting options to their managers, who slimmed those options down for their managers, who decided whether various things were appropriate, using decision-making tactics that the coders may not have been privy to. Maybe they said no to the steps due to the cost of fixing it, or the upcoming new version making the broken one obsolete. Maybe that's where it stopped, and they called that appropriate steps. If not? Positive steps may not have been taken, profitable steps were probably taken, incompetent steps were almost certainly taken. Pork barrel maneuvering may have happened in those meetings too. You know, "we can fix it if we can increase our budget by X" or "we'll need to get more people working on project Y since it includes that fix". And it would be pretty simple to create a fix and put in a new back door in the same patch... fix it, say you fixed it, and shuffle the new one under the rug.

      Stay ahead of malicious hackers = We're really hoping that these nerds are right that this is going to be hard to break, because we spent a lot of money letting them research it instead of making some other part of the experience more stylish.

      Defend our customers = When they are attacked, we will shake our fingers and give those nasties such a tut-tutting! Maybe we'll release a patch in three to six months or a year or two, if the managers interpreting their budgets and allocating it to those spreadsheet columns allows that. Otherwise, we'll just tell the engineers to make sure they fix that in the next version but the deadline can't slip so if it doesn't make it in under the wire we'll maybe patch it after the fact. Sometimes, too, you have to take a hit from one enemy while you're stopping a hit from another enemy. Maybe you'll let the spiders in your kitchen live, hoping they will help you out with those fruit flies, or you'll let the huntsman spiders live in the basement to keep the black widows out. Could it be that they see an ecosystem and have decided that certain less-problematic enemies are keeping more problematic enemies away? Did someone wine and dine the relevant managers and convince them that they should be allowed to live in there under some pretext of security?

      I've worked in a large company for long enough that I know that you say you're doing an "internal investigation" after the problem is in your face, then you probably have six months to two years to complete the investigation before enough people start to jump ship for it to matter. At that point, the product is probably obsolete and your faithful sales reps have been touting each new version as better and more secure.

      Call me cynical if you must, but I don't see any actual descriptions of what's being done behind closed doors at any of these companies or what's changing in the patches they roll out.

    55. Re:They can't stop unlockers by the_B0fh · · Score: 1

      You are missing the original point aren't you? This isn't about forcing the password out of you. This is about the NSA installing backdoors in your phone without your knowledge.

      I pointed out one way this is prevented in iOS from iPhone 3GS onwards, by default, and is not enabled by default in Android - in fact, most Android users don't even know it is available.

      You went off on an entirely different tangent. Nice straw man.

    56. Re:They can't stop unlockers by erikkemperman · · Score: 1

      Er.. The post I replied to (not yours) was a back of the envelope calculation about how long it would take to guess a pin code. I pointed out there are easier ways to do that. Despicable, but easier.

      Not sure why you would feel all offended by that though. I don't feel the need to turn these NSA stories into a iOS--android slugfest, because it would appear they're all compromised to some extent, but whatever floats your boat I guess. I use an iPhone, myself, and develop for android. I think they both kind of suck, but in different ways.

      --
      Gosh, thanks. That must be why the other ships call me Meatfucker -- GCU Grey Area (Eccentric)
    57. Re:They can't stop unlockers by Anonymous Coward · · Score: 0

      The best part about all of this is how everyone, including yourself, assume that your own personal scale of values and priorities is how everyone in the world rates everything.

      The fact of the matter is you only need as much security as the thing you are protecting is worth. On the other hand, the choice of which slavemaster you want to be sold to will affect you the same amount regardless of why you're asking for it.

      Oops, did I just burst your trademark Apple-installed bubble of superiority?

    58. Re:They can't stop unlockers by the_B0fh · · Score: 1

      If I misread you, apologies. And yes, they all suck in different ways.

      I was just pointing out that this particular suckitude doesn't exist any more on iOS, and still exists on default Androids-fresh-from-factory.

    59. Re: They can't stop unlockers by jbee02 · · Score: 1

      Cause its apple, one of the biggest powerful international companies in the world. They're probably better at gathering information then NSA, and they most definitely have more and better IT workers then the NSA.

    60. Re:They can't stop unlockers by smash · · Score: 1

      Because of course there's no way they possibly did that on the server end... by, you know... perhaps changing an authentication key or similar.

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    61. Re:They can't stop unlockers by smash · · Score: 1

      You know the iPhone will wipe itself by default if the wrong pin is guessed 10 times?

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    62. Re:They can't stop unlockers by smash · · Score: 1

      If you have an attacker with the NSA's resources, you're boned. They already can sniff all your data in flight before it gets on the device.

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    63. Re:They can't stop unlockers by smash · · Score: 1

      You missed the bit about the "up to 1kw" (with external power source) of RF emitted by the hardware bug(s)?

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    64. Re:They can't stop unlockers by smash · · Score: 1

      I dunno, looks like Manning still got charged with aiding the enemy.

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    65. Re:They can't stop unlockers by smash · · Score: 1

      You mean like this?

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    66. Re:They can't stop unlockers by smash · · Score: 1

      LOL. They're seeing their business crash... like Cisco, Juniper, Huwawei, who have also been implicated?

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    67. Re:They can't stop unlockers by shentino · · Score: 1

      Manning didn't help the NSA.

    68. Re:They can't stop unlockers by gordo3000 · · Score: 1

      what are you talking about? in 2012 apple osx + safari was the only one of the possible targets left standing and in 2013 no one even tried. In mobile pwn2own apple did fall to a recovery of Facebook account credentials, which makes me worry about what cookies are kept on my device. But it doesn't seem it got into the iCloud password set. There is a big difference (at least for me).

      Apple is a lot of things, and one of them is probably the best widespread vendor when it comes to security (at least in competitions like this). Samsung S4 fell horrifically, to a system level hack via a preinstalled app. Now you may say microsoft and blackberry had no attacks shown at mobile, but it could be they just aren't popular (you can't really say that with a straight face about apple OSX and safari in the full OS version of pwn2own)

    69. Re:They can't stop unlockers by sosume · · Score: 1

      Blackberry? Nokia? Windows Phone?

    70. Re:They can't stop unlockers by BlindBear · · Score: 1

      The link you are probably after.... http://xkcd.com/538/

      --
      I prefer Classic Slashdot.
  2. Sorry Apple. by Anonymous Coward · · Score: 5, Insightful

    Don't believe you.
    It's now proven most American companies can't be trusted.

    1. Re:Sorry Apple. by NoNonAlphaCharsHere · · Score: 2

      "Whenever we hear about attempts to undermine Apple's industry-leading security, we thoroughly investigate and take appropriate steps to protect our customers"

      Best laugh I've had all day.

    2. Re:Sorry Apple. by deconfliction · · Score: 1

      Don't believe you.
      It's now proven most American companies can't be trusted.

      I for one, either believe them, or think it doesn't matter. It doesn't take infiltrating every member of the company to accomplish what the NSA has. A very very small number of high ranking employees can be compromised, and effectively compromise the main products and services of the corporation. While open source and open development is still vulnerable to this same threat vector, I think its decreased threat surface will make it a formidable contender in the post-snowden tech era.

    3. Re: Sorry Apple. by johnsnails · · Score: 0

      Best laugh you have had all year.
      FTFY

    4. Re:Sorry Apple. by Anonymous Coward · · Score: 0

      Nice troll, but you're stupid if you trust anybody or anything with secrets, period.

    5. Re:Sorry Apple. by dk20 · · Score: 4, Insightful

      Remember when you could jailbreak your iphone by simply going to a website? Industry-leading for sure...

    6. Re:Sorry Apple. by Anonymous Coward · · Score: 0

      sorry to say - but NSA infected all devices - take a look at Huawei router - NSA modify the boot bios
      and would you trust Huawei router?

    7. Re:Sorry Apple. by BradleyUffner · · Score: 1

      Remember when you could jailbreak your iphone by simply going to a website? Industry-leading for sure...

      It's all relative... What company hasn't been hacked recently?

    8. Re:Sorry Apple. by sethstorm · · Score: 1

      They're just Thinking Differently about security.

      --
      Twitter supports and protects racists - by smearing their critics with the "Hate Speech" label.
    9. Re:Sorry Apple. by Anonymous Coward · · Score: 4, Insightful

      Right, but then, do you remember a time when you couldn't have a windows machine pwned by visiting a web page? There's also plenty of instances of Linux being remotely comprisable this way. Which operating system do you know of that hasn't been exploitable at some point by visiting a web page?

    10. Re:Sorry Apple. by R3d+M3rcury · · Score: 3, Insightful

      Keep in mind that Apple has a very secretive culture. I could easily believe that there is a group that works with the NSA but that is not generally known.

      Hell, most employees hadn't heard of the iPhone before it was announced. How difficult would it be to have a group inside Apple that did these things and not have anybody outside of those employees know about it?

    11. Re:Sorry Apple. by lxs · · Score: 1

      Moments from the life of Anonymous part 1 : The teenage years

      Cute girl: "Hey, can I tell you a secret?"
      AC: "Waaah! You're STUPID STUPID!"
      *runs away screaming*

    12. Re: Sorry Apple. by Anonymous Coward · · Score: 1

      Good for you. The rest of the world, who aren'tt flag-waving Americans, are pissed off as hell and don't trust any US company amy more. The move away from US tech will take years, but the NSA has butt-sexed all US tech workers without even giving them a reach-around. If you work for a US tech company, you might want to find a new line of work.

    13. Re:Sorry Apple. by Anonymous Coward · · Score: 0

      Don't believe you.
      It's now proven most American companies can't be trusted.

      And what makes you believe that Huawei isn't providing back doors to Chinese intelligence and Samsung to Korean Intelligence? I'm sure Korean companies could benefit mightily from backdoors in Samsung phones operated by their foreign competitors.

    14. Re:Sorry Apple. by jez9999 · · Score: 1

      Also, it looks like the NSA basically require companies to say "we don't have anything to do with the NSA". If anything, the company's feeling the need to come out and say it so publically is a red flag that they may have worked with them.

    15. Re:Sorry Apple. by gnasher719 · · Score: 1

      Also, it looks like the NSA basically require companies to say "we don't have anything to do with the NSA". If anything, the company's feeling the need to come out and say it so publically is a red flag that they may have worked with them.

      That is nonsense. The NSA cannot require any company to lie. They may be able to require a company to be silent, but they cannot require a company to lie.

      And your logic is the kind of logic typically used by wives and girlfriends. Assuming meaning and intention that isn't there.

    16. Re: Sorry Apple. by MikeMo · · Score: 1

      Right, but do you notice you can't do that anymore?

    17. Re: Sorry Apple. by Anonymous Coward · · Score: 0

      C64

    18. Re:Sorry Apple. by cbiltcliffe · · Score: 1

      Which operating system do you know of that hasn't been exploitable at some point by visiting a web page?

      DOS.

      --
      "City hall" in German is "Rathaus" Kinda explains a few things......
    19. Re:Sorry Apple. by TubeSteak · · Score: 1

      http://www.foreignpolicy.com/articles/2013/11/21/the_obscure_fbi_team_that_does_the_nsa_dirty_work

      But interviews with current and former law enforcement officials, as well as technology industry representatives, reveal that the [ata Intercept Technology Unit, or DITU] is the FBI's equivalent of the National Security Agency and the primary liaison between the spy agency and many of America's most important technology companies, including Google, Facebook, YouTube, and Apple.

      We know the FBI is intimately wrapped up in all these shenanigans, but it's almost like journalists are intentionally asking the wrong question by only talking about the NSA.

      Does Apple deny helping the FBI backdoor the iPhone?

      --
      [Fuck Beta]
      o0t!
    20. Re:Sorry Apple. by mimino · · Score: 1

      Akamai? And a gazillion of others. Also it is not relative, we are talking about Apple now. Anyway, the post was about rooting an iphone by visiting a web site and doing nothing more.

