Slashdot Mirror
Apple Worries Spy Technology Has Been Secretly Added To Computer Servers It Buys (businessinsider.com)
An anonymous reader writes: According to Business Insider, "[Apple] worries that some of the equipment and cloud services it buys has been compromised by vendors who have agreed to put "back door" technology for government spying, according to a report from The Information's Amir Efrati and Steve Nellis." With many of its cloud-based services like iTunes, the App Store, and iCloud requiring enormous data center to operate, Apple hasn't been able to build all the data centers it needs, and has instead been using services from its rivals, namely Amazon Web Services and Microsoft. Google recently landed Apple as a customer for the Google Cloud Platform. "Meanwhile, [Apple] has embarked on yet another attempt to build more of its own data centers to handle all of that, called Project McQueen, reports Jordan Novet at VentureBeat, and the project is having a rough go of it, reports The Information." Apple suspects that backdoors have been added to many of the servers it has been ordering from others. "At one point, the company even had people taking photographs of the motherboards in the computer servers it was using, then mark down exactly what each chip was, to make sure everything was fully understood."
I know it's a crazy idea, but maybe if Apple built their own servers, they wouldn't have to worry about that. Maybe they could even sell a few of them to other companies.
Nah. Crazy idea. Forget I mentioned it.
Assume your cloud service provider isn't secure.
Fuck backdoors, you can't vet their security or admin staff, you can't adequately audit their processes, you can't believe the marketing bullshit they produce.
So assume they're not secure.
How you deal with it isn't paranoia. Don't be bloody stupid.
Encrypt your data at rest. Control the keys yourself.
Encrypt your data in transit. Control the keys yourself.
Encrypt your keys. Fuck it, go whole hog if you're that worried about it.
But Apple aren't in any different position to anybody else, and photographing motherboards? Fuck me, get a life.
You guys remember when we'd read about some random individual doing paranoid crap like this, and our first response would be to make fun of the wacko?
Those were the good old days...
#DeleteChrome
It's quite sad that in the United States of America, of all places, this is now a legitimate and very real concern. What in the hell happened to this country?
At what point in your version of history has industrial espionage never been a concern?
The same thing that happens to every country.
You see, there is a subset of humans that are interested in having power over other humans. That is their primary drive. Over time such people infect all levels of government, law enforcement, and the upper tier of wealthy business controllers. Each and every day, they find ways of using the power they have to gain even more power, and they never get tired of doing this, and they never give up when defeated.
Your privacy is a degree of personal power that you would like to keep for yourself. Unfortunately, they want it, and you can't both have it. So, they have taken it.
Everything that you (and the majority of your social class) aren't willing to violently defend will eventually be taken from you.
You know, 15 years ago, give or take, this would have been considered the most absurd tin-foil hat bullshit imaginable.
Suddenly, we find ourselves in a world where this makes total sense ... which scares the shit out of me.
It's like the nasty dystopian future, but without cool skater chicks and designer digital drugs.
Lost at C:>. Found at C.
While encryption in transit is good, unfortunately encryption on the server is typically more theatre/ marketing than it is useful security. There are only two things you can do with properly encrypted data - decrypt it or send it to someone who can decrypt it. If the server can decrypt it, and the concern is that the server may be compromised, there's little point in encrypting it.
As a random example, let's consider the data of which users have purchased which songs on itunes. Apple uses that to know which songs you're allowed to stream. If it's encrypted, their server-side software can't do the lookup , so that can't be encrypted (or the server has to have the key, which amounts to the same thing).
Essentially the only data that can be usefully encrypted is files sent from a customer's device which Apple doesn't want to read or understand, they just want to send back the exact same binary blob that they received. That CAN be encrypted before it's sent to Apple. But any data that Apple needs to query, change, record, or de-duplicate can't really be usefully encrypted, in general.
It's an annoying problem, and a hard problem. There was a theory about encrypting data in such a way that you could do some very limited statistical processing on it without being able to actually read the data, but it's pretty limited so approximately nobody uses it. The one major use for data "encrypted" on the server is passwords, where you store a hash and can compare whether the password the person entered is the same as the stored hash. Though that's an important use case, it's only one use case. There aren't too many use cases for storing data you can't retrieve.
Pre-industrial history of course.
1984 was not supposed to be an instruction manual.