Slashdot Mirror
Apple Worries Spy Technology Has Been Secretly Added To Computer Servers It Buys (businessinsider.com)
An anonymous reader writes: According to Business Insider, "[Apple] worries that some of the equipment and cloud services it buys has been compromised by vendors who have agreed to put "back door" technology for government spying, according to a report from The Information's Amir Efrati and Steve Nellis." With many of its cloud-based services like iTunes, the App Store, and iCloud requiring enormous data center to operate, Apple hasn't been able to build all the data centers it needs, and has instead been using services from its rivals, namely Amazon Web Services and Microsoft. Google recently landed Apple as a customer for the Google Cloud Platform. "Meanwhile, [Apple] has embarked on yet another attempt to build more of its own data centers to handle all of that, called Project McQueen, reports Jordan Novet at VentureBeat, and the project is having a rough go of it, reports The Information." Apple suspects that backdoors have been added to many of the servers it has been ordering from others. "At one point, the company even had people taking photographs of the motherboards in the computer servers it was using, then mark down exactly what each chip was, to make sure everything was fully understood."
I know it's a crazy idea, but maybe if Apple built their own servers, they wouldn't have to worry about that. Maybe they could even sell a few of them to other companies.
Nah. Crazy idea. Forget I mentioned it.
Assume your cloud service provider isn't secure.
Fuck backdoors, you can't vet their security or admin staff, you can't adequately audit their processes, you can't believe the marketing bullshit they produce.
So assume they're not secure.
How you deal with it isn't paranoia. Don't be bloody stupid.
Encrypt your data at rest. Control the keys yourself.
Encrypt your data in transit. Control the keys yourself.
Encrypt your keys. Fuck it, go whole hog if you're that worried about it.
But Apple aren't in any different position to anybody else, and photographing motherboards? Fuck me, get a life.
You guys remember when we'd read about some random individual doing paranoid crap like this, and our first response would be to make fun of the wacko?
Those were the good old days...
#DeleteChrome
Because everyone knows that the US is the only country that spies on people ;-) Surely those good EU countries would never stoop to things like this:
http://www.telegraph.co.uk/tec...
The iPhones they used to take the photos with had also been tampered with and edited the images
It's quite sad that in the United States of America, of all places, this is now a legitimate and very real concern. What in the hell happened to this country?
At what point in your version of history has industrial espionage never been a concern?
The same thing that happens to every country.
You see, there is a subset of humans that are interested in having power over other humans. That is their primary drive. Over time such people infect all levels of government, law enforcement, and the upper tier of wealthy business controllers. Each and every day, they find ways of using the power they have to gain even more power, and they never get tired of doing this, and they never give up when defeated.
Your privacy is a degree of personal power that you would like to keep for yourself. Unfortunately, they want it, and you can't both have it. So, they have taken it.
Everything that you (and the majority of your social class) aren't willing to violently defend will eventually be taken from you.
You know, 15 years ago, give or take, this would have been considered the most absurd tin-foil hat bullshit imaginable.
Suddenly, we find ourselves in a world where this makes total sense ... which scares the shit out of me.
It's like the nasty dystopian future, but without cool skater chicks and designer digital drugs.
Lost at C:>. Found at C.
when you outsource everything
-I'm just sayin'
So Apple fears that the servers it relies on for its business are not fully under Apple's control, as one's computers ought to be fully under the control of those who own the computer. The same would be true even if the servers weren't virtual. As I understand it, this is part of the reason why Google is keen to build their own hardware and takes some interest free software to run that hardware. As Edward Snowden pointed out in his recent LibrePlanet talk this is the same reason privacy-minded people can't use Apple's equipment either. Snowden mentioned this in terms of Microsoft ("I did not use Windows machines when I was in my operational phase because I couldn't trust them. Not because I knew there was a particular backdoor or anything like that but because I couldn't be sure." circa 5m54s or 8m33s in the prerelease video) but the same insecurity stemming from a lack of freedom issue applies to all proprietors, not just Microsoft.