    21. Re:Sorry Apple. by Anonymous Coward · · Score: 0

      There are photos of the meeting between Obama and all the tech-company owners. Jobs was in that photo raising his glass.

    22. Re:Sorry Apple. by Plumpaquatsch · · Score: 1

      Keep in mind that Apple has a very secretive culture. I could easily believe that there is a group that works with the NSA but that is not generally known.

      Hell, most employees hadn't heard of the iPhone before it was announced. How difficult would it be to have a group inside Apple that did these things and not have anybody outside of those employees know about it?

      If anybody at Apple had given the NSA a backdoor in the iPhone - why would they develop software to get into iPhones more than a year later?

      --
      Of course news about a fake are Fake News.
    23. Re:Sorry Apple. by Anonymous Coward · · Score: 0

      If someone can be imprisoned for breaking a law they had never heard of before, then how would this absolve the rest of Apple?

    24. Re:Sorry Apple. by Nethemas+the+Great · · Score: 1

      There's also plenty of instances of Linux being remotely comprisable[sic] this way.

      Citation require.

      --
      Two of my imaginary friends reproduced once ... with negative results.
    25. Re:Sorry Apple. by smash · · Score: 1

      Good luck with the Chinese companies.

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    26. Re:Sorry Apple. by smash · · Score: 1

      Where can I buy an Akamai smartphone?

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    27. Re:Sorry Apple. by smash · · Score: 1

      Given that DOS has only one security context, and web browsers are available, the only reason for that is the lack of a userbase.

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    28. Re:Sorry Apple. by smash · · Score: 1

      Also Cisco and Juniper (as per the video). Good luck building your own router, on your PC with compromised BIOS and compromised hard drive firmware (also, as per the video).

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
  3. This could be true by Janek+Kozicki · · Score: 4, Interesting

    Well, since Apple is aware that whatever they claim can be sooner or later verified by checking Snowden data, they could be telling the truth.

    --
    #
    #\ @ ? Colonize Mars
    #
    1. Re:This could be true by AmiMoJo · · Score: 5, Insightful

      Like RSA they will just keep denying it and hope there is nothing to directly contradict them. They may well be telling the truth, but we can't be sure now and maybe even Apple don't know that one of their engineers was compromised and forced to work for the NSA.

      We know that iphones kept location logs, for example. Apple claimed it was done in error... Perhaps a deliberate error by an NSA agent in their ranks, but we will probably never know.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    2. Re:This could be true by Anonymous Coward · · Score: 5, Insightful

      Perhaps they are constrained by law and couldn't release the truth if they wanted to.
       

      Apple has never worked with the NSA to create a backdoor in any of our products, including iPhone. (Once the NSA backdoored the iPhone, we didn't fix it) Additionally, we have been unaware of this alleged NSA program targeting our products(In this case, 'we' refers to the marketing department and the guy that brings the bagels) ... Whenever we hear about attempts to undermine Apple’s industry-leading security, we thoroughly investigate and take appropriate steps to protect our customers. We will continue to use our resources to stay ahead of malicious hackers and defend our customers from security attacks, regardless of who’s behind them. Securing out products against the non malicious, non attacking survailence by the NSA would be inappropiate, of course.

    3. Re:This could be true by thue · · Score: 2

      > Like RSA they will just keep denying it and hope there is nothing to directly contradict them.

      Yup. And now John Kelsey (who authored the NIST report) says that the potential for the Dual_EC_DRBG backdoor was brought up in an ANSI group meeting, in a group that had three formal RSA Security members (whether they were actually present at the meeting we don't know). And two Certicom members of the same group wrote a patent exactly describing the back door in January 2005, which presumably all the ANSI group members had access to. But RSA Security's know-nothing defense is looking ever-more ridiculous.

      I have been updating Wikipedia: https://en.wikipedia.org/wiki/Dual_EC_DRBG . At some point I guess the journalists will wake up?

      Also there is no way at least Daniel Brown of Certicom (co-author of the patent) wasn't aware there were probably a backdoor. But he seems to have kept it fairly low-key. And now in 2013 he says: "All considered, I don't see how the ANSI and NIST standards for Dual_EC_DRBG can be viewed as a subverted standard, per se."... And at least Daniel Brown knew exactly how to neutralize the back door, but little was done.

    4. Re:This could be true by Anonymous Coward · · Score: 0

      Perhaps they are constrained by law and couldn't release the truth if they wanted to.

       

      Apple has never worked with the NSA to create a backdoor in any of our products, including iPhone. (Once the NSA backdoored the iPhone, we didn't fix it) Additionally, we have been unaware of this alleged NSA program targeting our products(In this case, 'we' refers to the marketing department and the guy that brings the bagels) ... Whenever we hear about attempts to undermine Apple’s industry-leading security, we thoroughly investigate and take appropriate steps to protect our customers. We will continue to use our resources to stay ahead of malicious hackers and defend our customers from security attacks, regardless of who’s behind them. Securing out products against the non malicious, non attacking survailence by the NSA would be inappropiate, of course.

      Sorry, I was busy cheering for the heroic struggle of iOS jailbreakers, let me change hats and start jeering Apple for intentionally leaving obvious gaping holes for the NSA.

      I can't figure out what world you people live in...

    5. Re:This could be true by tlhIngan · · Score: 1

      We know that iphones kept location logs, for example. Apple claimed it was done in error... Perhaps a deliberate error by an NSA agent in their ranks, but we will probably never know.

      It wasn't a location log. It was a cache. If you enable location services, your iDevice gets sent a list of local MAC addresses for WiFi and tower IDs. Apple sends you a list of MAC addresses and their locations so you can do WiFi-based geolocation (Apple owns at least one company doing this).

      In fact, you can take a WiFi-only iPad or iPod touch, tether it to your phone, and then do Google Maps. You'll find the same data in the cache from WiFi. Now, how precise the log is depends on your WiFi density. If you're in the city, Apple may send you only a block wide of data because of the WiFi density. In the country, you'll probably see far less accurate "tracking".

      Anyhow, it's easy for the NSA to get at all the phone data. Without Apple's permission.

      For iOS 6 and below, you just hook it to a PC and snarf all the data - Ubuntu's had this since 12.04!

      For iOS7, isn't it convenient that an iOS7 jailbreak just happened to come out? And who's to bet that the NSA doesn't have more jailbreaks at the ready? Perhaps that's how ev4ders7 got their jailbreak?

    6. Re:This could be true by girlintraining · · Score: 2, Interesting

      whatever they claim can be sooner or later verified by checking Snowden data

      Clearly slashdot's common sense quotient has passed its apex with the number of up-mods on this. Snowden didn't download the full NSA database of everything. Ever. Nobody in the NSA has that level of access. Nothing like that likely even exists at the NSA. It isn't like there's just this one computer, somewhere, that sits in a warehouse and contains every national secret ever. You do not get to "Hack the Gibson" and then it just ejects candy like it's a digital pinata. SIPR/NIPR is a network, and it's second only to the actual internet in its size. In fact, it's where the Internet came from; it's MILNET version 2.0 basically. That's where the data is; on thousand of servers spread across the world. And that's just the stuff the NSA has ownership of.

      But let's ignore all of that because here on Slashdot, we (apparently) cannot expect people to have a basic grasp of networking and systems fundamentals. Let's look at just the non-technical reasons why this is a horribly stupid statement to make: Snowden's gone. He's not part of current operations. Who is to say that after he left, the NSA decided to embark on a new intelligence initiative. I know -- it's shocking, but organizations sometimes continue to function and do new things after someone leaves it. And that person, no longer being part of the organization, will know nothing of them.

      Snowden has no useful function as verification for anything right now. Much of the intelligence data he's collected is now worthless -- a lot of this stuff has a "use by" date, and just like milk, once it's gone bad, trying to consume it will do terrible things to you. There is no Snowden Fact Checking Emporium, where you can just show up and punch in some keywords and find out what the NSA's up to today, or yesterday, or any day really. The data he stole doesn't offer that kind of granulated access... it's like he shoplifted a library, but all the pages in all the books are ripped out and thrown in the middle of the room. Without the organization and analysis of the data, it's largely useless anyway.

      There is no verification potential here. None. Nadda. Zero. Zippo. No potential at all. What Snowden says or doesn't say, what he released or didn't release, offers us no confirmation of any kind whatsoever regarding current intelligence operations.

      --
      #fuckbeta #iamslashdot #dicemustdie
    7. Re: This could be true by Anonymous Coward · · Score: 0

      They are obviously lying. They think their reputation is saved if they say these things.

      Trust, it is gone.

    8. Re:This could be true by AHuxley · · Score: 2

      Snowden went to the press with the documents. i.e. whistleblowing.
      The verification options are very simple - a large group of people exist in the private sector and academia who once worked for different govs around the world.
      They would be happy to offer their expert verification services to the press per "document" or over years.
      Think of it as great computer history filling in the ~1970-80 to 00 gaps. No use by date on history, books and other publishing :)
      Confirmation of private sector security malware can be found by skilled people e.g. 30C3 To Protect And Infect - The militarisation of the Internet
      http://www.youtube.com/watch?v=XZYo9TPyNko and part two
      http://www.youtube.com/watch?v=b0w36GAyZIA

      --
      Domestic spying is now "Benign Information Gathering"
    9. Re:This could be true by Anonymous Coward · · Score: 5, Interesting

      Perhaps they are constrained by law and couldn't release the truth if they wanted to.

       

      Apple has never worked with the NSA to create a backdoor in any of our products, including iPhone. (Once the NSA backdoored the iPhone, we didn't fix it) Additionally, we have been unaware of this alleged NSA program targeting our products(In this case, 'we' refers to the marketing department and the guy that brings the bagels) ... Whenever we hear about attempts to undermine Apple’s industry-leading security, we thoroughly investigate and take appropriate steps to protect our customers. We will continue to use our resources to stay ahead of malicious hackers and defend our customers from security attacks, regardless of who’s behind them. Securing out products against the non malicious, non attacking survailence by the NSA would be inappropiate, of course.

      Ok, I actually went and RTFA. TFA says, and I quote:

      The documents suggest that the NSA needs physical access to a device to install the spyware—something the agency has achieved by rerouting shipments of devices purchased online—but a remote version of the exploit is also in the works.

      If somebody actually reroutes shipments and tampers with your product in transit it's kind of hard to 'fix' that. What would you like Apple to do? Have every iPhone they sell escorted by armed guards? With all due respect to the noble sport of Apple hating, one security researcher speculates, and once again I quote:

      Either [the NSA] have a huge collection of exploits that work against Apple products, meaning they are hoarding information about critical systems that American companies produce, and sabotaging them, or Apple sabotaged it themselves...

      ...and every Apple hater on /. immediately takes that as proof positive that Apple must be sabotaging their own product by routing their shipments through NSA hacking HQ for spyware installation and have a team of engineers developing a remote attack kit for the NSA. Come to think of it, why would the NSA even need have one 'in the works' if Apple is building NSA friendly back doors into their products by default? I mean it could not possibly be the case that the NSA has teams of people tapping into the hacker underground and buying up zero day exploits now could it? (Hint: that's the other thing that security guy suggested) No it's much more logical that the NSA have blackmailed thousands of American and foreign companies into sabotaging their own products. After all, such an operation is much more easy to cover up (not) that just quietly buying up zero day exploits and/or hiring a team of hackers to ensure a steady supply of exploits. If Apple actually did what they are being accused of they deserve to get punished (and they will when their customers abandon them in droves), but let's at least try to base the idle speculation on something more solid than "I hate Apple".

    10. Re:This could be true by NotSoHeavyD3 · · Score: 2

      If somebody actually reroutes shipments and tampers with your product in transit it's kind of hard to 'fix' that. What would you like Apple to do? Have every iPhone they sell escorted by armed guards?

      I was wondering when somebody would point that out. Anyway like you point out, their "cracking" of apple products consists of getting to it before the end user gets to it. Any system is vulnerable if they can do that.(Yes, even Linux.)

