Slashdot Mirror
Researchers Use Siri To Steal Data From iPhones
wiredmikey writes "Using Apple's voice-activated Siri function, security researchers have managed to steal sensitive information from iOS smartphones in a stealthy manner. Luca Caviglione of the National Research Council of Italy and Wojciech Mazurczy of the Warsaw University of Technology warn that malicious actors could use Siri for stealthy data exfiltration by using a method that's based on steganography, the practice of hiding information. Dubbed "iStegSiri" by the researchers, the attack can be effective because it doesn't require the installation of additional software components and it doesn't need the device's alteration. On the other hand, it only works on jailbroken devices and attackers somehow need to be able to intercept the modified Siri traffic. The attack method involves controlling the "shape" of this traffic to embed sensitive data from the device. This covert channel could be used to send credit card numbers, Apple IDs, passwords, and other sensitive information from the phone to the criminal mastermind, researchers said in their paper.
Nothing to see here, move along.
So in order for this to work, an iOS device must already be compromised with a jailbreak? Why is that news?
it doesn't require the installation of additional software components and it doesn't need the device's alteration.
On the other hand, it only works on jailbroken devices
Too bad jailbraking actually requires the device's alteration / installation of additional software components...
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
It's interesting but hardly a concern given the requirements to make it work.
Jailbroken phone susceptible to data ex-filtration while on special malicious network?? Apple is dying.
... That discovered that the Scalage security deadbolts have been compromised, and can be unlocked without the use of a key! Assuming of course you are inside the house.
- Holy crap, I've got MOD points! Who thought that was a good idea.
Well, the difference is actually important. In one case, the data is being published and intended to be published, it's just a matter of optimizing compensation models. That is, the reason people object to copyright infringement is the potential loss of a sale. . In the other, the person's privacy is being breached, so something is in fact getting lost.
Or, to use an analog, it's the difference between sharing photos that were in Playboy, and sharing photo's copied off an unsuspecting person's device.
Your ad here. Ask me how!
"stolen" is taken in a manner that causes a permanent loss, denying the owner the benefit of it. Stealing a movie isn't stealing because they can still sell it another million times. But stealing an identity does deny the previous owner the use of it. That identity no longer "works" so the previous owner must spend real money to create it again. That's a provable loss. Not the same as if I copy a movie in my house, and give a copy to my family, the movie makers would never know, so know "loss" can be recorded.
Learn to love Alaska
So whether it's stealing depends on if the victim notices? Pickpockets of the world rejoice.
Actually, yes. That's why Grand Theft Auto is separately defined. As stealing a car with the intention of running it out of gas on a joyride is not "theft" by the legal definition of the word. If it's not a permanent "loss", then it isn't theft. A non-loss can't be a theft. And a taking intended to be temporary is also not theft.
I know it confuses you that the legal definition doesn't match your desired emotional use of the word. But reality doesn't bend to your will.
Learn to love Alaska
How can we stop this egregious security issue!
Every single aspect of computing is unsecure if you add enough caveats.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Perhaps to something more descriptive. I suggest: "Here's another way that you can't hack a properly maintained iPhone, but thanks for the clicks".
stealing a car with the intention of running it out of gas on a joyride is not "theft" by the legal definition of the word
I don't know what kind of bizarro legal system you live under, but it's not one I've ever heard of. Whether something is considered theft/larceny/stealing doesn't hinge on whether the property is eventually recovered. But this is veering offtopic, and I've already been modded down for that once in this thread, so good night.
But this is veering offtopic, and I've already been modded down for that once in this thread, so good night.
Your attack on "theft" that was factually and legally wrong was rightly modded down, but an on-topic discussion 6 deep (on topic because the discussion is about the definition of a word in the title of the submission) won't get you modded down. Sounds more like you are willfully ignorant of the definition of "theft" so you can bash others you don't like. That is what got you modded down, and will when you do it again. Good day.
Learn to love Alaska
In their experiments, Mazurczy and Caviglione managed to use this method to exfiltrate data at a rate of 0.5 bytes per second. At this speed, it would take roughly 2 minutes to send a 16-digit payment card number to the attacker.
2 minutes? One byte every 2 seconds for 16 characters should be 32 seconds. Plus, since they can control the encoding, they could send card numbers using only a nibble, so they could send all 16 numbers in 16 seconds.
