Slashdot Mirror
Apple Says It's Already Fixed Many WikiLeaks Security Issues (usatoday.com)
An anonymous reader quotes a report from USA Today: Apple says many of the vulnerabilities to its devices and software that came to light in WikiLeaks' revelations of CIA cyber weapons were already fixed in its latest updates. Late Tuesday, Apple emailed the following statement to USA TODAY: "Apple is deeply committed to safeguarding our customers' privacy and security. The technology built into today's iPhone represents the best data security available to consumers, and we're constantly working to keep it that way. Our products and software are designed to quickly get security updates into the hands of our customers, with nearly 80 percent of users running the latest version of our operating system. While our initial analysis indicates that many of the issues leaked today were already patched in the latest OS, we will continue work to rapidly address any identified vulnerabilities. We always urge customers to download the latest iOS to make sure they have the most recent security updates." For its part, Samsung emailed its own statement Wednesday: "Protecting consumers' privacy and the security of our devices is a top priority at Samsung. We are aware of the report in question and are urgently looking into the matter."
I'm glad to see positive response across the board, from Apple, Samsung, and I'm sure others. Especially Apple and Samsung, though, as I have many devices from both of them in my home.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
why? Because they don't opensource a thing.
Anyone other than me believe that Apple, Samsung et al. (at a minimum) didn't look the other way before the Wikileaks dump? The OS-level issues really were unknowns for a long enough time that the CIA and other agencies could develop and deploy a playbook for hacking high value targets? What about the other elephant in the room... firmware?
Since the CIA & FBI are keeping the vulnerabilities they find secret, these companies just need to start planting spies in the CIA & FBI to find out what bugs they have on their software.
Looking for a computer support specialist for your small business? Check out
"...The technology built into today's iPhone represents the best data security available to consumers".
TrueCrypt FDE on a laptop stored in a safe.
I guess that answers whether the leaks were legitimate. The first spate of news after the leaks tried to paint a "if you've done nothing wrong" picture and adding speculation on if it was even legit.
And, of course, the "if you've done nothing wrong, you have nothing to hide" argument is complete BS when it comes to privacy issues.
And already this leak provides benefits to end-users. The more of these leaks that occur, the more the news reports them, the more people that don't have a CLUE about security will at least ask 'how secure is this device', they may not understand the answer but the market will decide & us 'geeks' are the ones that must push that market by clearly explaining which products are the 'best', which companies take security as a 'tier 1' feature of their products etc.
Push comes to shove, whether any of the information in these leaks is currently 'valid' (for various values of 'valid') doesn't matter. Its back in the spot light again & that will help society overall as vendor's feet are held to the fire. Seriously, regular consumers may have 0 clue as to the probability of the CIA 'hacking their car', but the fact its out there as a possibility discussed by the CIA as an option will hopefully make consumers aware of the security issues involved in buying vehicles that nobody actually vets for security.
At least we can hope.
I'm glad to see positive response across the board, from Apple, Samsung, and I'm sure others. Especially Apple and Samsung, though, as I have many devices from both of them in my home.
Keep an eye out for updates on "Unlocked" Phones that have switched networks. For some insane reason phones are marketed as "unlocked" when they can be used on another carrier's network, but *the security updates don't work* if you use them on the other network. These should probably be considered unmarketable and therefore not unlocked--and there should be a convenient way to pull signed security updates from the manufacturer instead of the carrier. Samsung and Apple issuing patches doesn't help if Verizon and AT&T fail to talk to each other enough for users on both networks to get the security updates, regardless of who originally installed a given phone's O/S.
Real lawyers write in C++
Many issues were patched. That isn't the same as all. And only recently? Why weren't they found and patched sooner and not conveniently just before they were to become widely known?
Which could have been just after they were tipped off rhat they were going to be leaked.
I'm more interested in this page: https://wikileaks.org/ciav7p1/cms/page_23593064.html
To me this seems to advise people working for the CIA to connect to apple.net (Apple) via CIFS (SMB share) and download some package.
Which would then suggest that Apple has a backdoor entrance for their friends at the CIA. HUH?!
There's more mention of that towerpower.apple.net host at https://wikileaks.org/ciav7p1/cms/page_38633491.html where they connect to get updates for their OS X just like normal OS X users would through other Apple servers.
they have repeatedly in the past ignored critical security flaws for up to a year, even when being bombarded with trivial solutions to it from renowed security experts. Apple will leave security holes open as long as NSA/CIA/whoever makes that decision, tells them to.
Apple is actually capable of making things relatively secure and makes choices that are unpopular but increase security (walled garden, deep restrictions on app access to platform, signing Mac apps required by default). They are looking out for people who truly cannot and will not understand security around technical devices.
Samsung meanwhile may talk a good security game, but they put out truly half-assed effort with a billion exploit channels. How about TV's that can record audio and have full android installations to exploit? They put zero thought in how to handle the security implications of this system (to be fair, Amazon and Google are not far behind with Alexa like devices). Samsung and other companies consider user convenience first and security second - if at all.
As for the rest of your absurd anti-Trump fantasy - Russia expected Hillary to win too. They only reason they gathered so much from the DNC was so that they'd have dirt to hold over on Hillary!
Trump had zero to do with Russian hacks, I would love to hear your frothing rabid explanation for how exactly Russia "hacked the election". After all, all the hackers every did was show us what Hillary and the rest of teh elite DNC members said and did when people were not looking. Hillary lost because she is even more Hillary than people thought, not because Russia.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
The CIA got wing of the fact that WikiLeaks were going to do the release and tipped off the manufacturers to reduce the amount of anything to see here.
IF they were deeply committed, they would have fixed them all by now.
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
Just so you know.
Fine. I hereby declare all claims ordinary. You're welcome. The point being is, what makes something extraordinary, both in claims and evidence. Investigating and monitoring ordinary people? "Extraordinary!"
I'd even venture to say the next few "patches" will be installing completely different yet similar "security holes". Just as soon as the CIA has been trained to use them.
Isn't it sort of a fact that the security holes haven't even been fully sorted out yet?
Dear Wikileaks, ever thought about looking at other agencies? I don't like child porn either, but I also don't like the thought of dictatorship governments killing people for free speech. I'm sure a few members could appreciate the concern. Help the Tor team fix this. The FBI has literally dropped child porn cases just to protect the vulnerability existence. This is wrong. They also run most of those websites to trap people. If they are really that against it, how about not being the main supplier?
Its almost like they knew about them and had fixes already in storage for those there exploits!!! Genius?? Nefarious?? You decide!!!
I was just thinking the other day, the insanity of this Russia stuff is just like those idiots that kept claiming Obama was not born in the U.S.
Great comparison.
"There is more worth loving than we have strength to love." - Brian Jay Stanley