      --
      Did you know 80 to 90% of the moderators on slashdot wouldn't recognize a troll even if one dragged them under a bridge.
    11. Re:This could be true by cbiltcliffe · · Score: 1

      Clearly slashdot's common sense quotient has passed its apex with the number of up-mods on this. Snowden didn't download the full NSA database of everything. Ever. Nobody in the NSA has that level of access. Nothing like that likely even exists at the NSA.

      Really, it's quite impressive the knowledge you have of internal, top-secret NSA operations. How exactly do you come up with this information?
      On top of that, it's pretty widely known that Snowden didn't use just his own credentials to download documents. He accessed several different high level accounts. Between the lot of them, it's entirely possible that he could have accessed everything, or at least the vast majority of data.

      Snowden's gone. He's not part of current operations. Who is to say that after he left, the NSA decided to embark on a new intelligence initiative. I know -- it's shocking, but organizations sometimes continue to function and do new things after someone leaves it. And that person, no longer being part of the organization, will know nothing of them.

      That doesn't make his old information irrelevant. It just means that any new program which we don't know about is even more of an overreach than all the stuff they've been doing in the past.

      The data he stole doesn't offer that kind of granulated access... it's like he shoplifted a library, but all the pages in all the books are ripped out and thrown in the middle of the room. Without the organization and analysis of the data, it's largely useless anyway.

      How do you know what he stole? You've never seen it. Maybe it's files organized by folders with very descriptive names, readme documents explaining exactly what's in each folder, all signed and verifiable with a public NSA key. Maybe it's a dump from a database like SharePoint, that embeds documents into the database, rather than pointers, and all the descriptions/categories/other....ahem...metadata, are right there in the SQL, organizing everything exactly as the NSA had it set up.

      --
      "City hall" in German is "Rathaus" Kinda explains a few things......
    12. Re:This could be true by BasilBrush · · Score: 1

      For iOS7, isn't it convenient that an iOS7 jailbreak just happened to come out? And who's to bet that the NSA doesn't have more jailbreaks at the ready? Perhaps that's how ev4ders7 got their jailbreak?

      Not sure I follow the logic of your conspiracy theory here. If the NSA were the first to have a jailbreak iOS7, what benefit would they get from publishing it? Them being the only ones having it would be to their benefit.

    13. Re:This could be true by girlintraining · · Score: 1

      You clearly don't understand what verification means in the intelligence community. All you're doing is just regurgitating what you've heard from someone else. The ability to copy and paste does not create validation, anymore than citing a wikipedia article can prove the veracity of a statement.

      --
      #fuckbeta #iamslashdot #dicemustdie
    14. Re:This could be true by girlintraining · · Score: 2

      Really, it's quite impressive the knowledge you have of internal, top-secret NSA operations. How exactly do you come up with this information?

      By using common sense and the belief that the NSA is run by rational people, not snarky assholes on Slashdot who think they know everything simply because they googled it, but in actuality have exactly dick in the way of critical thinking skills. Nowhere in military or intelligence doctrine will you find the "Put all your eggs in one basket" to be marked as the best idea. Our nuclear weapons are spread throughout the country. Our military bases are spread throughout as well. Our training facilities are kept separate from our active duty areas. The internet, originally designed to support these activities, was designed to be so decentralized it could withstand a nuclear strike. It does not take very much imagination at all to conclude that the NSA will have decentralized and compartmentalized intelligence assets. I'm really sorry if there isn't a wikipedia entry for you to read up on this, but amongst those who didn't grow up having content spoon fed to them, we had to use this thing called a "brain" to fill in the missing pieces.

      That doesn't make his old information irrelevant. It just means that any new program which we

      This article references a current claim by Apple. It is not a claim Apple made two years ago which is being investigated. Unless I'm mistaken Snowden stole classified documents, not a time machine. He cannot possibly have any knowledge of whether Apple is telling the truth, today, right now, at this moment. Again, your inability to engage in any kind of deductive reasoning has failed you.

      How do you know what he stole? You've never seen it. Maybe it's files organized by folders with

      Snowden has already released all of the documents he stole. He's said as much. There are multiple copies of the data he released available for anyone who wants it. I'm sorry to disappoint you, but what Snowden released was not organized in any meaningful capacity. It's just like the diplomatic cables on Wikileaks... a lot of data, but no useful organizational scheme. That's why it's taken most of 2013 for people to go through it and release new "revelations" and attribute the find to Snowden. All he's ever done is run to Russia, hide, send a bunch of copies of what he stole to a bunch of people, get asylum, and then take his 15 minutes of fame about 20 times over. That's it. He wasn't an NSA analyst. He didn't know what he was looking at really -- his level of understanding of the overall organization and its operations was casual, unspecialized, and of the sort of thing you'd overhear at the water cooler. Which is what you'd expect from a systems administrator -- not an analyst. He knew the general picture, but not the specifics. The documents he stole took months to piece together the specifics enough to support his claims. There was no organization.

      --
      #fuckbeta #iamslashdot #dicemustdie
    15. Re:This could be true by Anonymous Coward · · Score: 0

      Expired, done, spent, used, useless, pointless, nothing to see here, move along. Support your local police. Be seeing you!

      "I am number two."
      "Who is number one?"
      "You are number six."

    16. Re:This could be true by Plumpaquatsch · · Score: 1

      Like RSA they will just keep denying it and hope there is nothing to directly contradict them.

      You're projecting again. Only in your case the facts do contradict your claims.

      --
      Of course news about a fake are Fake News.
    17. Re:This could be true by Anonymous Coward · · Score: 0

      The kettle calls the pot black...

  4. I wish I could believe that by Sean · · Score: 3, Insightful

    But I can't.

    1. Re:I wish I could believe that by Fantasio · · Score: 0, Flamebait

      Apple response is not surprising, it's just not targeted to you. This response has been carefully crafted and targeted to the Apple customer who'll believe anything coming from Apple, no question asked. Remember, Apple knows better than you what is good for you, because they know more about you than yourself .....except maybe after the NSA.

    2. Re:I wish I could believe that by amiga3D · · Score: 2

      What the hell? You must not read any Apple blogs. Apple's customers constantly bitch and complain to and about Apple. The problem is most of them feel they have nowhere else to go. Windows is so fucked and Linux is too much trouble for most of them.

    3. Re:I wish I could believe that by cbiltcliffe · · Score: 1

      GP didn't say "all Apple customers," they said "the Apple customer who'll believe anything coming from Apple, no question asked." That's clearly not all Apple customers, just as the bitching and complaining ones on the forum/blogs are obviously not all of Apple's customers.

      --
      "City hall" in German is "Rathaus" Kinda explains a few things......
  5. First Denial I've Heard... by rizole · · Score: 1

    ....which might not be to say much but I'm not sure I've heard anyone else saying "Not Me!". That could be down to the non-discolures of course.

  6. non-denial denial? by Anonymous Coward · · Score: 5, Insightful

    They didn't say there was *not* an NSA backdoor. All they said was that they didn't work with the NSA to create one.

    1. Re: non-denial denial? by Anonymous Coward · · Score: 5, Insightful

      Even the "news" about what the press is calling a backdoor never stated that Apple helped create it. What the guy (and the docs from Snowden) said was that the NSA was successful installing malware (that included back door access to many, many things) 100% of the time when they had physical access to the device. This should not be surprising to anyone here and should be even easier on devices that allow trivial access to root.

      Now, the guy who talked about this on stage stated (while admitting he had absolutely no evidence for this) that he believed Apple probably helped. Given the lack of evidence this claim is almost certainly libelous/slanderous, but so goes life. People should really work harder to examine facts instead of letting their dislike for a company determine what is true or not.

    2. Re:non-denial denial? by Anonymous Coward · · Score: 0

      "Apple has never worked with the NSA to create a backdoor in any of our products, including iPhone."

      Okay... thats fair.

      Additionally, we have been unaware of this alleged NSA program targeting our products.

      Translation: We have never heard of this one, but ...

      We will continue to use our resources to stay ahead of malicious hackers and defend our customers from security attacks, regardless of who’s behind them.

      Translation: evad3rs are the ones to be concerned with as they probably sold a backdoor into your phone to Chinese pirates. Is the NSA malicious?

    3. Re: non-denial denial? by Anonymous Coward · · Score: 0

      He actually went out of his way to say that he didn't think apple was complicit, that instead they write easily exploitable code.

    4. Re:non-denial denial? by mjwx · · Score: 1

      They didn't say there was *not* an NSA backdoor. All they said was that they didn't work with the NSA to create one.

      So a backdoor already existed, they didn't need to work with anyone to create it.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    5. Re: non-denial denial? by Anonymous Coward · · Score: 0

      He actually went out of his way to say that he didn't think apple was complicit, that instead they write easily exploitable code.

      Apple and everybody else too... how is that news? Just about the only people on the market that do develop a well hardened OS are the OpenBSD team with their famous boast of "Only two remote holes in the default install, in a heck of a long time!". Unfortunately commercial OS vendors have to strike a balance between security and features that sell their OS and their devices, they can't spend their entire time looking for potential exploits (And, yes, that includes Google/Android).

    6. Re:non-denial denial? by Anonymous Coward · · Score: 0

      AND they are LEGALLY allowed AND EXPECTED TO LIE.

  7. Because, of course... by Anonymous Coward · · Score: 5, Insightful

    Because, of course, when your domestic intelligence agency asks you to do something, and you comply, you then also admit to it the first time someone questions your integrity.

    It's almost as useful as government departments (esp. intelligence agencies) issuing press releases declaring that they only do what's in their mandate and according to the law.

    Trust no one, but assume innocence until proven guilty. So, while nobody should trust Apple devices with sensitive data, any direct accusation must be backed up with evidence. It's then up to Apple to defend itself by attacking the evidence. What we have here is neither.

    1. Re:Because, of course... by VortexCortex · · Score: 2

      Trust no one, but assume innocence until proven guilty.

      OK, so what if we find them guilty of silencing activists to protect the status quo instead of protecting us from enemies, and they give us a non choice to trust them or not while they keep doing the same either way, and even escalate to lying directly to their overseers in congress. Then what? At what point do you become a scientist and say: "Oh, they're innocent? No. Prove it."

      You see, you've forgotten a key piece of the puzzle. If the citizens are to be assumed innocent until proven guilty, then the laws, law enforces, government agents, prosecutors, and etc. governance systems are assumed wrong until proven right -- Or more succinctly: Governments are assumed guilty until proven innocent -- This goes doubly when government secrecy is involved. They can't prove their not guilty so long as they're allowed secrets. We don't really need secrets. No spy can harm a government without secrets. The NSA is just a big single point of failure allowing every enemy spy above Snowden's caliber to get at even more data.

      Corporations and governments frequently work together more readily than common citizens. The more money you have to lose the easier it is for the government to threaten you into compliance. This means that the whole "innocent citizen until proven guilty" thing goes right out the window. Apple is not a common citizen. The "guilty system until proven innocent" doesn't apply by default either to corporations. For evaluating them it is up to the methods of rationality. Any claim they make we must prove, as we would any scientific claim, with evidence. No evidence? It's bullshit. That's why the IRS reserves the right to do audits -- They don't trust corporations by default to be acting in the public's best interest, why would you?

    2. Re:Because, of course... by VortexCortex · · Score: 1

      Damn you eggnog. I do understand the difference between their there and they're, and other such typos... Proofreading after editing is always difficult for cybernetic systems who have preexisting mental pattern to match and thus a tendency to see what they expect (a form of confirmation bias). Meh, consider it a test of sentience. If you can grok the message without balking like a BASIC prompt then you're at least as smart as a simple lexical AI which extracts meaning from signal and isn't distracted by a little noise. Bias can be a valuable tool when wielded properly, indeed, without it you would understand nothing.