In other words there's quite an irony here: the proprietor is coming to terms with the same lack of freedom it imposes on its customers. Apple's iThings include phones that aren't under the owner's exclusive control allowing someone other than the owner to update software on the device. Some other devices (perhaps Apple's as well) don't allow the computer owner to fully control the cryptographic keys used to sign software installed on the device, so these keys are used to keep the owner locked out of full control (or the proprietor from being fully locked out). The updates can and do come in Apple and non-Apple systems without the owner's consent in the name of "convenience" and "safety" (one must ask whose safety is being assured in this scheme) or (as some proprietor sycophants are sure to point out) keeping non-technical users from messing something up. The technical details of precisely where the non-free software lies (on the main computer, on a modem controller, on some other bit of hardware one uses with the system) are no excuses for not providing documented hardware, a means to install a fully free software system, and thus a means to fully own one's own computer.
Digital Citizen
So the servers which can't interpret this encrypted data process it how, exactly?
"National Security is the chief cause of national insecurity." - Celine's First Law
So the servers which can't interpret this encrypted data process it how, exactly?
They don't. The point of a cloud server is to store user data, not Apple's data. User's word processing documents, spreadsheets, slideshows, photoshop documents, photos, etc. Whatever they stored to iCloud rather than the local HD.
While encryption in transit is good, unfortunately encryption on the server is typically more theatre/ marketing than it is useful security. There are only two things you can do with properly encrypted data - decrypt it or send it to someone who can decrypt it. If the server can decrypt it, and the concern is that the server may be compromised, there's little point in encrypting it.
As a random example, let's consider the data of which users have purchased which songs on itunes. Apple uses that to know which songs you're allowed to stream. If it's encrypted, their server-side software can't do the lookup , so that can't be encrypted (or the server has to have the key, which amounts to the same thing).
Essentially the only data that can be usefully encrypted is files sent from a customer's device which Apple doesn't want to read or understand, they just want to send back the exact same binary blob that they received. That CAN be encrypted before it's sent to Apple. But any data that Apple needs to query, change, record, or de-duplicate can't really be usefully encrypted, in general.
It's an annoying problem, and a hard problem. There was a theory about encrypting data in such a way that you could do some very limited statistical processing on it without being able to actually read the data, but it's pretty limited so approximately nobody uses it. The one major use for data "encrypted" on the server is passwords, where you store a hash and can compare whether the password the person entered is the same as the stored hash. Though that's an important use case, it's only one use case. There aren't too many use cases for storing data you can't retrieve.
When I worked at the Google help desk in 2008, the powers to be were talking about moving away from the Lenovo laptops because they suspected that the Chinese government were putting a backdoor into the BIOS. When I did contract work for a Google data center in 2011, the only laptops I saw were MacBook Pros from Apple.
By using homomorphic encryption, of course!
Pre-industrial history of course.
1984 was not supposed to be an instruction manual.
vs. the homeopathic encryption in use now.
"Freedom in the USA is not the ability to do what you want. It is the ability to stop others from doing what THEY want"
There's nothing to see in the linked articles. Absolutely no interviews or attempt to verify. Idiotic.
Maybe does. I am however certain you dont understand cryptography.
Almost no online service saves passwords. They save a one way hash of the password. When the user puts their own password in, if the hashes match then authentication happens. For basic cloud data theres no need to have any way at all for the *server* to decrypt it.
It gets a bit more complicated when the data needs to be complicated, invoving row level encryption and all sorts of drama around how that stuff interacts, but its entirely possible.
Excuse the Unicode crap in my posts. That's an apostrophe, and slashdot is busted.
Ah, but there's your problem - to compare a hash, you need the hash the user provides. But, you can't single out the file from the disk - a (fully) encrypted disk doesn't allow you to know where files start or end.
Let's ignore the detail that Apple is not going to store the "hash" to an AppleID on a 3rd party server where the 3rd party can read it and just go with the above for the sake of argument. One solution is to store the "hash" outside the encrypted drive. Which is what happens on the iPhone itself. The decryption keys are stored outside of the user's storage.
Now lets consider that the user needs no encrypted 3rd party disk on the cloud. The Mac/iPhone/iPad encrypts each file saved on the cloud before uploading it. Decrypts it after downloading it. There is no need for a 3rd party to ever see plaintext user files, they need only upload/download cyphertext. Similarly anyone intercepting the network traffic only sees cyphertext.