Slashdot Mirror

← Back to Stories (view on slashdot.org)

Apple Worries Spy Technology Has Been Secretly Added To Computer Servers It Buys (businessinsider.com)

Posted by BeauHD on from the check-it-once-check-it-twice dept.

An anonymous reader writes: According to Business Insider, "[Apple] worries that some of the equipment and cloud services it buys has been compromised by vendors who have agreed to put "back door" technology for government spying, according to a report from The Information's Amir Efrati and Steve Nellis." With many of its cloud-based services like iTunes, the App Store, and iCloud requiring enormous data center to operate, Apple hasn't been able to build all the data centers it needs, and has instead been using services from its rivals, namely Amazon Web Services and Microsoft. Google recently landed Apple as a customer for the Google Cloud Platform. "Meanwhile, [Apple] has embarked on yet another attempt to build more of its own data centers to handle all of that, called Project McQueen, reports Jordan Novet at VentureBeat, and the project is having a rough go of it, reports The Information." Apple suspects that backdoors have been added to many of the servers it has been ordering from others. "At one point, the company even had people taking photographs of the motherboards in the computer servers it was using, then mark down exactly what each chip was, to make sure everything was fully understood."

13 of 251 comments (clear)

  1. Here's a solution... by R3d+M3rcury · · Score: 4, Insightful

    I know it's a crazy idea, but maybe if Apple built their own servers, they wouldn't have to worry about that. Maybe they could even sell a few of them to other companies.

    Nah. Crazy idea. Forget I mentioned it.

    1. Re:Here's a solution... by sg_oneill · · Score: 3, Insightful

      Those things where great little units. Expensive, but really well built. We had a couple of them back in the day and they had to be some of the most elegantly designed rack fodder I've come across.

      --
      Excuse the Unicode crap in my posts. That's an apostrophe, and slashdot is busted.
    2. Re:Here's a solution... by currently_awake · · Score: 2, Insightful

      If you care about security, don't have your headquarters or manufacturing in the USA. Don't buy American anything, and build everything yourself, using your own designs.

    3. Re:Here's a solution... by MightyMartian · · Score: 3, Insightful

      So you can buy Chinese components and be hacked by the PRC.

      Unless you're fabricating everything, and writing you're own microcode, there's always a chance someone is going to slip a backdoor in somewhere.

      --
      The world's burning. Moped Jesus spotted on I50. Details at 11.
  2. What a shame by ShaunC · · Score: 1, Insightful

    It's quite sad that in the United States of America, of all places, this is now a legitimate and very real concern. What in the hell happened to this country?

    --
    Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
    1. Re:What a shame by Gussington · · Score: 5, Insightful

      It's quite sad that in the United States of America, of all places, this is now a legitimate and very real concern. What in the hell happened to this country?

      At what point in your version of history has industrial espionage never been a concern?

  3. The times, they are a-changin' by 93+Escort+Wagon · · Score: 5, Insightful

    You guys remember when we'd read about some random individual doing paranoid crap like this, and our first response would be to make fun of the wacko?

    Those were the good old days...

    --
    #DeleteChrome
  4. Wow ... by gstoddart · · Score: 5, Insightful

    "At one point, the company even had people taking photographs of the motherboards in the computer servers it was using, then mark down exactly what each chip was, to make sure everything was fully understood."

    You know, 15 years ago, give or take, this would have been considered the most absurd tin-foil hat bullshit imaginable.

    Suddenly, we find ourselves in a world where this makes total sense ... which scares the shit out of me.

    It's like the nasty dystopian future, but without cool skater chicks and designer digital drugs.

    --
    Lost at C:>. Found at C.
    1. Re:Wow ... by Anonymous Coward · · Score: 1, Insightful

      It's like the nasty dystopian future, but without cool skater chicks

      Yeah, instead of the cool skater chicks, we have prudish SJW's trying to subordinate us. In a way, it's even more dystopian than the dystopian sci-fi authors could have imagined.

    2. Re:Wow ... by Solandri · · Score: 5, Insightful

      It was absurd paranoia back then because 30 years ago we were in a Cold War against an opponent notorious for limiting its citizens' freedoms and spying on everything they were doing. Our leaders had to constantly portray themselves as the polar opposite of that, or risk being voted out of office. Even after the Cold War ended, that mentality lingered.

      Then 15 years ago, 9/11 happened. And suddenly it became "important" for the government to know everything you were doing and saying in private, because Terrorism! It's pretty sad when you start to think the Cold War days were better.

    3. Re:Wow ... by cfalcon · · Score: 3, Insightful

      > Suddenly, we find ourselves in a world where this makes total sense ... which scares the shit out of me.

      You've always been in a world where this makes total sense. You just didn't want to believe it until now. That's fair- none of us really did- but it's better to have our eyes open so we can fix the problem than just pretending it's not real.

  5. that's what happens by hguorbray · · Score: 2, Insightful

    when you outsource everything

    -I'm just sayin'

  6. can't do anything much with encrypted data by raymorris · · Score: 5, Insightful

    While encryption in transit is good, unfortunately encryption on the server is typically more theatre/ marketing than it is useful security. There are only two things you can do with properly encrypted data - decrypt it or send it to someone who can decrypt it. If the server can decrypt it, and the concern is that the server may be compromised, there's little point in encrypting it.

    As a random example, let's consider the data of which users have purchased which songs on itunes. Apple uses that to know which songs you're allowed to stream. If it's encrypted, their server-side software can't do the lookup , so that can't be encrypted (or the server has to have the key, which amounts to the same thing).

    Essentially the only data that can be usefully encrypted is files sent from a customer's device which Apple doesn't want to read or understand, they just want to send back the exact same binary blob that they received. That CAN be encrypted before it's sent to Apple. But any data that Apple needs to query, change, record, or de-duplicate can't really be usefully encrypted, in general.

    It's an annoying problem, and a hard problem. There was a theory about encrypting data in such a way that you could do some very limited statistical processing on it without being able to actually read the data, but it's pretty limited so approximately nobody uses it. The one major use for data "encrypted" on the server is passwords, where you store a hash and can compare whether the password the person entered is the same as the stored hash. Though that's an important use case, it's only one use case. There aren't too many use cases for storing data you can't retrieve.