  8. Totalitarian Business Model for Totalitarians by melchoir55 · · Score: 1, Troll

    Apple is *proud* of its totalitarian business model, which is politely referred to as a "walled garden". Live in our little apple world where no one is free! No freedom means safety! You don't have to worry about bad words, or nipples, or someone pointing out that Jesus probably got laid all the time! We have complete control and domination over everything which operates in our ecosystem!

    The apple philosophy is perfectly consistent with that of the NSA, the security state, and fascism in general. Add on some friendly govt subsidies and freedom to continue abusing the hell out of the american tax system...

    1. Re:Totalitarian Business Model for Totalitarians by Nerdfest · · Score: 5, Interesting

      This could be part of the reason the Whitehouse waived the patent decision against them.

    2. Re:Totalitarian Business Model for Totalitarians by Nerdfest · · Score: 0

      It's sad that you're getting modded as troll, as you're quite correct. People here constantly say that they appreciate what Apple is doing in requiring approval of all software, and in not allowing alternative software sources. It's very much the same as the people that say "I don't mind the NSA spying on me as I have nothing to hide", not thinking of the future where you have no alternatives.

    3. Re:Totalitarian Business Model for Totalitarians by jythie · · Score: 1

      Since breaking out of their walled garden is as easy as buying a competing device, and even still have access to the same phone network, calling it totalitarian is kinda out there.

    4. Re:Totalitarian Business Model for Totalitarians by dugancent · · Score: 3, Insightful

      It's not even in the same ballpark. Likening a the idea of a company checking out apps before you install them is nothing like having a government entity, with no accountability, recoding you every time you take a shit.

      Get real.

      --
      SJWs are the new boogeyman. -Me
    5. Re:Totalitarian Business Model for Totalitarians by rubycodez · · Score: 1

      because everyone is forced to buy an Apple product?

    6. Re:Totalitarian Business Model for Totalitarians by fisted · · Score: 1

      I recently purchased an Android phone, but it wasn't interoperable with my IDevice. So I purchased another IDevice.

    7. Re:Totalitarian Business Model for Totalitarians by gnasher719 · · Score: 1

      The apple philosophy is perfectly consistent with that of the NSA, the security state, and fascism in general. Add on some friendly govt subsidies and freedom to continue abusing the hell out of the american tax system...

      That's pretty idiotic. Apple's walled garden is there to protect customers, including their privacy, by preventing certain unwise choices. That has negative consequences sometimes, but everything in life is some compromise. Worst case that happens to you as the customer is a slightly reduced choice in software that you can run on the iPhone, including lots of software that is either rubbish or harmful. What the NSA and fascist states do is something completely different.

    8. Re:Totalitarian Business Model for Totalitarians by gordo3000 · · Score: 1

      my appreciation for a repository of software which has passed basic functionality and security checks has no bearing on my view of NSA spying. In no way does the existence of the app store inhibit me from installing any software I want on my apple device. But it nicely prevents a lot of people, the vast majority of whom are morons when it comes to computers, from screwing up (which, if you have done any tech support work ever, you should know happens to the vast majority of computer users).

      Hell, it's not like apple charges me for this validated software repository directly (obviously, a fraction of what I pay for an app, if I pay, goes to apple). It's awesome because it saves me the time I used to waste finding tools to do X in windows or Linux and half of what I download to be poorly documented, not compatible, or not offering the features as advertised. And it seems the security they force on every piece of software has prevented any system level hacks of Apple in the pwn2own contests (doesn't mean they don't exist, obviously, but it's better than if they were getting pwn'ed constantly).

  9. Obama could stop this with an executive order by Anonymous Coward · · Score: 1

    Why doesn't he?

    1. Re:Obama could stop this with an executive order by Anonymous Coward · · Score: 0

      It's nearing funny how everyone, including the president, is a wussy-ass in America, and does nothing to stop what NSA is doing. Well, enjoy your country.

    2. Re:Obama could stop this with an executive order by Fantasio · · Score: 2

      (why doesn't he ?)......Because he received a gag order from the NSA !

    3. Re:Obama could stop this with an executive order by rubycodez · · Score: 0

      He is an Uncle Tom; a bitch of mega-corporations run by white fat cats.

    4. Re:Obama could stop this with an executive order by BasilBrush · · Score: 1

      Then you don't understand the Obamacare debate at all. The "mega-corporations run by white fat cats" wanted healthcare the old and extremely profitable way. They didn't want affordable healthcare. They fought Obama every step of the way. It's to Obama's credit that he managed to get as far as he did against them.

    5. Re:Obama could stop this with an executive order by Nethemas+the+Great · · Score: 1

      Messing with the MIC is not conducive to a long, healthy life.

      --
      Two of my imaginary friends reproduced once ... with negative results.
  10. Aha by theweatherelectric · · Score: 1, Troll

    Apple has never worked with the NSA to create a backdoor in any of our products

    So Apple has worked for the NSA to create a backdoor in their products. I understand.

  11. Denying the wrong thing by Anonymous Coward · · Score: 5, Insightful

    They should say there is no backdoor, not that they did not help making one.

    1. Re:Denying the wrong thing by The+Real+Dr+John · · Score: 2

      Absolutely, this is the most absurd spin on the story I can think of. It really doesn't matter if they didn't assist the NSA. And it doesn't reassure that they say they will work hard to prevent all hacking. If this has been going on as reported, then Apple did not do a very good job of "staying ahead of malicious hackers and defend our customers from security attacks." Obviously Apple didn't do any worse than any of the companies mentioned in the Der Spiegel article, but they didn't do any better either.

      --
      A brain is a terrible thing to waste... Mind? That's debatable.
    2. Re:Denying the wrong thing by TrollstonButterbeans · · Score: 1

      Agreed. This is virtually an admission. Not that a USA-based corporation has the freedom to admit that kind of thing.

      On the "plus" side, well --- uh --- ok then I'm not sure what that could be so Nevermind ...

      --
      Priest: "Universe from nothing, no laws of physics, sped up time"+ huge discrepancies. Creationism? No. Big Bang Theory
    3. Re:Denying the wrong thing by Anonymous Coward · · Score: 0

      You can't promise what you can't prove, and you can't prove a negative. All they can say is that they have not put any backdoors into their own code. They can't promise that there are no unknown exploits or tools that the NSA has developed or acquired to do it.

    4. Re:Denying the wrong thing by Anonymous Coward · · Score: 0

      Rather, they are not aware of the existence of any backdoor.

    5. Re:Denying the wrong thing by cowwoc2001 · · Score: 2

      There is no way for them (or anyone else) to say with any certainty that a backdoor does not exist for this or any other product out there.

      The most Apple can do is say that they're not aware of a backdoor, but I doubt this will satisfy anyone with a tinfoil hat.

    6. Re:Denying the wrong thing by gl4ss · · Score: 1

      besides, due to the secret courts and national security, they wouldn't even be able to make a statement saying otherwise.

      furthermore, it's unlikely the spokesperson would have known about it even if happened.

      --
      world was created 5 seconds before this post as it is.
    7. Re:Denying the wrong thing by cbiltcliffe · · Score: 1

      You can't promise what you can't prove, and you can't prove a negative. All they can say is that they have not put any backdoors into their own code. They can't promise that there are no unknown exploits or tools that the NSA has developed or acquired to do it.

      That's true, but they could at least say "We don't know of any backdoors into our iPhones." That would be a heck of a lot more reassuring, even to an Apple fanboi, than what they actually said, and still doesn't require proving a negative.

      --
      "City hall" in German is "Rathaus" Kinda explains a few things......
    8. Re:Denying the wrong thing by cbiltcliffe · · Score: 1

      The most Apple can do is say that they're not aware of a backdoor, but I doubt this will satisfy anyone with a tinfoil hat.

      The tinfoil hat crowd won't be satisfied with anything, you're right. The healthy sceptics, on the other hand, tend to notice not what was said, but what was not said. In this case, Apple specifically avoided mentioning the lack of knowledge of any backdoor. Why would they do this, if they didn't know of one?

      --
      "City hall" in German is "Rathaus" Kinda explains a few things......
    9. Re:Denying the wrong thing by deconfliction · · Score: 1

      They should say there is no backdoor, not that they did not help making one.

      They should say that it is company policy to in all instances, secure the products and services from any possible backdoor. They should say that all of their employees are required to spend 30 minutes each year watching a refresher video on how to most effectively whistleblow should they be asked to do anything unethical or deceptive by any government agency, no matter the legal arguments that government agency uses to defend its 'orders'. Same goes for methods to deal safely with outright criminal elements that attempt the same through common means of coercion/extortion/blackmail/etc.

  12. So which is it by Anonymous Coward · · Score: 0

    Does Apple produce bad software which is trivially exploited (given that exploit is unconditional and for any and every current model) or did they do a decent job of security and been compelled to assist the NSA and keep it private?

  13. Wording /might/ be a bit off by MrDoh! · · Score: 1

    The first thing noticed with all the other Snowden releases was how pathetic the gov worded things 'We aren't spying right now, and won't be in the future'. ok... but... that extra tense you missed....


    I'm sure there's legal coverage for all of these people to flat out lie, and as shown, most of them have been, but the gov has their back, and I'm sure the wording of things signed meant they were compelled to lie.
    So they hit up Google/Microsoft/Cisco, and Apple is the only one who didn't turn over their information when forced to and doesn't even know what all this is about? Yeah, right. Need to do better to earn our trust, as I'm sure the next leak will show that Apple not only knew, but probably gave them the docs to allow this to occur.

    --
    Waiting for an amusing sig.
  14. Who's the enemy? by mariox19 · · Score: 5, Insightful

    This rogue agency will destroy billions upon billions of dollars worth of American commerce before its done.

    --

    quiquid id est, timeo puellas et oscula dantes.

    1. Re:Who's the enemy? by TrollstonButterbeans · · Score: 4, Interesting

      It is a government that prints trillions upon trillions in debt notes, I'm not sure they would notice "billions".

      Kind of like how I don't notice dropped pennies ...

      --
      Priest: "Universe from nothing, no laws of physics, sped up time"+ huge discrepancies. Creationism? No. Big Bang Theory
    2. Re:Who's the enemy? by amiga3D · · Score: 1

      Damn. I think that is one of the best comments in a while. Too bad I have no more mod points.

    3. Re:Who's the enemy? by Anonymous Coward · · Score: 0

      Good. Let these American companies get exactly the government they bought and paid for.

    4. Re:Who's the enemy? by mariox19 · · Score: 1

      Apparently, Osama bin Laden was wasting his time working for the wrong organization. He should have sent his résumé to the Federal Reserve.

      --

      quiquid id est, timeo puellas et oscula dantes.

  15. Blackberry had government contracts by erroneus · · Score: 4, Interesting

    I seem to recall Apple recently acquired a certain type of government security approval. I wonder if any of that is related.

  16. Why so sure of a social/legal component? by Anonymous Coward · · Score: 0

    Appelbaum acts as if there could be no other way, as if it isn't possible for the NSA to hack into things the old-fashioned way. It's kind of telling about his bias, hmmm? He doesn't want to believe that the NSA can hire smart people who work really hard to hack into anything and everything. He doesn't want to believe that government contractors aren't just ripping off the government.

    1. Re:Why so sure of a social/legal component? by Anonymous Coward · · Score: 0

      So what you're saying is you didn't actually listen to what he said? Because that's not at all what he had implied. In fact, it is quite the opposite. He made it very clear that he couldn't be certain if Apple had participated in it or not, just that in his opinion it was hard to believe the NSA could be so successful without some cooperation.

      Perhaps you should actually look to see what people say before bashing them. Especially when they are right.

  17. Read the wording carefully by Anonymous Coward · · Score: 0

    As expected read the wording carefully and think of possibilities that aren't covered.

    "We didn't work with the NSA on the back door", we put it in all by ourselves.

    "We don't know about the NSA targeting our products", why would they need to we give them what they want.

  18. We SWEAR we didn't just comply with an NSA order.. by Anonymous Coward · · Score: 1

    ...We're just entirely incapable of implementing a modest semblance of security to our devices.