Either the original (non-posted) research showed ALL card information could be sent in 2 minutes, or they realized Siri communications are so short they would need multiple requests to get a full 30 seconds of sent audio. Sadly, the original information is not posted so the math discrepancy remains puzzling.
~~
you might want to check up on that.
"unauthorized use" or similars are used in pretty much all of the west for.. well, unauthorized use, like joyriding. if the joyriding ends up destroying it then it's destroying of property..
you know how destroying property isn't theft as such.
why the distinctions? because usually it's more "bad" if the crime is done with profit in mind (like reselling the car)
world was created 5 seconds before this post as it is.
Any chance the research was sponsored by Apple to make people more afraid of jail breaking ?
This same old canard from the anti-IP and freeloaders association. If you can legally watch that movie without paying, why should anyone else be required to pay? And if no one pays, how will the movie producer generate revenue to even cover the cost of making the movie, let alone profit? If someone loses profit because of unethical and illegal actions of another, it's a crime. So copying that movie is a crime.
Here's webster's definition for stealing as applied to non-tangible goods such as IP:
I don't know what kind of bizarro legal system you live under, but it's not one I've ever heard of. Whether something is considered theft/larceny/stealing doesn't hinge on whether the property is eventually recovered. But this is veering offtopic, and I've already been modded down for that once in this thread, so good night.
In Germany, when the very first "theft" of electricity happened (connecting to the neighbour's power cable and having him pay for the electricity bill), it turned out that this was according to the existing laws no theft, and a new law was added. Fraud laws had to be changed because of computer fraud; before that fraud had the legal requirement that a _person_ had to be given false information and with careful construction a computer could be defrauded without giving false information to any person.
> On the other hand, it only works on jailbroken devices and attackers somehow need to be able to intercept the
> modified Siri traffic.
So basically, its useful if you can run a stingray and most effective against more sophisticated users who jailbreak their phones (yet still use siri). Nice, real nice.
"I opened my eyes, and everything went dark again"
This reminds me of the JitterBug that got a lot of press back in 2006. It required such a ridiculous set of preconditions, it managed to be one of my dozen or so entries on my "dumb studies" blog. (Which is proof that I'm just as dumb - a blog about dumb studies?)
I suppose this might be interesting to some people, but when it says, "it only works on jailbroken devices and attackers somehow need to be able to intercept the modified Siri traffic", well, that's a lot of "ifs" in there. It's sort of like walking up to someone and saying, "Can you make elephant soup?" And they reply, "Sure I can. First, I need an elephant. Then I need to chop the elephant into small pieces..." I mean, I guess, technically, someone can make elephant soup, but not that easily.
Proverbs 21:19
If someone loses profit because of unethical and illegal actions of another, it's a crime.
Holy circular reasoning. It's a crime because it's illegal. Oh, and copyright violation isn't usually a "crime" but a "tort", well, for most copyright infringement.
So yelling "fire" in a theater isn't criminal negligence (trying to cause harm to others through lie/fraud), but theft, if any of those patrons leave because of the "fire" and request their money back. The person yelling "fire" stole from the theater and movie makers by his actions causing a loss of profit from the movie theater. Would it matter if the person requesting a refund bought popcorn?
Here's webster's definition for stealing as applied to non-tangible goods such as IP:
When you are using words like "illegal" and "crime" you should stick to the legal definitions. Shopping dictionaries to find the one definition you like doesn't work in court. I'm using the legal definition, and no, taking a websters dictionary into court won't sway the judge.
Texas Penal Code Title 7, Section 31
THEFT. (a) A person commits an offense if he unlawfully appropriates property with intent to deprive the owner of property.
"Appropriate" means: (A) to bring about a transfer or purported transfer of title to or other nonpossessory interest in property, whether to the actor or another; or (B) to acquire or otherwise exercise control over property other than real property.
"Deprive" means: (A) to withhold property from the owner permanently or for so extended a period of time that a major portion of the value or enjoyment of the property is lost to the owner;
If you are in Texas, that is the *only* valid definition of theft. It's literally defined bylaw. And before you ask, it's nearly identical everywhere. I've looked.
Learn to love Alaska