    Seriously? Why do we keep hearing companies swearing left and right that they're entirely incompetent?

    If it were me, I'd be covering up incompetences left and right with "the NSA made me do it". At this point, we know how persuasive they can be to companies when they care to be. Seems an easy cop out.

  19. Gag Order by ebonum · · Score: 5, Insightful

    Working with the NSA most likely comes with a caveat: "you follow this gag order or we will put you in jail for interfering with national defense and releasing classified information." In other words, something almost as bad as giving aid to the enemy.

    I hate conspiracy theories, but it is plausible that they are under a secret order from a secret court ordering them to deny everything. This is precisely why in the US we should never every have secret courts.

    1. Re:Gag Order by Anonymous Coward · · Score: 1

      Working with the NSA most likely comes with a caveat: "you follow this gag order or we will put you in jail for interfering with national defense and releasing classified information." In other words, something almost as bad as giving aid to the enemy.

      I hate conspiracy theories, but it is plausible that they are under a secret order from a secret court ordering them to deny everything. This is precisely why in the US we should never every have secret courts.

      This is almost certainly the case, not just for Apple, I imagine that any large technology company in the US has been required to cooperate with the NSA, and not say a word about it.

      Which is a shame, because its about to hurt international business badly. All that boogey man shit we used to shout about not buying Chinese routers cause they might be spying on us just got proved true for the US.

      Government has overstepped here, it did was was good for the government instead of what was good for the nation. Undermining trust in international business on this scale was simply stupid. The Feds don't give a shit about our privacy, that's no secret, but now they are messing around with a lot of money. The money will push back.

    2. Re:Gag Order by Anonymous Coward · · Score: 0

      How is that plausible? There's no legal mechanism to do that.

    3. Re:Gag Order by bill_mcgonigle · · Score: 4, Informative

      How is that plausible? There's no legal mechanism to do that.

      Joseph Nacchio. If you don't cooperate with the NSA, the SEC finds something to put you in prison for.

      That's the whole point of Three Felonies A Day.

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
    4. Re:Gag Order by Anonymous Coward · · Score: 0

      Really? They've been handing out NSLs to do exactly that. Think of it like an NDA, except with serious legal repercussions.

    5. Re:Gag Order by Barlo_Mung_42 · · Score: 1

      Worse things than this in the last few months have come up and I though "No way. That goes too far. Surely we wouldn't bug the personal phones of other leaders of state?!?" Yep. We did. And worse. The head of the NSA lied before the people who are supposed to over see their activities. Where was the "legal mechanism" for any of that? There is none. I agree with you Anonymous Coward, people in high position should be in prison for these crimes because there is no legal mechanism to justify so fucking much of what has been going on.

    6. Re:Gag Order by Nethemas+the+Great · · Score: 1

      There are many means by which to coerce governments, companies and individuals alike. The US federal government has long used funding as a means of gaining compliance from states. Apple recently received security clearance from the Pentagon for their iPhones and iPads. Perhaps there were certain conditions that Apple had to meet for that approval. The CIA has a long history of persuading individuals. What would happen to the Apple brand if it was revealed that Jobs had certain sexual eccentricities? That kind of thing.

      If you want to live a deluded life waving a flag in one hand and the Constitution in other I guess that's your prerogative...

      --
      Two of my imaginary friends reproduced once ... with negative results.
  20. Apple iOS vs. Blackberry by Anonymous Coward · · Score: 4, Interesting

    Don't believe you.

    Rhetorical question: why not?

    If the "amateurs" can compromise iOS security, the professionals shouldn't have much of a problem:

    https://en.wikipedia.org/wiki/Pwn2Own

    Physical access to the iPhone was mentioned, so that's not surprisingly that the NSA can get at the data.

    Blackberrys were also mentioned in the "Spiegel" article, but that was actually about getting at the e-mails via compromising the BES server. So it looks like in the case Blackberry, the crypto (both over-the-air and on-device) is secure. Which isn't too surprising given that RIM/Blackberry owns Certicom and uses ECC crypto (which the NSA has been pushing with Suite B), and given that BB has EAL 4+ certifications (and iOS does not):

    https://www.google.ca/search?q=blackberry+EAL

    However, in Pwn2Own BBs were compromised by visited exploit-filled websites.

    1. Re:Apple iOS vs. Blackberry by Plumpaquatsch · · Score: 1

      Let's not forget why Android wasn't mentioned in that article: the information is from 2008, when no Android phones were available to the public.

      --
      Of course news about a fake are Fake News.
  21. of course their going to deny it... by Anonymous Coward · · Score: 0

    the NDA they are forced into is punishable by jail time due to the way the Patriot Act works.

  22. The Difference by SuperKendall · · Score: 1, Troll

    Apple products: The NSA may be able to access your data.

    Android Products: Everyone else AND the NSA can access your data.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
    1. Re: The Difference by Anonymous Coward · · Score: 0

      The most refreshing thing is how big a deal an Apple vs. Android struggle has become for your likes. Running scared, eh?

    2. Re:The Difference by Anonymous Coward · · Score: 0

      It's New Year's. You're supposed to drink the champagne, not the kool-aid.

      Sheesh, making this kind of defense about the one company well known for putting out a BATTERY that was vulnerable to exploits...

    3. Re:The Difference by Anonymous Coward · · Score: 0

      The whole point of the Snowdon episode is that "once the NSA has the data, everyone else knows where to get it!"

  23. Apple, have you heard of Mandy Rice-Davies? by Anonymous Coward · · Score: 0

    Really, these hi-tech companies should learn a bit of history, lest they come up with public statements that make them look stupid without adding a whit to their credibility.

  24. It's the cellular baseband to worry about by Anonymous Coward · · Score: 0

    Even if Apple isn't working with the NSA, the cellular baseband manufacturers probably are, so regardless what phone you are using, your in the same boat! (Forget iOS, Android, Linux, etc, it's the baseband controller and associated OS that is interesting if you want to snoop!)

  25. Not directly... But... by MobSwatter · · Score: 2

    https://developer.apple.com/library/ios/documentation/Security/Conceptual/cryptoservices/Introduction/Introduction.html#//apple_ref/doc/uid/TP40011172-CH1-SW1
    Cryptographically strong random number generation
    Encryption and decryption (both general-purpose and special-purpose)

    https://developer.apple.com/library/mac/documentation/security/conceptual/cryptoservices/cryptoservices.pdf
    [Page 10]
    "elliptic curve encryption",

    RSA random number generator = keys to palace...

    .

  26. What are the attack vectors by jones_supa · · Score: 1

    What are the particular security vulnerabilities that the DROPOUTJEEP program exploits to install the NSA rootkit? Are those vulnerabilities still hiding in the iOS operating system?

    1. Re:What are the attack vectors by AHuxley · · Score: 4, Informative

      Hi JS,
      Try watching a few of the new 30C3 vids to get an overview of contractor and gov visions for phone tracking.
      30C3 To Protect And Infect - The militarisation of the Internet
      http://www.youtube.com/watch?v=XZYo9TPyNko
      30c3 To Protect And Infect, Part 2 (at ~30 min in for the cell phone question more at 43 min for ~DROPOUTJEEP too)
      http://www.youtube.com/watch?v=b0w36GAyZIA
      30C3 Backdoors, Government Hacking and The Next Crypto Wars
      http://www.youtube.com/watch?v=xLT7ao1V8vY

      --
      Domestic spying is now "Benign Information Gathering"
    2. Re:What are the attack vectors by AHuxley · · Score: 1
      --
      Domestic spying is now "Benign Information Gathering"
    3. Re:What are the attack vectors by jones_supa · · Score: 1

      Those videos do not tell what the exact vulnerabilities (or possibly intentional backdoors) in iPhone are. It would be important to know. How do we know that every iPhone user is not carrying a phone that comes with a convenient "welcome, NSA" feature.

    4. Re:What are the attack vectors by AHuxley · · Score: 1

      Carrying a phone is all a person needs to do - you have a classic location beacon, they have your microphone, they have your camera, "text" as entered (great for passwords), the ability to update the software in use... all the vulnerabilities have been document and know for years. Now you have more names and historical documents.
      In the early 1990's this would have been interesting. Much of the tech is now cheap and in the hands of national and state law enforcement.
      The main problem is the lost, unlatched, version drift or upgrade cycle is allowing a lot of hardware to stay in use with gov entry options that 'others' or ex gov staff can use/find/buy/sell.

      --
      Domestic spying is now "Benign Information Gathering"
  27. And the careful parsing continues... by Jah-Wren+Ryel · · Score: 2

    Apple has never worked with the NSA to create a backdoor in any of our products,

    Note that they specified the NSA, but did not disclaim the possibility of working with some other group, like say a sub-contractor who didn't officially disclose to Apple the fact that they were an NSA sub-contractor. Surely the NSA isn't the only part of the US government that would love to have unfetterred "legal" access to arbitrary iphones.

    With all the deliberatedly worded non-denial denials we've seen in response to NSA revelations, you'd think that Apple's PR firms would know to make an absolute denial if that was their intent. That wouldn't stop some people from thinking Apple is out-right lying. But why even give them an excuse, unless Apple does have something to hide and they want plausible deniability if the truth ever comes out?

    --
    When information is power, privacy is freedom.
    1. Re:And the careful parsing continues... by bill_mcgonigle · · Score: 3, Insightful

      With all the deliberatedly worded non-denial denials we've seen in response to NSA revelations, you'd think that Apple's PR firms would know to make an absolute denial if that was their intent.

      I see these overly-specific denials as a signal that they're under a gag order.

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
  28. Like the wording by Anonymous Coward · · Score: 0

    I don't like Apple's marketing approach, and I don't know if anyone can believe their promises, but I do like how Apple lumps the NSA with malicious hackers attacking Apple's customers.

  29. The damage is done by Anonymous Coward · · Score: 1

    So any denial by anyone is now irrelevant. The rest of the planet now has as much trust in American services / hardware as we have in our own government.

    Hell, I would expect a huge push to remove the US from any position of authority when it comes to anything Internet related. I certainly wouldn't blame them for it.

    The rest of the planet should be fun and ban all American company sposored hardware / software declaring them a National Security risk. We'll quickly find out if Corporate America are truly buddies with the NSA or not when profits drop right through the floor.

    1. Re:The damage is done by MobSwatter · · Score: 1

      They were not given choices, the letter they got is a a gag order/order of compliance. But it gets worse, the concept of corporate lobbied politicians that issue their directives makes this a case of mega corporation insurrection.

  30. From the snow leopard security config guide v10.6 by Anonymous Coward · · Score: 5, Informative

    Page 16/272: Acknowledgments
    Apple would like to thank the National Security Agency, the National Institute of Standards and Technology, and the Defense Information Systems Agency for their assistance in creating and editing the client and server security configuration guides for Mac OS X Snow Leopard.

  31. IT takes one to know one by ladydi89 · · Score: 0

    Regardless of whether Apple's claims are true or not, I think it is awesome that Apple called the government malicious hackers.

    --
    Thou shalt not use tools thou does not understand, lest they rise up and smite thee
  32. Big company and not everyone knows by Anonymous Coward · · Score: 1

    It's not like someone or a group inside Apple sent a company wide email that they were working with the NSA on something for the iPhone. I work at a big law firm and we are tasked with doing things that only a few people in IT are aware of at any given time. Certain types of discovery and data captures, legal holds, monitoring, exporting data, redirecting email, etc.. I imagine any big company does the same and when that company is spread out around the world and involved in manufacturing in different countries, it would be even easier to slip this stuff in.

    1. Re:Big company and not everyone knows by Anonymous Coward · · Score: 0

      It doesn't matter either way. While someone in an unrelated department might not be well informed on these sorts of things, I certainly expect the bosses and CEOs to know about it. And if they don't put a stop to it, they are complacent. Even if they didn't know, somehow, then they still fucked up. Do not make excuses for them. Any other company that was pushing out a defective product would take a big hit from it. They couldn't just say "We didn't know! Honest!"

    2. Re:Big company and not everyone knows by shentino · · Score: 1

      They can if the government covers their asses with retroactive immunity after the fact.

  33. hahahaha by csumpi · · Score: 1

    hahahahaha hah hahaha. oh my god, that is the joke of the year. thanks for the laughs, apple!

  34. This exploit applied to the original iPhone/IOS3 by Anonymous Coward · · Score: 0

    It has been reported that Apple was not complicit in the remote exploit and that the original iPhone software was rushed and incomplete. This exploit applied to the original iPhone running IOS3.x and earlier and had to do with remote debugging/error reporting. The poor phone only had 128MB of RAM and needed lots of debugging.

  35. Obligatory translation... by PsychoSlashDot · · Score: 4, Interesting

    "Apple has never worked with the NSA to create a backdoor in any of our products, including iPhone."

    Translation: "the NSA did all the work and we didn't have to work with them."

    "Additionally, we have been unaware of this alleged NSA program targeting our products."

    Translation: "we weren't aware they were supposedly trying to hack our products because we already allowed them carte blanche access."

    " ... Whenever we hear about attempts to undermine Apple’s industry-leading security, we thoroughly investigate and take appropriate steps to protect our customers."

    Translation: Our customers are best-protected by us having a lot of money and not being in secret courts all day so we comply with government organizations' suggestions.

    "We will continue to use our resources to stay ahead of malicious hackers and defend our customers from security attacks, regardless of who’s behind them."

    Translation: since the NSA are not malicious hackers but our best buddies, we will happily focus our efforts on black-hat bad guys. Nothing to see here.

    You know... if one of these companies would just say "there are no backdoors in our software. We do not allow the NSA or any other organization access to customer data or communications under any circumstance. These are not new policies and go back to the inception of our iOS line of products", then I could take them seriously. Instead their lawyers draft these PR statements that use such mind-deadening language that it's trivial to poke fun at them.

    I don't honestly believe Apply has allowed a back-door, but their statement just sucks.

    --
    "Oh no... he found the .sig setting."
    1. Re:Obligatory translation... by Anonymous Coward · · Score: 0

      I tend to think that Apple may be telling the truth, at least literally. Perhaps they never did work with the NSA to create backdoors in their products. Far more likely the NSA conscripted the FBI to compels Apple to create a backdoor in their products via some secret law or secret court order.

      Far more reassuring would have been a statement to the effect that "We have never deliberately created a backdoor in any of our products"... However that seems somewhat unlikely, more so now...

  36. Re:Happy new year by jones_supa · · Score: 1

    Happy new year!

    2014 is an anagram of 1024, so we must be up for something good.

  37. Roshak Journal: Sniffing Along The Trail, Not Good by Anonymous Coward · · Score: 0

    Apple Inc. i.e. the executives controlling the company are fully aware of the rules and restrictions and compliance with the rules regarding National Security activity when contracted for work by a Federal agency conducting National Security work.

    If Apple Inc. was working in accordance with those rules and having received significant money from the Federal agency for their work and corporation, a response to a direct question regarding the National Security work and corporation by a third party must be given using these precise legal works, "I am not authorized to conform or deny."

    The new question is, "was Apple Inc. authorized to deny?"

    The authorization, if issued, will come from the Federal agency or the President of the United States of America.

    Did Obama authorize Apple Inc. to deny?

    Mr. Cook meet with the President on December 16, 2013, other than what has been reported by the main stream media!

  38. Ok then, WHY was local sync removed from OS X ? by Anonymous Coward · · Score: 2, Insightful

    Prior to OS X 10.9 Mavericks, it was possible to sync an iOS
    device completely, via USB cable which connected the iOS
    device to the main computer.

    Now in Mavericks the iOS local sync is gone. Personally I believe this
    has been done because it will make it trivially easy for the NSA to collect the
    contents of iOS devices from various central points ( the central points
    would be the servers Apple uses for iCloud ).

    So no, I don't believe that Apple will do anything to
    protect the people who buy hardware from Apple. I've been one
    of those buyers but I won't spend any more of my money with
    Apple, because even if they aren't helping out the spooks
    they are selling shit that doesn't work well without even bothering to
    let users know about the loss of important features in their operating
    system before those poor users "upgrade". That is inexcusable behavior
    on the part of a company which pretends to care about how its products work. ///

    1. Re:Ok then, WHY was local sync removed from OS X ? by Anonymous Coward · · Score: 0

      You do realize that you can use CardDAV, CalDAV, ActiveSync, and IMAP protocols against your own server on your own local network, right? USB is not the only way.

    2. Re:Ok then, WHY was local sync removed from OS X ? by Anonymous Coward · · Score: 0

      You do realize that you can use CardDAV, CalDAV, ActiveSync, and IMAP protocols against your own server on your own local network, right? USB is not the only way.

      Yes, I know about the stuff you mentioned. But thanks for mentioning it,
      because others may not know of those options.

      I also know that this company http://mac.eltima.com/sync-mac.html
      claims they will have a USB sync solution "soon".

      It's not that I don't know that alternative solutions exist, but what bothers me
      is that Apple saw fit to remove many useful features from OS X and it
      will cost me some combination of time and money to get some of those
      features back. Apple shouldn't be doing this, there is no upside which
      could possibly compare to the displeasure of the thousands of users who
      are unhappy about the missing features.

      It's not a technical problem. It is a problem with how Apple does things. ...

    3. Re:Ok then, WHY was local sync removed from OS X ? by Anonymous Coward · · Score: 0

      Can you provide some references to what you describe? I've not noticed any difference in the sync behavior since upgrade to Mavericks - details?

      I still sync via USB because it is faster and does a full backup more frequently. Is there something I'm missing?

    4. Re:Ok then, WHY was local sync removed from OS X ? by l0n3s0m3phr34k · · Score: 1

      activesync is crap, unless you get some mdm clients...at least on a corp level. For the past 5-6 months, two of my customers (huge multi-country megacorps) have seen a sharp uptick in AD lockouts. It seems Apples AS protocal implementation doesn't play well with Exchange / AD.

    5. Re:Ok then, WHY was local sync removed from OS X ? by thechink · · Score: 4, Informative

      Complete and utter BS.

      I always local sync and backup my iOS devices via USB with OS X and continue to do so in Mavericks.

    6. Re:Ok then, WHY was local sync removed from OS X ? by Anonymous Coward · · Score: 0

      It isn't... go to iTunes... attach phone...click on iPhone in upper right... then select the radial box middle left that says Backups - THIS COMPUTER. Then select the Backup Now button. Then make up your next conspiracy devoid of facts!

    7. Re:Ok then, WHY was local sync removed from OS X ? by Anonymous Coward · · Score: 0

      This is not what happened. Apple retired isync and sync services in Mac OS X 10.8 because it was unreliable. You can read more about this from Busymac. You can still sync iOS Devices locally using iTunes.

    8. Re:Ok then, WHY was local sync removed from OS X ? by Anonymous Coward · · Score: 0

      Complete and utter BS.

      I always local sync and backup my iOS devices via USB with OS X and continue to do so in Mavericks.

      Other than the fact that your post contains erroneous information and that you are a lying sack of
      shit, everything you wrote was perfect.

      You CANNOT sync Notes in Mavericks using the local sync.

      You CANNOT sync mail in Mavericks using local sync.

      You CANNOT sync Address Book in Mavericks using local sync

      There is plenty of evidence which backs up my claims, and nothing
      except your words to back up your claims.

      ---

    9. Re:Ok then, WHY was local sync removed from OS X ? by Anonymous Coward · · Score: 0

      It isn't... go to iTunes... attach phone...click on iPhone in upper right... then select the radial box middle left that says Backups - THIS COMPUTER. Then select the Backup Now button. Then make up your next conspiracy devoid of facts!

      Backup and Sync are two different things. Sync does not
      equate to a backup, nor does a backup equate to a sync.

      You have no idea what you are talking about. Accusing someone
      of fabrication is comical in light of the fact that you don't even
      understand what you are talking about.

      ---

  39. Breakdown of what was actually said. by Anonymous Coward · · Score: 5, Insightful

    I work in a relationship role for a large firm that most people have heard of. Let me fill all of you in on exactly what was said here.
    First time poster as I am normally not interested however I felt that most of the comments were not addressing the whole verbiage of the defense.

    "Apple has never worked with the NSA" ----- We did not have a contract with or resources sharing agreement with the NSA. We have friends though.
    "to create a backdoor in any of our products, including iPhone" ----- Whatever was created was not called a backdoor or we did not create it. Someone else did.
    "Additionally, we have been unaware of this alleged NSA program targeting our products..." ----- THIS alleged program. We were given a different name or aware of others.
    " ... Whenever we hear about attempts to undermine Apple’s industry-leading security, we thoroughly investigate and take appropriate steps to protect our customers.
    ----- Apple will and probably does investigate breach attempts. But this is not a breach. It was a voluntary. So we aren't doing anything.

    "We will continue to use our resources to stay ahead of malicious hackers and defend our customers from security attacks, regardless of who’s behind them." ------ Malicious hackers, Security Attacks, as stated above this was voluntary. We will continue not using resources to patch the vulnerabilities.

    In summary Apple did not deny. It is simply used double speak/meaning to say, it was not officially worked, we didn't refer to it by this name, we did not personally create the vulnerabilities and we aren't going to fix them. The NSA would be like a vendor to a large company in this instance. The company can sit back and say they did not personally take malicious action. However, they can't get away from the fact that it happened under their watch so they must respond and deny, which as pointed out by others can be proven by subsequent revelation by Snowden or others, or they can type a paragraph which is true and doesn't admit guilt while misguiding others into making their own conclusion.

    Remember, you are the one they have to convince, not themselves. The executives are not going to let someone like government or shareholders just waltz in and destroy what they've spent years building. They will lie or mislead and if caught, after years of arbitration and lawsuits, can settle for a small lump sum that pales in comparison to the money they could have made in the meantime. Look at BP and the trust fund they setup for the Gulf Oil Spill Cleanup. They made a profit on the interest and reinvestment of that money.

    Believe me or not it's entirely up to you. I work in an area who has written quite a few of these and trust me it works to divide and conquer individuals who have different interpretations of literary/writing style. Either way, most people are not paying attention... and that's a fact.

  40. Snowden allegations == questionable. by sethstorm · · Score: 0

    The only valid response to Snowden allegations are to dismiss them and consider them disinformation as long as he is not in US custody. Once he is in a court based on US law (the only one that matters as opposed to the court of public opinion) then all of that can be used as evidence against him.

    (Of course, /. would rather silence any dissent with -Infinity, Disagree from the idolatry of Snowden even if truth.)

    --
    Twitter supports and protects racists - by smearing their critics with the "Hate Speech" label.
    1. Re:Snowden allegations == questionable. by Anonymous Coward · · Score: 0

      Is this a joke? Something tells me that the official documents he took carry a little bit more weight than some jackass working for Apple that has a vested interest in protecting his company's image. Occam's razor could apply very well here.

  41. Uh-yup by ApplePy · · Score: 4, Insightful

    Additionally, we have been unaware of this alleged NSA program

    How could they be aware? I mean, it's only been widespread news for the last year or so!

    Their statement is 100% lawyer-drafted weasel language crafted to tell enough truth that they don't get in trouble, while still lying about whatever it is they're lying about. Next it'll be something like "We're really sorry you think there are security flaws in our product, and we're working hard to change that perception."

    --
    That I'm right, and you don't like it, doesn't mean I'm a troll.
    1. Re:Uh-yup by DMUTPeregrine · · Score: 1

      "have been" is used in the past perfect tense. That's important.
      They have been unaware of the program at one period in time, and have completed that period of being unaware in the past. Since they finished being unaware of the program they have been aware of it, and continue to be aware of it.

      --
      Not a sentence!
    2. Re:Uh-yup by cbiltcliffe · · Score: 1

      Good catch. I missed that one.

      --
      "City hall" in German is "Rathaus" Kinda explains a few things......
  42. Only if China and Russia are exposed similarly. by sethstorm · · Score: 1

    When we start hearing of damning leaks of Chinese and Russian military/intelligence being exposed, then you might have a point.

    It would most certainly vindicate those who saw China walking out with Nortel IP and putting it into a government-run Huawei.

    --
    Twitter supports and protects racists - by smearing their critics with the "Hate Speech" label.
  43. HA HA Apple uses weasel words by Hey_Jude_Jesus · · Score: 1

    OK so what government agency or contractor did Apple help with a back door to the iPhone? The rant about "malicious hackers" is a classic switch to get the consumer to think Apple is denying the program. But the government of the United States is not a malicious hacker.

  44. What scares me the most is... by CmpEng · · Score: 1

    "the ability to remotely push/pull files from the device... All communications with the implant will be covert and encrypted." Say you're a government trouble maker/political rival/whistle blower/unwanted/whatever and next thing you know they find inappropriate content on your phone. How are people not rioting in the streets over this?

    1. Re:What scares me the most is... by MobSwatter · · Score: 1

      How are people not rioting in the streets over this?

      Because, that may be the predicted and intended reaction of the people by the DHS purchase of over 2 billion rounds of .223 ammo and armored personnel carriers. The makings of this mess may be too big for the average person to grasp and isolate the responsible party, there are a lot of factors involved. NSA directives do have self preservation at heart, but they do answer to someone, unfortunately that person(s) was corporate sponsored (owned) long before his/her name hit the ballot, in other words someone put them up to it. Who knows, maybe the economy ends up so bad that some meth addicted truck driver cannot make ends meet and starts taking out the responsible crony corporate thugs that put us all here, call it an act of god.

  45. Everything is insecure by design by WaffleMonster · · Score: 1

    There really is no need to deny because nobody believes you or cares.

    Whether by your own incompetence or collusion your platform is insecure "100% of the time".

    Even when operating as designed and even assuming no secret backdoors both iOS and Android have methods of remote installation of software without giving user a choice or prompt. These platforms and the networks they run on are all defective by design.

  46. US Law specifically allows MS and Apple to lie by Anonymous Coward · · Score: 1

    Not one word that comes out of the mouth of any employee of any US company can be trusted, because US law DEMANDS that such employees LIE about any NSA operation carried out by their company, under penalty of legal punishments INCLUDING the death penalty.

    So the owners of Slashdot think that you are so very very thick, they can push FUD like this, and convince many of you that reports of NSA spying are exaggerated.

    Snowden's leaks, and other sources, PROVE the extent of NSA operations. The presence of back-doors in the software and hardware described proves NSA spying. Now, if you are the kind of cretin the owners of Slashdot hope you are, you will say "no, NSA spying is NOT proven, because there is always the possibility, no matter how slim, that the evidence points to some other explanation". However, in the real world, 'proof' works on the balance of probabilities- because NOTHING in the real world can be proven beyond a doubt- it is a common fallacy to suggest absolute proof lies outside the field of formal mathematical logic- it does not.

    Slashdot encourages its stupider sheeple readers to listen to the vile shills that rely on this fallacy, and repeat it whenever possible. It is a form of "I won't believe it unless I see it with my own eyes".

    The trick is to notice whom the leaders of Dell, Apple, Microsoft, Oracle etc., choose to hang with in their 'important' time. Here's a clue- it ain't you or your 'class'. You (and you family and friends) are less than cattle to them- and the goal is to put you under absolute 'control' They have no hesitation stating, over and over, that there are too many of you.

    Want to get inside their heads- the powerful people who fall over themselves to cooperate with the NSA? Look to Syria. Wave after wave of the most murderous terrorists imaginable are sent into Syria to attack the civilian population of that nation. The over-lords of this project are the leaders of the West, especially those within the UK and USA. And this agenda, and the full surveillance activities of the NSA, are supported completely by the self-same set of people.

    Raping, torturing and bombing civilians in Syria, and installing bugs in your Dell server, are simply facets of the same war against general Humanity by those who claim to be members of the 'elite'. To the same people who authorise back-doors in Apple and Microsoft products, such acts of atrocity are but a reasonable means to an end.

    But it gets far worse. Google is now fully involved in implementing future generations of autonomous ground based 'tanks'- holocaust machines that can be mass produced, like drones, and sent in place (initially) of US ground troops into the villages, towns and cities of nations like Iran. Google has purchased EVERY available, worthwhile 'robot' company, and by 'robot company' I mean companies actively involved in producing 'battlefield' killing machines. While the vile shills will make jokes about 'Terminator', thinking you THAT stupid, Google simply wants large deadly tracked vehicles that can slaughter EVERY Human within their vicinity as the computers identify every Human visible from the road position, and guide automatic machine guns to mass murder these Humans far faster than the Humans can respond.

    The owners of Google have stated to their genocidal allies in Israel that they will not stop until Israel is able to command its American servants "destroy this nation", and American leaders are able to persuade the sheeple of America to allow the extermination of this nation using machines largely designed by Google. Google claims, to those in charge of the US military, that they can move so much faster than the Chinese or Russians in this area, that this time the US will WIN this arms race, and will be able to use the victory to finally dominate the planet. Google uses air drones as an example, falsely claiming the US and Israel had a drone advantage of 15 years plus over other nations (actually, Israeli drones were designed specifically to MURDER civilian targets, a form

    1. Re:US Law specifically allows MS and Apple to lie by MobSwatter · · Score: 1

      So get off ur ass and ask ur mom 'Sara Conners' for money to build an EMP emission device.

    2. Re:US Law specifically allows MS and Apple to lie by gnasher719 · · Score: 1

      Not one word that comes out of the mouth of any employee of any US company can be trusted, because US law DEMANDS that such employees LIE about any NSA operation carried out by their company, under penalty of legal punishments INCLUDING the death penalty.

      No, it doesn't. It can require people to be silent, it can't require them to lie.

  47. Re:Happy new year by Anonymous Coward · · Score: 0

    no it isn't, the anagram would be 4102

  48. Occam's Razor would look unfavorably on Snowden. by Anonymous Coward · · Score: 0

    The simplest explanation would be that he is indeed harming the country with such allegations. But then you'll try to argue that it doesn't apply when truth hurts Snowden's case.

    Until he is in US custody and presents his case in a US-jurisdiction court, all he has are allegations. Of course, that means that you'd be seeing the inevitable conviction of an individual that continously incriminates himself (and others such as the "journalists" and "lawyers"). The sooner he turns himself in, the less he has facing against him.

    -sethstorm

  49. NSA by Anonymous Coward · · Score: 1

    My friend worked for the NSA for a few years in exchange for them paying for his grad school. He said he was working on iphones and that's all he could say. He left as soon as his time was up and went to seminary. I joke that he had to repent after seeing what they were doing.

  50. Capture Cook by Anonymous Coward · · Score: 0

    Once in custody cut off a few toes and fingers, then his penis.

    Now lets see what the pig's got to say for himself.

  51. Meh by swillden · · Score: 2, Insightful

    Per the video, the NSA iPhone compromise requires the NSA to obtain physical access to the device, and suggests they did this by rerouting shipping.

    To me, that says that what they've done is exploited holes in iOS -- of which there have been many, that's how jailbreaks are possible -- and used them to install their own spyware. There's not only no need for them to involve Apple to do such a thing, involving Apple would actually be a bad idea, because it increases the number of people who know about it and might leak it.

    I believe Apple had nothing to do with it. I believe the NSA has spyware for every version of iOS ever made, as well as Windows, OS X, Android, Linux (well fragmentation of the last two means there might be some versions which are safe -- but not the major ones), AIX, etc. If they don't, they're not doing their jobs. I don't think anyone should be the slightest bit surprised by any of this.

    --
    Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    1. Re:Meh by cbiltcliffe · · Score: 1

      So, don't buy a phone online and have it shipped to you. Buy retail only.

      --
      "City hall" in German is "Rathaus" Kinda explains a few things......
    2. Re:Meh by swillden · · Score: 1

      So, don't buy a phone online and have it shipped to you. Buy retail only.

      The opposite would probably be better. It would make more sense for the NSA to reroute shipments to retail stores, that way they can hack a whole bunch of phones at once.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    3. Re:Meh by AHuxley · · Score: 1

      The physical access to the device has now been cleared up.
      "The way that the NSA and GCHQ compromise devices with QUANTUMNATION does not require physical access - that is merely one way to compromise an iPhone." http://cryptome.org/2014/01/appelbaum-der-spiegel.htm

      --
      Domestic spying is now "Benign Information Gathering"
    4. Re:Meh by swillden · · Score: 1

      Which just means that the NSA has also found some remote exploits. Those are bigger news from a security aspect, but again not really shocking, and still don't require collaboration by Apple.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
  52. Prove it! by Anonymous Coward · · Score: 0

    Oh you can't?

  53. Re:From the snow leopard security config guide v10 by Anonymous Coward · · Score: 0

    Oddly enough, the NSA did a lot of work on SELinux and mandatory access controls, then released it. Wouldn't surprise me if they're referring to either that or basic server/firewall/access-control setup.

  54. An official backdoor would be so much easier by mbkennel · · Score: 2

    How would an official backdoor work?

    a) Windows Update
    b) App Store Update

    Complete triviality. Any targeted device gets updates routed somewhere else.

    All of Snowden's evidence of those complex cracks make it much less probable that there was any general manufacturer supported backdoor. I think Apple's being truthful.

    Besides, what did you expect the NSA did? Do you think the Russians and Chinese have worse cracks? Certainly not.

  55. Re:Occam's Razor would look unfavorably on Snowden by l0n3s0m3phr34k · · Score: 4

    "harming the country"...along the same lines of harming a child molester by turning them in...he's only harming the security apparatus...said security apparatus already caused massive harm, they just kept it covered up until now.

  56. Re:Happy new year by Anonymous Coward · · Score: 0

    Anonymous Coward fail.

  57. You can't know... by Hairy1 · · Score: 1

    The problem with these denials is that they would say the same thing regardless of whether or not they have collaborated. There is no way to verify the truth. What we do know is that the Government is capable and willing to force these companies to lie or face criminal prosecution. They are intimidating people into immoral treasonous behaviour or face prison. It isn't Apples fault that they are put in this situation; they are in the same boat as all the other US companies.

    Of course, the US is far from the only country with intel programs. They are however in the best position to do so, and have budgets that are more than the GDP of small countries (perhaps not so small). Considering the staggering cost of the NSA and its woeful record in terms of actionable intel it may have possibly, maybe, been a better idea to spend it on say space exploration that would get us off this rock.

    It is hard to believe the reputation of the US could get lower than under Bush... but it seems I underestimated the ability of the US Administration to stuff up. Good ole United States, has the best politicians money can buy. So you want 'Change'? Who you gonna vote for now?

    1. Re:You can't know... by swb · · Score: 1

      I would bet that there's more than just official pressure using the tools of national security law. Given the secrecy involved, it wouldn't surprise me if individuals weren't being pressured the old-fashioned way via personal blackmail.

      Even with the "you must do this, stay quiet or go to jail" laws, you run the risk of exposure should someone decide to take a principled stand and go to the press like Snowden.

      Far more secretive would be to squeeze key individuals personally -- expose their drug use, their adultery, their homosexuality, tax evasion, any of their personal weaknesses. Even if it means inventing them by entrapping them in set-up situations involving sex, drugs, statutory rape, planted drugs, and then use that against them.

      All of this could be done false-flag, too, to make them think the ones catching them are the bad guys and that the NSA guys who intervene on their behalf are trying to help them.

      "You may be surprised, but we know you hold a key job at Apple and part of the NSA's mission in protecting national security is to make sure you are not targeted by foreign agents, so we keep tabs on people in your position. These [fake] local cops want to bust you for fucking that teenage girl/boy, but we can make that go away and tell them that this involves a national security investigation. But we need a little help..."

      And how many are truly immune to outright bribery?

  58. Technically telling the truth? by runeghost · · Score: 1

    If they're co-operating with the FBI to create a backdoor, then they wouldn't be precisely lying now, would they?

  59. Re:From the snow leopard security config guide v10 by Anonymous Coward · · Score: 0

    It's true:

    https://ssl.apple.com/support/security/guides/docs/SnowLeopard_Security_Config_v10.6.pdf#page16

  60. Irrational reaction by Anonymous Coward · · Score: 1

    At the time the document was published, 2008, any iPhone could be booted off a RAM disk, and spyware installed, 100% of the time.

    There are several companies that sell spyware that runs on iOS, and they have since about 2008. Existing UNIX spyware kits could probably be pretty easily adapted to iOS as well. Given the $0 cost quoted in the document, it is likely they were customising an existing toolkit for the platform, rather than just buying COTS.
    (mspy and Mobile Spy are two, but there's others as well, including some Beltway bandits)

    No active participation or co-operation by Apple required at all - this applies to everything from the original iPhone up to and including the iPhone 4.

    WTF is that a revelation to anyone ?

    Reality is a little different, in that since 2010 or so, Apple closed the firmware bug in the A4 that enabled the "guaranteed to boot to a root kit DFU RAMdisk bug", and got a whole lot better along the way with its cryptography and implementation of a hardware root of trust.

    Since the A5 processor came out, there has not been any :

    - RAMdisk boot exploits (aka LimeRa1n exploit)
    - "hostile" jailbreaks -ie that do not involve prior knowledge of the device passcode (Absinthe, RedSn0w, Evasi0n and Evasi0n7 all require the device to be manually unlocked as part of the process if its an A5 based device running iOS 6 or later)
    - bypass for supervised mode that blocks USB port access

    The above mentioned spyware gets wiped out by a DFU mode restore (aka the "connect to iTunes" screen). (yes, I've tested this)

    The only way that this could be currently be viable, is if Apple has handed over the secret key for the hardware root of trust to the NSA. Thats a big call. Not impossible, but its not something the document claims, and it is something Apple denies.

    In addition, and this may be hard for people to grasp as it doesn't fit their preconceptions, but claims made in documents such as leaked by Snowdon are not necessarily always TRUE (in the general sense, or outside a very specific set of preconditions). Its quite common for internal briefing documents to over-simply facts or make aspirational claims in order to make that part of the organisation look good to the non-technical higher-ups in the bureaucracy. I'm not saying that the NSA hasn't engaged in a massive effort, just that you can't cherry pick paragraphs from individual documents and extrapolate from them reliably 6 years into the future.

       

  61. I would be inclined to believe them by cowwoc2001 · · Score: 1

    ... if it wasn't for the fact that the iPhone 5s contains a fingerprint sensor. Who is to say other phones don't? What is to prevent anyone from collecting our fingerprints and matching them to webcam photos? If you want to get very paranoid, putting this kind of technology into a single device doesn't radiate "harmless".

  62. Who remembers NSA_KEY in WindowsNT sp6? by Anonymous Coward · · Score: 0

    This is nothing new. They aren't going to admit it. and yes, they allowed it.

  63. That flamebait mod must be reflexive by now by sethstorm · · Score: 1

    Given that it's happened at least 10-20 times straight, someone really, really, really can't take dissent. It'll only show that you're much like the people you think the NSA is.

    Snowden's actions being of questionable ethics won't be changed by modding me down into Bad.

    --
    Twitter supports and protects racists - by smearing their critics with the "Hate Speech" label.
    1. Re:That flamebait mod must be reflexive by now by cbiltcliffe · · Score: 2

      I doubt it's the dissent that people don't like. It's your NSA-ass-licking sig that they don't like.

      Justice? For capturing Snowden? WTF?

      How about justice for capturing all the NSA agents and leaders who are regularly commiting perjury, violating every right that is supposed to be sacred in the USA, and covering it all up with lies multiplied by lies?
      How about justice for removing from the bench all the judges who say "What the NSA is doing has to be legal, because the government finds it useful!"
      In other parts of the world, leaders have been assassinated for less.

      --
      "City hall" in German is "Rathaus" Kinda explains a few things......
  64. Re:From the snow leopard security config guide v10 by jovius · · Score: 1

    That guide actually makes the device NSA safe. It's pretty comprehensive and when applied in full should please even most paranoid and security conscious users.

  65. BS by Anonymous Coward · · Score: 0

    Politely, thats crap, ever heard of updates? They, apple/Google/MS all do "updates" that "change"your phone/computer settings without your permission. That activate "features" in your system until you find out about later after some security expert notifies the public about what they did. Even then you have no idea what else has happened, since the companies/the phone/computer/parts/whatever/ even don't know what has been shipped, or refuse to elaborate on what they did, or they have been ordered by the FISA courts to keep quiet about what was added.....

    1. Re:BS by Rosyna · · Score: 2

      Politely, thats crap, ever heard of updates? They, apple/Google/MS all do "updates" that "change"your phone/computer settings without your permission. That activate "features" in your system until you find out about later after some security expert notifies the public about what they did. Even then you have no idea what else has happened, since the companies/the phone/computer/parts/whatever/ even don't know what has been shipped, or refuse to elaborate on what they did, or they have been ordered by the FISA courts to keep quiet about what was added.....

      You make a good point. Where are the Android release notes for each release? Where are the security advisories published when they've fixed a vulnerability?

    2. Re:BS by the_B0fh · · Score: 1

      Removing malware is a good thing. Removing things you disagree with, previously bought, is not a good thing.

      The OP's Asian Boobs falls into the second category. It appears that Apple does not remove it from your account/device if it falls into the second category.

      Is that a good thing, or a bad thing?

    3. Re: BS by Anonymous Coward · · Score: 1

      Like to add that apples platform updates are very optional. So are individual app updates.

      I know there are bad points to both companies, but I really don't get this "nerd halo" that Google enjoys. Trust no one.

  66. Just a few core people by Anonymous Coward · · Score: 0

    And stay shut up or go to jail.

  67. That, my friends, is called a "Lie" by Anonymous Coward · · Score: 0

    Of course they have helped. They have no other choice.

  68. Not exactly complete info by Anubis350 · · Score: 2

    They removed the sync for contacts and calendar, the rest is still locally synced. You can sync those 2 to any cloud provider, including rolling your own caldav server, not just Apple's, it just defaults to Apple's. It was an annoying move, but ascribing a motive beyond "we really would like people to use iCloud more because it ties them to continuing to use Apple products" isn't really supported by the facts (especially since the framework, SyncServices, had been declared deprecated since 10.7, so it wasn't exactly unexpected)

    --
    "goodbye and hello, as always" ~Prince Corwin, from Zelazny's Amber series
    1. Re:Not exactly complete info by Anonymous Coward · · Score: 0

      They removed the sync for contacts and calendar, the rest is still locally synced. You can sync those 2 to any cloud provider, including rolling your own caldav server, not just Apple's, it just defaults to Apple's. It was an annoying move, but ascribing a motive beyond "we really would like people to use iCloud more because it ties them to continuing to use Apple products" isn't really supported by the facts (especially since the framework, SyncServices, had been declared deprecated since 10.7, so it wasn't exactly unexpected)

      My point was that local sync should have remained an option, and I am
      very displeased with Apple for removing it. Your remark that SyncServices
      has been deprecated since 10.7 is, while true, not any sort of justification
      for Apple removing such capabilities.

      Believe it or not, some of us travel to places in the world where there is no internet
      service, and thus no cloud is available. Local sync is something some users need
      badly, and making excuses for why it is somehow ok that Apple removed this capability
      is of no use to this discussion. So unless you can offer a solution rather than an excuse,
      why don't you just shut the fuck up.

      ---

    2. Re:Not exactly complete info by Anubis350 · · Score: 1

      I don't usually reply to ACs, but on the off-chance you read this I'l point that a) I said it wasn't complete info, and that Apple was unlikely doing it to help NSA spying, not that it wasn't an annoying inconvenience that I think Apple was doing for profit and b) for geeks traveling to such places there are 2 (well, 3) solutions, 1 of which I even mentioned in the comment you just replied to saying I didn't.

      Option 1)You can run your own server (as I mentioned above). That doesn't have to on the internet, it could be local on your laptop.

      Option 2 has a few possibilities, basically in all cases allowing access to SyncServices. You can
      a)Not upgrade to 10.9
      b)if you need 10.9 for work or are on a new machine run an older version of the OS in a VM or
      c)run windows in a vm or
      d)run the windows version of iTunes and whatever app you want to sync contacts with in WINE (this particular option may not always work depending on the apps and how well the current version of iTunes plays with WINE of course)

      Option 3)You can get a phone not made by Apple

      --
      "goodbye and hello, as always" ~Prince Corwin, from Zelazny's Amber series
  69. never worked with by Anonymous Coward · · Score: 0

    The only part of this I believe is the part where Apple says they never worked with anyone on anything. Apple is like a NIH walled garden.

  70. Apple Bashing NSA Militerization of the Internet by hackus · · Score: 1

    A company has to be chosen to be made an example of.

    I think Apple would be an ideal choice:

    1) Closed systems seem to be at the heart of the issue here. Companies that do not use open source or open systems have a much higher degree of compromise than say your typical open source project.

    2) Trying to identify whether or not Apple is telling the truth with the amount of money they are likely to have received from the NSA/CIA for cracking their phones with 100% reliability, as disclosed here is a good example I think of who to believe. (Hint, not the company with the Apple LOGO.)

    3) Furthermore, if we do not make an example of these companies, they will destroy the economy of technology by subverting products they sell on the open market allowing your competitor, or the NSA if they don't like your company to steal your IP capital.

    If we do not take a stand here, and make an example of Apple or HP, etc by depriving them of their profits, and destroying their products viability we will lose the entire world market.

    In fact, if things are allowed to continue, you won't be able to get a job doing anything with computers because they will be deemed too risky to use for just about anything that makes money, requires capital investment etc.

    So if we take down say Apple and bankrupt it like we did with SCO (A very coordinated effort industry wide to replace SCO products with LINUX essentially killed the company.), it will get widespread attention and companies will stop cooperating with the NSA/CIA and more than likely improve their products so that they can't be modified in shipment, software is more open and secure. A win win!

    I would suggest the first place we start with a company, such as Apple is getting rid of their products in your home by using your influence in computing if you are a professional and work in the field of computing to not use their products.

    Apple, unlike HP is easier to attack with your friends as HP doesn't make iPhones and general consumer products that are 100% guaranteed to be crackable by your local NSA/CIA goon squad.

    Most of my friends who use Apple products do so because of fairly personal reasons, not really good ones. If you can point those out, you can get them to try something else, like Cyannogenmod!

    I did this by allowing my cousin for example to borrow my Android Cyanogen mod phone for a few days, and got him to dump his iPhone.

    We could call the initiative the $1 Apple Stock Drive. (i.e. because we won't stop attacking the company until its stock is worth $1).

    -Hack

    --
    Got Geometrodynamics? Awe, too hard to figure out? Too bad.
  71. Sneakernet by CyclistOne · · Score: 1

    Sneakernet is old and slow, but it will never die.

  72. Apple won the last two hands down by Anonymous Coward · · Score: 1
    1. Re:Apple won the last two hands down by smash · · Score: 1

      Don't let truth get in the way of a good anti-apple rant!

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
  73. Would you still support this if we chose Google? by Imazalil · · Score: 1

    Google's core apps/services on Android are just as closed as Apple's, and they are on a trajectory to close off more and more things. Google is also known to delete data from user's phones without consent, unlike Apple so far.

    Oh wait, you're just on an anti-Apple troll roll... silly me... carry on.